How to Use Mailvelope for Encrypted Email on Gmail

Read Time:2 Minute, 55 Second

The content of this post is solely the responsibility of the author.  LevelBlue does not adopt or endorse any of the views, positions, or information provided by the author in this article. 

In the previous blog we covered how to use PGP keys for encrypting and decrypting emails on desktop clients like Thunderbird and Outlook. Now, let’s take a look on securing your emails without too much hassle using OpenPGP on webmail services like Gmail using the Mailvelope extension for Google Chrome.

Setting Up Mailvelope on Google Chrome

To smoothen the process login to your webmail before proceeding to further steps, in this scenario login to your gmail account and follow further steps:

Install Mailvelope Extension:

Go to the Browser Web Store. Since we are using Google Chrome we will head to Chrome Web Store

Search for Mailvelope: In the search bar, type “Mailvelope” and press Enter, alternatively you can directly access mailvelope browser extension here

Add to Chrome: Click on the Mailvelope extension from the search results, and then click the “Add to Chrome” button. Confirm the installation by clicking “Add extension” in the pop-up window.

Access Mailvelope:

Go to the Extensions Toolbar: Once Mailvelope is installed, go to the extensions icon (a puzzle piece) in the Chrome toolbar.

Select Mailvelope: Click on the Mailvelope icon and select “Let’s start.”

You will be taken to the Mailvelope Key Management page. Since this is your first time using Mailvelope, you will need to generate a new pair of keys. On the Key Management page, click the “Generate Key” button.

You will be prompted to fill out a form. Enter your name and email address. Under the advanced tab, you can set the algorithm (usually RSA), key size (at least 2048 bits for good security), and key expiration date. Additionally, set a strong password to validate your key.

Generate the Key:

After entering your details, click “Generate.”

The key generation process will take a moment as Mailvelope works its magic in the background. Once the keys are generated, you will see a message saying that the new key has been generated and imported into your key ring. You will also receive an email for account verification.

Voila! an encrypted email. Click on show message and enter the password you setup during the key generation process to decrypt the email.

After that follow the verification link in email to verify your account. Congratulations, your PGP keys are now set up! (If you already generated a PGP key pair using the steps from the previous article, you can import them into Mailvelope instead of generating new ones using import key option on the key management page.)

Now that your keys are set up, you can start sending and receiving encrypted emails.

Click on the mailvelope icon adjacent to compose in gmail, now the extension will ask required permissions to read and send email. After that you will be prompted with a compose secure email form.

Choose the recipient’s public key from your key ring and complete the encryption process. After that you will be required to sign the message by providing the Key password

Mailvelope makes it easy to send and receive encrypted emails directly from your web browser. By following these steps, you can ensure that your email communications remain private and secure. Remember, while Mailvelope is a convenient tool, there are other solutions available, and you should choose the one that best fits your needs. Stay safe and keep your digital communications protected!

Read More

USN-6966-1: Firefox vulnerabilities

Read Time:1 Minute, 2 Second

Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2024-7518,
CVE-2024-7521, CVE-2024-7524, CVE-2024-7526, CVE-2024-7527, CVE-2024-7528,
CVE-2024-7529, CVE-2024-7530, CVE-2024-7531)

It was discovered that Firefox did not properly manage certain memory
operations when processing graphics shared memory. An attacker could
potentially exploit this issue to escape the sandbox. (CVE-2024-7519)

Nan Wang discovered that Firefox did not properly handle type check in
WebAssembly. An attacker could potentially exploit this issue to execute
arbitrary code. (CVE-2024-7520)

Irvan Kurniawan discovered that Firefox did not properly check an attribute
value in the editor component, leading to an out-of-bounds read
vulnerability. An attacker could possibly use this issue to cause a denial
of service or expose sensitive information. (CVE-2024-7522)

Rob Wu discovered that Firefox did not properly check permissions when
creating a StreamFilter. An attacker could possibly use this issue to
modify response body of requests on any site using a web extension.
(CVE-2024-7525)

Read More

USN-6837-2: Rack vulnerabilities

Read Time:34 Second

It was discovered that Rack incorrectly parsed certain media types. A
remote attacker could possibly use this issue to cause Rack to consume
resources, leading to a denial of service. This issue only affected
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-25126)

It was discovered that Rack incorrectly handled certain Range headers. A
remote attacker could possibly use this issue to cause Rack to create
large responses, leading to a denial of service. (CVE-2024-26141)

It was discovered that Rack incorrectly handled certain crafted headers. A
remote attacker could possibly use this issue to cause Rack to consume
resources, leading to a denial of service. (CVE-2024-26146)

Read More