How hard would it be to develop an add-on app of some sort that GPG-encrypts messages before you send them. Something like a textbox that encrypts its content, copies it to the clipboard, and then pastes it into the message app. Vice-versa on the receiving side.
It's becoming clear that if you want to keep the government and tech companies from snooping on your messages you need to take matters into your own hands.
GPG is probably not the best choice for IM because it lacks Perfect Forward Secrecy. Meaning if someone obtains the key they can read all consent ever encrypted with it both past and present.
PFS requires that both endpoints communicate together so for email's "fire and forget" structure it didn't make sense. But for IM it sure does.
note that with email, you can still choose to advance the ratchet every time a round trip happens by pure coincidence or whatever.
There's also deniable authentication: in the case of email, a simple pre-shared key (instead of public/private) means that the recipient of an email can't prove they didn't forge it.
Of course it does. The attacker just has to steal your token and pin. Because it's unique (well it should be if you generated the key on token as you should have) it's not possible to do so without the target's knowledge. But you can still decypher all past intercepts with it.
Also, some types of tokens like the original openpgp card don't have touch to sign functionality. So it's possible to 'milk' them for decrypts though the gpg agent. This is why I only use Yubikeys now that do have this functionality (though by default it's off!)
Definitely. I was doing EE2E with friends using Pidgin and OTR plugin (just because it was possible, not that we were discussing anything sensitive) over ICQ and MSN... so ages before TextSecure (now Signal) was even a thing.
The tricky bit is the auto-paste into and auto-copy out of the message app where the people that make the app might be actively hostile to your activity. See Mailvelope[1] for an example of doing this sort of thing for webmail.
If you are willing to do things manually then PGP works with anything already.
It's becoming clear that if you want to keep the government and tech companies from snooping on your messages you need to take matters into your own hands.