Home | Community | Message Board
You are not signed in.
Sign In New Account
Forum Index Search Posts Trusted Vendors Highlights Galleries FAQ User List Chat Store Random Growery


This site includes paid links. Please support our sponsors.

Feedback and Administration > Website Announcements and Feature Feedback
Threaded Mode Threaded  Previous topic Previous  View all topics Index  Next topic Next 

Welcome to the Shroomery Message Board! You are experiencing a small sample of what the site has to offer. Please login or register to post messages and view our exclusive members-only content. You'll gain access to additional forums, file attachments, board customizations, encrypted private messages, and much more!

Jump to first unread post Pages: 1
Encryption program as part of messages?
    #25833868 -

So I've been teaching a member to use encryption, and we've been exchanging encrypted messages for a few days so he can get comfortable with it.

The last message I received had a box asking for my pass phrase and then my private key? Is this a new thing, and if not why did it only show up now?



I wouldn't want to give that information to the website,  and I guess it seems a bit sus.

I mean, I guess I can understand that if someone was pulling a sheekle, the site would want to know...

Is it an attempt for admins to gain the information to read and monitor encrypted messages on the site? Or is it just a new feature for easy encryption? Or both...

Thanks


--------------------
"To the young it gives a vision of the dead and gone. While the old receive a passion to survive,
and the pattern picks the pockets of the palindrome, before the oscillating rhythm takes to flight..." - Rishloo


Extras: Filter Print Post Top
Re: Encryption program as part of messages? [Re: brk] * 1
    #25839625 -

It is for easy encryption since 99% of people here won't do client-side encryption.

Admin knows that this is poor security practice, and I've been trying to get people including the site to move toward client side encrypted messages.

I think your PGP block got tagged as a PGP formatted message and the server side encryption styling/code was activated. It won't work even if you enter the right info.

Just ignore it and copy the block and decrypt as you normally would.


--------------------
Let's upgrade our security practices and move toward client-side PGP for encrypted PMs.
My Public PGP Key: hxxps://www.shroomery.org/forums/showflat.php/Number/24002249#24002249

Extras: Filter Print Post Top
Re: Encryption program as part of messages? [Re: naum] * 1
    #25840235 -

Yes as naum said, encryption operations are performed on our server which is why you sometimes may be prompted to re-upload your private key. This key is never stored on our server - just used and discarded - but it is temporarily saved in your computer's web browser for convenience and securely transmitted when you decrypt a PM. If you log out, switch browsers, or clear your cookies, you may be prompted to re-upload the private key file. Nothing sketchy, that's just how it's designed to work.

I agree with naum's point that client-side encryption is the gold standard for private correspondence. However, providing this as a web service is a complicated problem. Even if we switch to a client-side model where all encryption and decryption is performed on your computer, it would still require you to download and execute arbitrary code from our site. If we were hacked or coerced, this would be just as easy to compromise as the current setup we're using. So I think it would do more to provide a false sense of security than anything else. Secure PMs are intended to provide a degree of protection against hacking, snooping, or subpoenas, but they aren't perfect. You have to trust that our site is not compromised at the moment when you receive or decrypt a secure PM.

Ultimately, you just can't just depend on random Javascript served from a website to provide secure encryption. There are too many weak links to attack. You need to be using audited, open-source encryption software on your own secure PC, verify the executable's checksum, and perform all sensitive operations locally.

Striking a good balance between security and usability is an ongoing challenge and I welcome all suggestions!

Extras: Filter Print Post Top
Re: Encryption program as part of messages? [Re: Ythan]
    #25840335 -

Thanks guys, that makes sense. I'll stick with kleopatra for encryption. Cheers for the clarification.


--------------------
"To the young it gives a vision of the dead and gone. While the old receive a passion to survive,
and the pattern picks the pockets of the palindrome, before the oscillating rhythm takes to flight..." - Rishloo


Extras: Filter Print Post Top
Jump to top Pages: 1

Feedback and Administration > Website Announcements and Feature Feedback
Threaded Mode Threaded  Previous topic Previous  View all topics Index  Next topic Next 

Similar ThreadsPosterViewsRepliesLast post
* New Feature: Secure Private Messages!
( 1 2 3 4 all )		 YthanA 15,581 76 05/03/15 01:33 PM
by milonix
* Request to have encrypted message key reset... Le_Canard 521 2 12/18/05 11:19 AM
by WhiteBunny
* How do I make it so I only receive encrypted messages? myndreach 1,088 6 05/30/07 11:17 PM
by Legend9123
* Secure Private Messages delta9 1,422 11 08/13/05 03:45 PM
by delta9
* Encrypted messages??? unknown28 420 0 09/27/05 05:20 PM
by unknown28
* forwarding encrypted PM's Dragonaut 637 3 09/21/05 12:18 AM
by Ythan
* Re: Private Message service buggered ? Psylosymon 1,189 6 12/02/99 12:16 PM
by Psylosymon
* My encryption key is fucked up Dark_Star 451 4 08/10/06 10:02 PM
by Dark_Star

Extra information
You cannot start new topics / You cannot reply to topics
HTML is disabled / BBCode is enabled
Moderator: Ythan, Thor, Seuss, geokills
376 topic views. 0 members, 29 guests and 5 web crawlers are browsing this forum.
[ Show Images Only | Sort by Score | Print Topic ]
Search this thread:

Copyright 1997-2026 Mind Media. Some rights reserved.

Generated in 0.023 seconds spending 0.006 seconds on 16 queries.