41
submitted 1 year ago* (last edited 1 year ago) by umami_wasbi@lemmy.ml to c/privacy@lemmy.ml

We all know PGP is old and got a myriad of problems, like key management.

Thus, I'm looking for a generic encryption and signing tool that also available on mobile devices, both Android and iOS.

I know age+minisign is the preferred choice but unfortunately there ain't an mobile app for them.

I know Magic Wormhole is great for P2P data transfer but it's slow and not reliable. I often have corrupted files even the size is small. I would much rather encrypt locally, upload to GDrive, and share it.

I know Signal, WhatsApp and other messaging apps now offers E2EE to exchange many data forms but the political sphere is shifting and given the current trend, they might forced to backdoor the protocol, drop E2EE entirely, or cease operation. Something independent from messaging tool is needed.

I'm not seeking perfect forward secrecy as that wasn't achievable for non conversations use case unless parties manually negotiate a session key.

I don't care the web of trust either. Putting PII on a key server for public viewing doesn't fit today's privacy trend.

Nor anonymity. I'm talking to my family members and friends and I don't find a reason to hide that. The only thing matters is the content.

While it will be great to follow some kind of widely used standards, it is not a requirement.

Thanks for the input.

EDIT: Added GPG to the title

you are viewing a single comment's thread
view the rest of the comments
[-] umami_wasbi@lemmy.ml 1 points 1 year ago

So you have two keys: master and ephemeral key. Both are independent to each other. Mater doesn't expire and ephemeral will have a short period of validity.

You kept the master key secure, and using it to certify the ephemeral key with a expire date?

You still need to publish the master's public key to key server for everyone knows and verify you signed the ephemeral key isn't?

[-] adespoton@lemmy.ca 2 points 1 year ago

No, they just have to know that the signer hash is the same for each ephemeral key in the chain. If someone required more validation than that, I’d have to share the public key, but in real life that’s never come up.

[-] umami_wasbi@lemmy.ml 2 points 1 year ago

Please correct me if I misunderstood.

You have one master key (root). This key have strong connection to your identity. However, you kept this in secret.

You have one or more ephemeral keys (edge). You can dedicate each key for different purposes. You sign these keys with the root key.

If I'm not mistaken, it's essentially the "Web of Trust". How do people trust your edge keys without knowing the root's public key by "the signer hash is the same"? While I can see the certification on your edge key, I can't build a trust path as I don't have your root's public key.

I don't really understand "each ephemeral key in the chain". What chain actually? Chain as in " Web of Trust"? Or as in subkeys?

this post was submitted on 13 Sep 2023
41 points (93.6% liked)

Privacy

31885 readers
539 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS