Public
- Public
- Network
- Groups
- Featured
- Popular
- People

Conversation

Notices

Embed this notice
Sally (sally@shitposter.world)'s status on Monday, 26-Aug-2024 04:56:29 JST Sally
@dlatchx
@SuperDicq @sampo @lanodan @hj

Are you? Even if you have the private key it requires a passphrase, without it the key itself is useless.

In conversation about 3 months ago from shitposter.world permalink
- Embed this notice
  SuperDicq (superdicq@minidisc.tokyo)'s status on Monday, 26-Aug-2024 04:56:28 JST SuperDicq
  in reply to
  @sally@shitposter.world @dlatchx@fedi.tfnux.org @sampo@pleroma.soykaf.com @lanodan@queer.hacktivis.me @hj@shigusegubu.club Forward secrecy is indeed something that GPG does not have.
  
  However forward secrecy is only thing you can do with realtime client-server applications.
  
  It is not possible to implement forward secrecy in decentralized solutions. You just have to be not stupid and don't leak your keys and passphrases.
  
  In conversation about 3 months ago permalink
- Embed this notice
  Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Monday, 26-Aug-2024 04:59:53 JST Haelwenn /элвэн/ :triskell:
  in reply to
  @SuperDicq @hj @sampo @dlatchx @sally You can have forward-secrecy with decentralisation (Both XMPP+OMEMO and Matrix have it), but not if you use a non-realtime protocol like email which is the intended communication protocol for OpenPGP.
  
  In conversation about 3 months ago permalink
- Embed this notice
  SuperDicq (superdicq@minidisc.tokyo)'s status on Monday, 26-Aug-2024 05:01:35 JST SuperDicq
  in reply to
  @lanodan@queer.hacktivis.me @hj@shigusegubu.club @sampo@pleroma.soykaf.com @dlatchx@fedi.tfnux.org @sally@shitposter.world XMPP and Matrix are both realtime client-server applications indeed, as I said. That makes forward secrecy possible.
  
  Maybe I shouldn't have mentioned decentralized.
  
  If you want to encrypt any sort of information that is not transported over a realtime client-server application you can not implement forward secrecy.
  
  In conversation about 3 months ago permalink
- Embed this notice
  Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Monday, 26-Aug-2024 05:06:28 JST Haelwenn /элвэн/ :triskell:
  in reply to
  @SuperDicq @hj @sampo @dlatchx @sally Yeah, the only thing you can do without realtime is key-rotation with explicit timeframes, possibly even keys published well in advance so you can easily switch right after even a potential compromise.
  
  Something which OpenPGP in theory allows and in fact the design of having subkeys should help but in practice it's unusable.
  
  In conversation about 3 months ago permalink
- Embed this notice
  SuperDicq (superdicq@minidisc.tokyo)'s status on Monday, 26-Aug-2024 05:09:34 JST SuperDicq
  in reply to
  @sally@shitposter.world @hj@shigusegubu.club @sampo@pleroma.soykaf.com @lanodan@queer.hacktivis.me @dlatchx@fedi.tfnux.org Yes, but encryption is not part of that protocol.
  
  In conversation about 3 months ago permalink
- Embed this notice
  Sally (sally@shitposter.world)'s status on Monday, 26-Aug-2024 05:09:35 JST Sally
  in reply to
  @SuperDicq
  @hj @sampo @lanodan @dlatchx
  
  Isn't push-IMAP realtime though.
  
  In conversation about 3 months ago permalink
- Embed this notice
  Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Monday, 26-Aug-2024 05:11:16 JST Haelwenn /элвэн/ :triskell:
  in reply to
  @sally @dlatchx @SuperDicq @sampo @hj SMTP is on timeframe of days, way too slow for an handshake that gets invalidated after some time.
  
  DeltaChat style of abuse of the protocol could maybe try to get handshakes but at that point… use another protocol.
  
  In conversation about 3 months ago permalink

Feeds