End-to-End Encryption of PMs

[SearchVoat]

In User Control Panel there's a tab End-to-end PM encryption then hit Generate New Keys. That creates a pair of keys and stores the Public Key on the server (for senders to encrypt when they send to you) and stores the Private Key in your browser (for decryption).

Then when you PM someone who has set it up there's an Encrypt for [Username] option. When you receive an encrypted email you have an unlock button (looks like an unlocked padlock). It's all displayed within the web page so it looks like it might be handled by the server but in fact it's all Javascript within the browser, plaintext never gets to the server*.

*You can test this, or anyone moderately tech-savvy can, by watching the network traffic between your browser and the website. You will see the Public Key and encrypted messages but not the Private Key or plaintext messages. Also, the Javascript is clear and commented in the Page Source so you can view the algorithm. The OpenPGP Javascript library is

Code: Select all

/*! OpenPGP.js v5.5.0 - 2022-08-31 - this is LGPL licensed code, see LICENSE/our website https://openpgpjs.org/ for more information. */

Test by sending me one.

It's pretty fragile so not very dependable, but if you see Encrypt/unlock it's guaranteed private. The problem is that every time you hit Generate New Keys new ones are created and the old ones are lost, so any messages in transit or already in your Inbox become unreadable. Also currently no way for you to disable it at the receiving end, although of course I can delete the Public Key at the server so it can be disabled manually.

[doginventer]

https://files.catbox.moe/15izlj.mp4

[SearchVoat]

https://files.catbox.moe/15izlj.mp4

Literally lol

[shewhomustbeobeyed]

https://files.catbox.moe/15izlj.mp4

That kitty at the end, must have just read this. :/
it's not easy being a techtard

[SearchVoat]

If you think it's worthwhile I can put more work into this to make it more elegant and reliable. So far it's purely experimental.

Please comment here with observations, suggestions.

[doginventer]

I can’t think of any particular use I would have for this feature at the moment but who knows in the future.
I think that just in principle increasing the functionality of the site should be a net positive.
Thanks as always for all your work SV, and hope you have a good weekend.

[shewhomustbeobeyed]

If you think it's worthwhile I can put more work into this to make it more elegant and reliable. So far it's purely experimental.

Please comment here with observations, suggestions.

Would it be very hard to make it so that we can block mods from sending PMs? Except from you, ofc. I want to specifically block those PMs, not regular users. ;)

[SearchVoat]

Would it be very hard to make it so that we can block mods from sending PMs? Except from you, ofc. I want to specifically block those PMs, not regular users.

Not sure - I just tested by setting the user as "Foe" but that doesn't seem to prevent messaging.

You can set up a rule to discard messages without being notified:



but that doesn't tell the sender they've been blocked. Is that good enough?

[shewhomustbeobeyed]

Would the mods have to be individually listed by name, or would using the term 'moderator' work?
Or how about being able to block all PMs?

[SearchVoat]

This would "block" all PMs: