Page 1 of 2

End-to-End Encryption of PMs

Posted: Thu Dec 08, 2022 7:00 pm
by SearchVoat
In User Control Panel there's a tab End-to-end PM encryption then hit Generate New Keys. That creates a pair of keys and stores the Public Key on the server (for senders to encrypt when they send to you) and stores the Private Key in your browser (for decryption).

Then when you PM someone who has set it up there's an Encrypt for [Username] option. When you receive an encrypted email you have an unlock button (looks like an unlocked padlock). It's all displayed within the web page so it looks like it might be handled by the server but in fact it's all Javascript within the browser, plaintext never gets to the server*.

*You can test this, or anyone moderately tech-savvy can, by watching the network traffic between your browser and the website. You will see the Public Key and encrypted messages but not the Private Key or plaintext messages. Also, the Javascript is clear and commented in the Page Source so you can view the algorithm. The OpenPGP Javascript library is

Code: Select all

/*! OpenPGP.js v5.5.0 - 2022-08-31 - this is LGPL licensed code, see LICENSE/our website https://openpgpjs.org/ for more information. */
Test by sending me one.

It's pretty fragile so not very dependable, but if you see Encrypt/unlock it's guaranteed private. The problem is that every time you hit Generate New Keys new ones are created and the old ones are lost, so any messages in transit or already in your Inbox become unreadable. Also currently no way for you to disable it at the receiving end, although of course I can delete the Public Key at the server so it can be disabled manually.

Re: End-to-End Encryption of PMs

Posted: Thu Dec 08, 2022 8:24 pm
by doginventer

Re: End-to-End Encryption of PMs

Posted: Thu Dec 08, 2022 8:28 pm
by SearchVoat
doginventer wrote: Thu Dec 08, 2022 8:24 pm
Literally lol

Re: End-to-End Encryption of PMs

Posted: Thu Dec 08, 2022 11:57 pm
by shewhomustbeobeyed
doginventer wrote: Thu Dec 08, 2022 8:24 pm
That kitty at the end, must have just read this. :/
it's not easy being a techtard

Re: End-to-End Encryption of PMs

Posted: Fri Dec 09, 2022 7:24 pm
by SearchVoat
If you think it's worthwhile I can put more work into this to make it more elegant and reliable. So far it's purely experimental.

Please comment here with observations, suggestions.

Re: End-to-End Encryption of PMs

Posted: Fri Dec 09, 2022 10:05 pm
by doginventer
I can’t think of any particular use I would have for this feature at the moment but who knows in the future.
I think that just in principle increasing the functionality of the site should be a net positive.
Thanks as always for all your work SV, and hope you have a good weekend.

Re: End-to-End Encryption of PMs

Posted: Sat Dec 10, 2022 8:32 pm
by shewhomustbeobeyed
SearchVoat wrote: Fri Dec 09, 2022 7:24 pm If you think it's worthwhile I can put more work into this to make it more elegant and reliable. So far it's purely experimental.

Please comment here with observations, suggestions.
Would it be very hard to make it so that we can block mods from sending PMs? Except from you, ofc. I want to specifically block those PMs, not regular users. ;)

Re: End-to-End Encryption of PMs

Posted: Sat Dec 10, 2022 8:45 pm
by SearchVoat
shewhomustbeobeyed wrote: Sat Dec 10, 2022 8:32 pm Would it be very hard to make it so that we can block mods from sending PMs? Except from you, ofc. I want to specifically block those PMs, not regular users. ;)
Not sure - I just tested by setting the user as "Foe" but that doesn't seem to prevent messaging.

You can set up a rule to discard messages without being notified:

Image

but that doesn't tell the sender they've been blocked. Is that good enough?

Re: End-to-End Encryption of PMs

Posted: Sat Dec 10, 2022 9:00 pm
by shewhomustbeobeyed
Would the mods have to be individually listed by name, or would using the term 'moderator' work?
Or how about being able to block all PMs?

Re: End-to-End Encryption of PMs

Posted: Sat Dec 10, 2022 11:47 pm
by SearchVoat
This would "block" all PMs:

Image