Helvede

0 posts0 participants0 posts today

Delta Chat<a href="https://fosstodon.org/@triskelion" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@triskelion</a> Proton Mail uses <a href="https://chaos.social/tags/OpenPGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenPGP</a> standard and it is possible to send and receive encrypted messages between Delta Chat and Proton Mail. It is not straightforward currently but we work on making it easier by allowing to share the keys in vCards. Delta Chat cannot be used as a client for Proton Mail because Proton Mail does not allow the clients to use SMTP and IMAP to directly access mailboxes.Tuta cannot be used to send and receive encrypted e-mail because it does not support OpenPGP.

Delta ChatSome of you may have heard of <a href="https://chaos.social/tags/simplex" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#simplex</a> which likes to elevate itself as "the first messenger without user-ids" ... a goal, similar to ours, of not letting the transport layer know about who talks. Only we are doing it in the email system, fully interoperable with tens of thousands of existing email servers and other <a href="https://chaos.social/tags/openpgp" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openpgp</a> endpoints. The email system is much more than SMTP/IMAP or even openpgp btw ... there is plenty of room for radical shifts and new takes. We are just starting :)

Delta Chat<a href="https://chaos.social/tags/openpgp" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openpgp</a> traditions and <a href="https://chaos.social/tags/signal" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#signal</a> both bind a cleartext identifier, phone number or email address, to a cryptographic key. It opens up attack vectors as the servers/orgs controlling this binding can interfere.<a href="https://chaos.social/tags/deltachat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#deltachat</a> avoids such cleartext identity bindings by creating random <a href="https://chaos.social/tags/chatmail" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#chatmail</a> addresses, as transport only. The cryptographic key becomes the identifier and we want it hidden from the transport layer. Only people being in end-to-end encrypted chat need to identify each other, after all.

Karl Voit :emacs: :orgmode:If you need <a href="https://graz.social/tags/E2EE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#E2EE</a> via <a href="https://graz.social/tags/email" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#email</a>, the only 2 valid standards are <a href="https://graz.social/tags/OpenPGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenPGP</a> and <a href="https://graz.social/tags/SMIME" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SMIME</a>. It's not that those are without issues but everything else is mediocre.Yes, you can switch to non-email-services as well such as <a href="https://graz.social/tags/Signal" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Signal</a>. But that's a different island.<a href="https://graz.social/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a> <a href="https://graz.social/tags/encryption" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#encryption</a> <a href="https://graz.social/tags/mail" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mail</a> <a href="https://graz.social/tags/GMail" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GMail</a>

Ivan GJDelta Chat es demasiado buena 🔥 <a href="https://fediverse.tv/videos/watch/21b54e75-f8ae-4a61-919c-a7d264f67b57" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://fediverse.tv/videos/watch/21b54e75-f8ae-4a61-919c-a7d264f67b57</a>

Preston Maness ☭<a href="https://mastodon.ml/@Xeniax" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@Xeniax</a> Totally nerdsniped :D I'd love to be a part of the study.I don't think that <a href="https://tenforward.social/tags/KeyServers" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#KeyServers</a> are dead. I think they evolved into Verifying Key Servers (VKS), like the one run by a few folks from the OpenPGP ecosystem at <a href="https://keys.openpgp.org/about" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://keys.openpgp.org/about</a> . More generally, I believe that <a href="https://tenforward.social/tags/PGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PGP</a> / <a href="https://tenforward.social/tags/GPG" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GPG</a> / <a href="https://tenforward.social/tags/OpenPGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenPGP</a> retains important use-cases where accountability is prioritized, as contrasted with ecosystems (like <a href="https://tenforward.social/tags/Matrix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Matrix</a>, <a href="https://tenforward.social/tags/SignalMessenger" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SignalMessenger</a>) where deniability (and Perfect Forward Secrecy generally) is prioritized. Further, PGP can still serve to bootstrap those other ecosystems by way of signature notations (see the <a href="https://tenforward.social/tags/KeyOxide" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#KeyOxide</a> project).Ultimately, the needs of asynchronous and synchronous cryptographic systems are, at certain design points, mutually exclusive (in my amateur estimation, anyway). I don't think that implies that email encryption is somehow a dead-end or pointless. Email merely, by virtue of being an asynchronous protocol, cannot meaningfully offer PFS (or can it? Some smart people over at crypto.stackexchange.com seem to think there might be papers floating around that can get at it: <a href="https://crypto.stackexchange.com/questions/9268/is-asynchronous-perfect-forward-secrecy-possible" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://crypto.stackexchange.com/questions/9268/is-asynchronous-perfect-forward-secrecy-possible</a>).To me, the killer feature of PGP is actually not encryption per se. It's certification, signatures, and authentication/authorization. I'm more concerned with "so-and-so definitely said/attested to this" than "i need to keep what so-and-so said strictly private/confidential forever and ever." What smaller countries like Croatia have done with <a href="https://tenforward.social/tags/PKI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PKI</a> leaves me green with envy.

l<a href="https://mastodon.social/@eff" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@eff</a> <a href="https://hachyderm.io/@evacide" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@evacide</a> GnuPG is not the only way to encrypt email, I use <a href="https://fosstodon.org/tags/OpenPGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenPGP</a> with Thunderbird and <a href="https://chaos.social/@delta" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@delta</a>, both don't use GPG.Also pages <a href="https://ssd.eff.org/module/how-use-pgp-linux" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://ssd.eff.org/module/how-use-pgp-linux</a> and <a href="https://ssd.eff.org/module/how-use-pgp-windows" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://ssd.eff.org/module/how-use-pgp-windows</a> are outdated, Thunderbird now has built-in OpenPGP implementation and Enigmail does not work with the latest versions.

Delta ChatWe are not aware of other FOSS development teams that have as extensive knowledge, both theoretical and practical, about <a href="https://chaos.social/tags/email" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#email</a> and <a href="https://chaos.social/tags/openpgp" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openpgp</a> and regularly release across all platforms for users world wide ... except for <a href="https://chaos.social/tags/protonmail" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#protonmail</a> with whose technical and security experts we discuss regularly. They are the other major game in town doing pervasive email encryption after all. Did you know that Proton's and delta's VCards are compatible across ecosystems and establish immediate encryption?

Delta Chat<a href="https://jura.social/@mathilde" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@mathilde</a> <a href="https://chaos.social/tags/chatmail" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#chatmail</a> server users don't have these problems because they don't even need to know their password or email address. Messages in delta chat are stored locally and the server only stores them for a limited time, up to 20 days by default, so all devices have a chance to download the message. Blocklists are also not used, the only requirements are <a href="https://chaos.social/tags/DKIM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DKIM</a> signature and <a href="https://chaos.social/tags/OpenPGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenPGP</a> encryption.

Delta ChatThe downside of our project approach was that we often got experts being very dismissive on re-using email and <a href="https://chaos.social/tags/OpenPGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenPGP</a> ... and there still is some opposition which often subsides when actually trying <a href="https://chaos.social/tags/deltachat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#deltachat</a> and <a href="https://chaos.social/tags/chatmail" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#chatmail</a>, looking at security audits and our strong usable security focus. There may also be surprising upsides. The UK "Online Safety Bill" which attacks end-to-end encryption integrity seems to not apply for ... e-mail. Because everyone knows, e-mail is unencrypted, right? :)

Em :official_verified:New Privacy Guides article 🔑✨ by me: If you are using a YubiKey, you might get in some situations where you need to reset your key to factory default, and/or set up a backup of it on a spare key.This tutorial will guide you through each step to reset and back up your YubiKey successfully, with clear instructions and plenty of visual support.I hope you find it helpful!<a href="https://www.privacyguides.org/articles/2025/03/06/yubikey-reset-and-backup/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.privacyguides.org/articles/2025/03/06/yubikey-reset-and-backup/</a><a href="https://infosec.exchange/tags/PrivacyGuides" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PrivacyGuides</a> <a href="https://infosec.exchange/tags/Privacy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Privacy</a> <a href="https://infosec.exchange/tags/Yubico" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Yubico</a> <a href="https://infosec.exchange/tags/YubiKey" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#YubiKey</a> <a href="https://infosec.exchange/tags/Security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Security</a> <a href="https://infosec.exchange/tags/OTP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OTP</a> <a href="https://infosec.exchange/tags/OpenPGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenPGP</a> <a href="https://infosec.exchange/tags/Encryption" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Encryption</a> <a href="https://infosec.exchange/tags/MFA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MFA</a>

Lars WirzeniusI've made release 0.3.0 of sopass, my command line password manager that uses a Stateless OpenPGP implementation for cryptography.* configuration file * add value from named file or stdin * default to rsop * manual page, built-in help<a href="https://sopass.liw.fi/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://sopass.liw.fi/</a><a href="https://toot.liw.fi/tags/sopass" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#sopass</a> <a href="https://toot.liw.fi/tags/pass" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pass</a> <a href="https://toot.liw.fi/tags/passwordManager" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#passwordManager</a> <a href="https://toot.liw.fi/tags/commandLine" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#commandLine</a> <a href="https://toot.liw.fi/tags/cli" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cli</a> <a href="https://toot.liw.fi/tags/openpgp" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openpgp</a> <a href="https://toot.liw.fi/tags/statelessOpenPGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#statelessOpenPGP</a> <a href="https://toot.liw.fi/tags/sop" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#sop</a>

Lars WirzeniusI made a couple of changes to sopass, my command line password manager that uses a Stateless OpenPGP implementation for cryptography.* It no longer creates the configuration file. * It has built-in help for all sub-commands, options, and other command line arguments.There is also a rudimentary manual page.<a href="https://sopass.liw.fi/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://sopass.liw.fi/</a><a href="https://toot.liw.fi/tags/paswordManager" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#paswordManager</a> <a href="https://toot.liw.fi/tags/sopass" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#sopass</a> <a href="https://toot.liw.fi/tags/pass" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pass</a> <a href="https://toot.liw.fi/tags/commandLine" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#commandLine</a> <a href="https://toot.liw.fi/tags/cli" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cli</a> <a href="https://toot.liw.fi/tags/openpgp" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openpgp</a> <a href="https://toot.liw.fi/tags/cryptography" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cryptography</a>

Rivane RasetiansyahInitializing a new project - Interplanetary Markdown. Might explore a <a href="https://fosstodon.org/tags/Web3" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Web3</a> (off-chain) approach later for a better experience, but for now, keeping it simple with good old <a href="https://fosstodon.org/tags/OpenPGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenPGP</a>.A censorship-resistant <a href="https://fosstodon.org/tags/Markdown" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Markdown</a> publishing platform, enabling seamless content distribution. Powered by the Interplanetary File System (<a href="https://fosstodon.org/tags/IPFS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IPFS</a>), ensuring <a href="https://fosstodon.org/tags/blogs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#blogs</a>, <a href="https://fosstodon.org/tags/articles" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#articles</a>, and other written content remain accessible and verifiable across the distributed web.<a href="https://github.com/rvnrstnsyh/cupoftea" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/rvnrstnsyh/cupoftea</a>

Delta ChatIsn't it poetic and ironic that out of all possible time lines we are in one where <a href="https://chaos.social/tags/securejoin" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#securejoin</a> <a href="https://chaos.social/tags/openpgp" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openpgp</a> protocols on top of the existing <a href="https://chaos.social/tags/email" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#email</a> protocols offer the arguably most solidly scaling, useable, world-wide federated end-to-end encrypted messaging reality, safe against compromised <a href="https://chaos.social/tags/mitm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mitm</a> servers? Hundreds of billions spend to create "the email successor" and here we are in 2025 .... <a href="https://chaos.social/tags/interoperable" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#interoperable</a> <a href="https://chaos.social/tags/email" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#email</a> and <a href="https://chaos.social/tags/cryptography" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cryptography</a> as the tortoise looking at Achilles through the back mirror :)

Kushal Das :python: :tor:Using openpgp-card-tool-git for <a href="https://toots.dgplug.org/tags/git" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#git</a> operations <a href="https://kushaldas.in/posts/using-openpgp-card-tool-git-with-git.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://kushaldas.in/posts/using-openpgp-card-tool-git-with-git.html</a> The tools is from <a href="https://fosstodon.org/@hko" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@hko</a> <a href="https://toots.dgplug.org/tags/OpenPGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenPGP</a> <a href="https://toots.dgplug.org/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a>

HeikoI just released versions 0.6.2 of rsop, a stateless <a href="https://fosstodon.org/tags/OpenPGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenPGP</a> ("SOP") CLI tool based on <a href="https://mastodon.social/@rpgp" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@rpgp</a>:<a href="https://crates.io/crates/rsop/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://crates.io/crates/rsop/</a>Changes since rsop 0.6.0:- decryption based on session keys is now supported, - generation of man pages and shell tab completion has been added, - some subtle semantics fixes for component key validity were implemented.For more on <a href="https://fosstodon.org/tags/SOP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SOP</a>, see <a href="https://datatracker.ietf.org/doc/draft-dkg-openpgp-stateless-cli/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://datatracker.ietf.org/doc/draft-dkg-openpgp-stateless-cli/</a><a href="https://fosstodon.org/tags/PGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PGP</a> <a href="https://fosstodon.org/tags/GnuPG" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GnuPG</a>

rPGPrPGP has recently received an audit by <a href="https://infosec.exchange/@ros" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@ros</a>The audit uncovered a number of issues, in particular: Multiple cases in which malformed input data can lead to Rust "panic"s. Triggering these typically leads to termination of applications that use <a href="https://mastodon.social/tags/rPGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#rPGP</a>. This can act as a vector for denial of service attacks, but does not impact confidentiality or integrity security properties.These issues were resolved in <a href="https://mastodon.social/tags/rPGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#rPGP</a> release 0.14.2. Updating is recommended for all users.<a href="https://mastodon.social/tags/OpenPGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenPGP</a> <a href="https://mastodon.social/tags/PGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PGP</a> <a href="https://mastodon.social/tags/GnuPG" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GnuPG</a>

Delta ChatSix times so far ... is how often important parts of <a href="https://chaos.social/tags/deltachat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#deltachat</a> were independently <a href="https://chaos.social/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a> audited and analyzed. Thanks to IncludeSecurity, Cure53, Applied Crypto Team at ETH Zuerich and Radical Open Security.Last audit is from December 2024 covering <a href="https://mastodon.social/@rpgp" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@rpgp</a> , the minimal <a href="https://chaos.social/tags/OpenPGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenPGP</a> Rust library that is gaining traction with others projects as well. Shout-out to dignifiedquire and <a href="https://fosstodon.org/@hko" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@hko</a> for their excellent maintenance! For more info on Delta Chat related security audits: <a href="https://delta.chat/en/help#security-audits" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://delta.chat/en/help#security-audits</a>

HeikoThere's a lot of interest in <a href="https://fosstodon.org/tags/pass" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pass</a> -like tools, but without being bound to <a href="https://fosstodon.org/tags/gnupg" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#gnupg</a> One exciting early stage exploration by <a href="https://toots.dgplug.org/@kushal" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@kushal</a> uses the standard <a href="https://fosstodon.org/tags/SOP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SOP</a> mechanism (<a href="https://datatracker.ietf.org/doc/draft-dkg-openpgp-stateless-cli/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://datatracker.ietf.org/doc/draft-dkg-openpgp-stateless-cli/</a>).Kushal's experimental fork of pass can already directly use <a href="https://fosstodon.org/tags/OpenPGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenPGP</a> card devices via the rsop-oct implementation:<a href="https://github.com/kushaldas/password-store/tree/card" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/kushaldas/password-store/tree/card</a>

Recent searches

Search options

Administered by:

Server stats:

#openpgp