You know what's a good idea? PGP signing/encryption. Not only is it useful to you because it allows you to be sure neither I nor anyone else is snooping on your PMs or fraudulently editing your posts, but it's also beneficial to us as a society to have infrastructure in place for secure communication. By the nature of key exchange waiting until you need secure communication is waiting too long, if you wait to establish a secure communication channel until your medium is compromised then it will be impossible to do secure key exchange afterwards.
For the moment I've added the feature of allowing users to add their PGP public key to their user profile where other users can record it and subsequently use it to verify signed content and send encrypted private messages. Actual encryption/decryptions/verification/signing needs to be done by you as there are good reasons why you don't want to trust my code to do that kind of thing. Right now the only thing that NiS does is facilitate key exchange by allowing you to list your public key on your user profile.
As such, using PGP crypto will require a little setup. The appropriate software to use differs by platform, there are a number of implementations available which are all interoperable but I'll list the the most popular ones here:
"signing" is the process of adding information to a piece of content that anyone can read such that others who know your public key can verify that it has not been tampered with. This prevents tampering but does not prevent anyone from reading the message. Signing your posts on the public boards is probably what you want to do: everyone can read your posts but I or the CIA or hackers or whoever can't edit your post without it subsequently failing verification.
"encryption" is the process of taking a message destined for one or a few known recipients and making it unreadable to anyone except those recipients. This is what you want to do when using PMs as the forces that be will be unable to either manipulate or read your message.
Signing is a process done with your private key, verification is done by others with your public key to ensure you're actually the author of the message. Encryption is a process done with your recipient's public key, the recipient decrypts your message with their secret key.
As always I want to point out what this process means in terms of trust and what kind of evil things I'm able to do. When you exchange keys over NiS you need to be convinced that the public key you list is the key that others receive, and likewise that the keys you collect from other posters are really their keys. I can "man in the middle" the exchange to some extent, accepting your public key but then distributing my own key to others and this would allow me to eavesdrop on you. I'm working on a way to help detect if this kind of thing is happening (essentially a list of all keys which you can download to verify your own key is faithfully transmitted and detect if anyone else's key as changed). You can still do key exchange through channels outside of NiS and there's nothing wrong with that, I'm simply putting this option out there for ease of use or for those who think the service is trustworthy today but may be compromised in the future (which is the use-case I'm usually thinking about).
It's not a very sophisticated system and there are plenty of sharp corners in remaining in the user experience. Going forward I'll be looking at things like making signing more cosmetically palpable (hiding signature/encryption headers/footers until a user initiates verification), potentially something like automatic signing/verification and encryption/decryption but to be even remotely secure it would have to be implemented though userscripts or browser extensions. But the central thing I'd urge is to generate a key and record other people's keys now, keeping a record of public keys in a place I can't manipulate them (on your computer) is a big step to limiting the amount of useful information I can be compelled to turn over.
P.S. I only tested the key submission form with keys my tools produced and wasn't able to find any clear format specification for keyfiles, if your software is producing output and you're not able to submit it on your profile page let me know.
The following users say it would be alright if the author of this
post didn't die in a fire!
Originally posted by aldra
nice, but that's a long post about adding a text field to our user profiles
Yeah, it is. Like I said, pretty unsophisticated at the moment but I'm looking to build out some more features around it, but it serves as a talking point to motivate people to exchange keys in any case.
Originally posted by aldra
genuinely surprised it bothers validating
I figured there was like a 99% chance it was going to be used for some stupid meme-y shit if I just let it be free text entry.
Originally posted by Lanny
I figured there was like a 99% chance it was going to be used for some stupid meme-y shit if I just let it be free text entry.
Originally posted by benny vader
this is exactly why you people need to be balkanized inside a special subforum specially made for you and your people.
I'm doing this wrong more than likely, but I'm copy pasting my key into the text field and it's saying invalid submission, that it's expecting an armoured entry..?
Originally posted by DietPiano
Now further fortify the Sputnigger with 2-FA (if you would, kindly) and we will be IMPENETRABLE upon approach of the MONGOLVOID!!
(That's probably unpractically difficult to implement on a BBS tho)
it's actually pretty easy, doubt anyone would actually use it though
Originally posted by DietPiano
I'm doing this wrong more than likely, but I'm copy pasting my key into the text field and it's saying invalid submission, that it's expecting an armoured entry..?
gpg --list-keys
find your personal key in the list, take not of name (uuid)
gpg -a --export uuid
the -a flag creates an 'armored' version of the key because the raw key will have invalid characters in it
Originally posted by DietPiano
I'm doing this wrong more than likely, but I'm copy pasting my key into the text field and it's saying invalid submission, that it's expecting an armoured entry..?
There's actually a good chance that I made the validation too strict, I'm not 100% sure what is and isn't permitted so if you have anything that isn't B64 or newline characters following the header then it will reject it. Can you post or PM me your key?
Originally posted by Lanny
There's actually a good chance that I made the validation too strict, I'm not 100% sure what is and isn't permitted so if you have anything that isn't B64 or newline characters following the header then it will reject it. Can you post or PM me your key?
i used the key you posted in your OP and it says its invalid.
