12 ms·

I've always handled PGP via cut-and-paste of the ascii armored block, through a text file on a ramdisk (or between systems), then using command-line pgp or gpg

by rdl 8y ago

I've always handled PGP via cut-and-paste of the ascii armored block, through a text file on a ramdisk (or between systems), then using command-line pgp or gpg to decrypt, and the reverse. Not always on a VM or machine without external network access, but for signing keys for software and stuff, yes. It just seemed too easy to mess up auto-decrypt/auto-encrypt and accidentally send out cleartext -- the cut and paste or textfile intermediate step makes it verifiable. Unless there's a protocol bug where the message itself can include "dump the secret key to a public keyserver on decrypt", I'm not too worried. (I also don't use PGP for routine communications, because it's so inconvenient to use it, and due to lack of a good mobile solution. Signal, or for routine email, tls to a mail server I control is fine too.)

dividuum 8y ago
I wonder if that doesn't open up similar problems: Pasting the mail into the gpg command line program prints out the clear text to the terminal. There are all kinds of magic control sequences that might be in that clear text. Isn't that conceptually similar to having HTML "executed"?
- rdl 8y ago
  I use text files (on ramdisk/tmpfs) as the intermediary, not display-to-screen.
- viraptor 8y ago
  Console control characters won't cause you to make an internet connection. There are some weird control sequences which are designed to execute a command on the reader's terminal, but nobody implements those these days.
Jach 8y ago
On Android, the OpenKeychain app suits my needs just fine on the rare occasion I need to encrypt/decrypt on mobile, though I've never used its email integration... Apart from that I have basically the same workflow. I wrote a GUI program once to play with Clojure + Apache Pivot that lets me copy/paste text into the program's text fields and gives a dropdown of public keys (or an option to add a key), that's sometimes a bit more convenient. I can also explicitly manage whether I add myself as a recipient or not, lots of email clients seem to automatically encrypt to the sender's key as well so they can read it later.

by rdl 8y ago

dividuum 8y ago

I wonder if that doesn't open up similar problems: Pasting the mail into the gpg command line program prints out the clear text to the terminal. There are all kinds of magic control sequences that might be in that clear text. Isn't that conceptually similar to having HTML "executed"?

rdl 8y ago
I use text files (on ramdisk/tmpfs) as the intermediary, not display-to-screen.
viraptor 8y ago
Console control characters won't cause you to make an internet connection. There are some weird control sequences which are designed to execute a command on the reader's terminal, but nobody implements those these days.

Jach 8y ago

On Android, the OpenKeychain app suits my needs just fine on the rare occasion I need to encrypt/decrypt on mobile, though I've never used its email integration... Apart from that I have basically the same workflow. I wrote a GUI program once to play with Clojure + Apache Pivot that lets me copy/paste text into the program's text fields and gives a dropdown of public keys (or an option to add a key), that's sometimes a bit more convenient. I can also explicitly manage whether I add myself as a recipient or not, lots of email clients seem to automatically encrypt to the sender's key as well so they can read it later.