4 ms·
He's talking about giving their public key, not the private key that has to remain on the user's device(s) under all circumstances.
by GTP 7y ago
He's talking about giving their public key, not the private key that has to remain on the user's device(s) under all circumstances.
- forgotmypw16 7y agoThe private key is stored in localStorage, but this is not the user's "real" private key which they might use for email, but a temporary device key, which can then be vouched either by admin or by user.
- GTP 7y agoI'm not understanding how this works, then. Are you using the user's private key to somehow derive temporary device keys?
- forgotmypw16 7y agoGenerate a PGP key using in-browser JS. Use that key submitted posts. Then, later, sign either the file hashes or the public key itself using actual secure PGP. This is optional. I'm not claiming any level of security, this is all mostly UI prototyping.
- GTP 7y agoSorry, what do you mean by "Use that key submitted posts"?