Automated PGP PMs in forum

[chsados]

I am imagining a forum where private messages between users are automatically PGP encrypted behind the scenes.  I am imagining where one would have to upload their public key to their profile page and somehow when Sam private messages Sally the server locates Sally's public key, encrypts Sam's message and then delivers a PGP ASCII message to Sally's inbox.

Does anyone know if any current forum software has a feature like this?  If not, how do you think it could be done?

[1714659087]

1714659087

[1714659087]

1714659087

[theymos]

It can't be done without a browser addon unless you want the forum to have your private key.

[🏰 TradeFortress 🏰]

It can't be done without a browser addon unless you want the forum to have your private key.

The forum doesn't need to decrypt the messages. The PM send page could have a JS PGP encrypt function, if a user has set a keyid in their profile. It would be up to the receiver to decrypt the messages themselves.

The hard part has already being done: http://www.hanewin.net/encrypt/

[escrow.ms]

It can't be done without a browser addon unless you want the forum to have your private key.

Forum can save public key and user needs to save private key in browser storage/file

Here is a example:  (Punbb.ru have done this on their forum)

pics:

http://prntscr.com/17dkem
http://prntscr.com/17dki3
http://prntscr.com/17dko1
http://prntscr.com/17dl3e
http://prntscr.com/17dl6j
http://prntscr.com/17dl4u
http://prntscr.com/17dl9t
http://prntscr.com/17dljp


But yeah it will take alot time to code this kind of system.

[🏰 TradeFortress 🏰]

It can't be done without a browser addon unless you want the forum to have your private key.

Forum can save public key and user needs to save private key in browser storage/file

Here is a example:  (Punbb.ru have done this on their forum)

pics:

http://prntscr.com/17dkem
http://prntscr.com/17dki3
http://prntscr.com/17dko1
http://prntscr.com/17dl3e
http://prntscr.com/17dl6j
http://prntscr.com/17dl4u
http://prntscr.com/17dl9t
http://prntscr.com/17dljp


But yeah it will take alot time to code this kind of system.

No, don't do this. People who use the GPG system can handle the decryption of themselves offline.

Simply encrypting the message via JS is just ~3 lines of calling a premade library on the JS side, and a new DB column like the added Bitcoin addresses.  

[escrow.ms]

No, don't do this. People who use the GPG system can handle the decryption of themselves offline.

Simply encrypting the message via JS is just ~3 lines of calling a premade library on the JS side, and a new DB column like the added Bitcoin addresses.  

Then they can encrypt it themselves offline too, It takes less than 2 seconds to encrypt it using that site. what's the point of semi automatic pgp system. lazyness? 

[🏰 TradeFortress 🏰]

No, don't do this. People who use the GPG system can handle the decryption of themselves offline.

Simply encrypting the message via JS is just ~3 lines of calling a premade library on the JS side, and a new DB column like the added Bitcoin addresses.  

Then they can encrypt it themselves offline too, It takes less than 2 seconds to encrypt it using that site. what's the point of semi automatic pgp system. lazyness?  

People who PM me might not know what GPG is, have it installed, or know what a keyid is. They don't need to even know what it means if encryption is automated.

Now, if you are using GPG, then it should be assumed that you have it installed and know how to decrypt.

[theymos]

The forum doesn't need to decrypt the messages. The PM send page could have a JS PGP encrypt function, if a user has set a keyid in their profile. It would be up to the receiver to decrypt the messages themselves.

The hard part has already being done: http://www.hanewin.net/encrypt/

You still need a browser addon to prevent the forum from changing its JS to read your messages or steal your private key.

Instead of integrating PGP into sites, the proper solution IMO is to improve PGP's browser (or OS) integration so that it can be easily used on all sites regardless of whether they know about PGP.

[justusranvier]

This would be cool but I'd be satisfied with the ability to upload a public key that the forum software would use to encrypt every email it sends me.

I'd like to be able reduce the amount of data mining my email provider can perform without giving up email entirely.

[chsados]

thanks for all the suggestions.  ill do some further research.

maybe implementing privnote.com could be an answer - obviously not 100% secure but better than nothing.

[OpenYourEyes]

Not a solution to your actual issue, but why not use something like BitMessage? (https://www.bitmessage.org/)

A lot of people on here already have it, it's easy to install/setup for those that don't, and encrypts all the messages.

[chsados]

Not a solution to your actual issue, but why not use something like BitMessage? (https://www.bitmessage.org/)

A lot of people on here already have it, it's easy to install/setup for those that don't, and encrypts all the messages.

well bitmessage is a client and cannot be implemented into a forum website AFAIK