this post was submitted on 24 Mar 2026
23 points (89.7% liked)

Selfhosted

56957 readers
416 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

  7. No low-effort posts. This is subjective and will largely be determined by the community member reports.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
23
Typing into the abyss - need a service (lemmy.world)
submitted 1 day ago* (last edited 1 day ago) by ehguyitsmebuddy@lemmy.world to c/selfhosted@lemmy.world
20 comments fedilink hide all child comments
 

Does it exist, some sort of encrypted journal-like app where I can type things which will be forever locked away? In my mind and in a place I can feel confident about, without a doubt.

Pen and paper requires burning afterwards, I don’t think I want to do this.

I know no opsec solution is perfect. I need some sort of outlet. I need some sort of solution.

I was thinking. Maybe, at least, some solution where even though access is non-negotiable, if somebody does get in, I can accept that the entity was already determined enough to end things.

Thanks.

Edit: I should I guess mention the obvious such as encryption and possibly authentication with a hardware security key. Any other features that might be out there I am hoping to hear about.

you are viewing a single comment's thread
view the rest of the comments
[–] notabot@piefed.social 9 points 1 day ago (2 children)

An airgapped machine is certainly going to be most robust from external attack, but even then you should probably encrypt your files to ensure privacy should you ever discard, or otherwise lose control of, the storage media.

An encrypted partition may be sufficient, but your journal entries will still be "plain text" when it is mounted, and so you will be able to read them without extra effort. If you want to make it so that once an entry is written it is encrypted and can only be read with deliberate effort, you could use GPG encryption.

First generate a key pair with a really strong passphrase, and store it on a USB drive. Then import just the public key onto your journaling machine and store the USB drive somewhere safe. With just the public key on your machine you can encrypt files, but you can't decrypt them. Ideally you'll set up your journalling tool to only write via GPG, but if not, you can just encrypt each entry after you write it.

As to what journalling tool to use, I like VIM, although I know not everyone gets on with it. You can have it start up with a template ready to go, not write temporary files, and save via GPG so the plaintext never hits persistent storage.

[–] ehguyitsmebuddy@lemmy.world 4 points 1 day ago (1 children)

Thank you. This is really insightful and something that I think might be a robust solution for me. I’ll research GPG more, I clearly need to.

[–] observantTrapezium@lemmy.ca 1 points 19 hours ago

The fundamental difference between GPG encryption and encrypted partition is that of asymmetric vs. symmetric encryption. Whether you mount encrypted storage or decrypt a file with GPG, there's some "effort" in putting in the passphrase and in both cases the system's keyring is briefly aware of it and the plaintext is saved to memory (volatile, unless you have encrypted swap or other edge cases).

Asymmetric encryption is not normally used for personal stuff but mostly to exchange material with one party holding the private key, and other having access to the public key (which is public). Of course you can act as both parties if you like. If you do, keep in mind:

  1. Asymmetric encryption algorithms may be vulnerable to quantum computing attacks in the coming years. There are quantum-resistant algorithms, but to my understanding they are not necessarily quantum-proof and could potentially be broken in the more distant future.
  2. If you do choose to use GPG, make sure that the plaintext never touches the disk, for example save it to /dev/shm before encryption.
  3. You can also protect your private key with a passphrase.

Personally I use Joplin. On the clients it's secure because the database is saved on encrypted storage secured by my login phrase. On the server it's secure by Joplin encrypting the files saved to WebDAV storage. Is it 100% safe? Probably not, but probably good enough to stop all but a nation-state level actor.