this post was submitted on 12 Apr 2025
499 points (98.8% liked)
Technology
78627 readers
3620 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Mmmhmm. Apparently the Threadiverse is about to become illegal in Florida.
First, let's generate a strong public-private GPG keypair for myself and some hypothetical other Threadiverse user, anotheruser@lemmy.today:
And show the tal@lemmy.today public key:
long keyblock
$ gpg -a --export tal@lemmy.today -----BEGIN PGP PUBLIC KEY BLOCK-----And then show an example of someone else importing it, pretending that they're anotheruser@lemmy.today (though in my case, I've already got the tal@lemmy.today public key in my keyring):
another long keyblock
$ gpg -a --import <<EOF -----BEGIN PGP PUBLIC KEY BLOCK-----And now let's pretend we're anotheruser@lemmy.today and use end-to-end encryption that doesn't have a back door, using
sedto prefix each line with four spaces so that we get nice blockquoted Markdown that we can paste into a Threadiverse comment or direct message to tal@lemmy.today:encrypting message with end-to-end encryption
And let's have tal@lemmy.today decrypt it:
decrypting message
$ gpg -a -d <<EOF -----BEGIN PGP MESSAGE-----I guess the only option will be to lock up instance admins for violating Florida law, as they're operating a social media platform with end-to-end encrypted communications with no backdoor.
EDIT: It'd also probably be nice to have browser and client support to make this more-convenient, no copy-pasting. I haven't used it, so I can't vouch for its functionality, but for users using Firefox, this Firefox extension claims it can automatically detect and decrypt GPG content in a webpage; if it can pick up on encrypted, ASCII-armored blockquoted text in a Threadiverse comment, that would hopefully let one simply read encrypted messages in Lemmy or whatever without any additional copy-pasting effort (though sending an encrypted message would still require copy-pasting some text):
https://addons.mozilla.org/en-US/firefox/addon/gnupg_decryptor/
Actually, on second thought, maybe the automated in-webpage decryption via the plugin thing I stuck at the end is a bad idea if it just inserts the decrypted stuff right into the page (not sure if this is the case). Like, I bet that a malicious or compromised instance could serve up Javascript in the webpage it provides to read and send the decrypted content from the web page.
But not a problem for the approach in general, just decrypting-in-place in a webpage. Would benefit from client support in general, though.
EDIT: Also would be nice to have user profile bios have enough space to actually fit a PGP public key, if that is to be used to distribute PGP public keys (rather than keyservers or something, though one issue with using Lemmy instances to distribute them is that a compromised instance could list bogus pubkeys for users who haven't yet obtained a local copy of the pubkey for a given user). Presently, it looks like the character limit is extremely short on lemmy.today, which is presumably using the Lemmy default; 300 characters. I'd think that it could at least be boosted to the comment length limit of 10,000 characters.