reply on: Stacker Saloon \ stacker news

295 sats \ 22 replies \ @Natalia 23 Feb \ on: Stacker Saloon

Playing around PGP last night ( yes, late into the game - it takes time to sort things out one by one. ) so here is my understanding of the logic of verifying software:

you import the specific APP's public key from the terminal
download both the software and the signature file (asc)
copy and paste a line of code into the terminal to verify

But how does it work in the background - is it verifying the signature file matches with the public key? and how things be if someone changed the app, the signature then unmatched with the public key? 🤔

Then early this morning, I was playing around with the PGP encrypted message as I want to see how I can take advantage of it; so actually, all you need is someone else's public key, and then you can send them everything, and only the one with the private key can read, which is so cool! ( okay, this is how Nostr works too, but it's leaking metadata ) And then it reminded me that it seems all these so-called encrypted mail providers can only be encrypted within the same providers, however you can solve this problem by using a password in between, but isn't making things more complicated when you can use a simple mail provider but encrypted stuff ourselves? It's like indeed these encrypted mail providers creates convenience, but also it's with limited encryption at the same time?

Now that it's really interesting relearning how to verify things myself instead of depending on a third party. 👀

119 sats \ 5 replies \ @siggy47 23 Feb

A long time ago, way before bitcoin, I think in the late 1980s or early 1990s, I was in a PGP message group. There were probably some famous people in there too. I started using PGP for encrypted emails. It worked well and was easy to use, but no one I knew cared about privacy so I didn't use it much. This was either before or around the time the US government tried to ban it.

40 sats \ 4 replies \ @Natalia 23 Feb

how do you use PGP now, self-hosting is the way? 👀 I don't use email that much, but curious to see what's the proper way to use it.

I feel these encrypted mail providers take away all the burdens and blend everything with a single password, and then users become "stupid" by default; It feels the same when using custodial wallets without having the burden of safeguarding the seeds yourself, but then how come it's pretty much all "custodial way" in the email case? fascinating.

0 sats \ 3 replies \ @siggy47 23 Feb

I don't use it any more. I use protonmail, but you're right. It's easy and I'm ignorant about what goes on beneath the hood.

40 sats \ 2 replies \ @Natalia 23 Feb

would it be really cool if email blends with sats one day? 👀

paid to send, no spams.
need private key to decrypt the msg.
all the msg follows the key instead of being stuck in the email provider.

it feels almost the same with DM over LN, only the encrypted message part is missing.

0 sats \ 1 reply \ @ek 23 Feb

it feels almost the same with DM over LN, only the encrypted message part is missing

It's encrypted, only the receiving node can read it. But on SN, we all share the same node and thus k00b and me could just lookup the decrypted messages in the database.

0 sats \ 0 replies \ @Natalia 23 Feb

my understanding is if you and the other party both use your own node, then it's encrypted; but if one of the party using LN custodian address, like from Alby, Blink or SN then the node owner can read it too. 👀

31 sats \ 11 replies \ @Natalia 23 Feb

so the upgraded DMing in SN is you can use the receiver public key to encrypt the message, and only he/she can read it ( but yeah you need to find their public key first, POW! )

why not sending mail directly? well it's more fun sending with sats. 😂

0 sats \ 10 replies \ @siggy47 23 Feb

Do you have a link to read about this new DMing? Is it still a LN transaction?

148 sats \ 9 replies \ @Natalia 23 Feb

no link to read, I just did a test early today with @ek, all I did is I use his key to encrypted the message and then I send that to him over LN:) ⚡️ really fun!

23 sats \ 8 replies \ @ek 23 Feb

I'm trying to decrypt your message but I am confused and a bit embarrassed lol. It says I don't have the decryption key:

$ gpg --decrypt natalia.asc
gpg: encrypted with rsa3072 key, ID 72BBE6ACFD911E48, created 2023-11-23
      "ekzyis <ekzyis@ekzyis.com>"
gpg: public key decryption failed: No secret key
gpg: decryption failed: No secret key

It says it was encrypted with rsa3072 key, ID 72BBE6ACFD911E48 but I indeed don't seem to have the decryption key for that:

$ gpg --list-secret-keys --keyid-format long ekzyis@ekzyis.com
sec   rsa4096/ECEC37F68FB73398 2023-11-23 [SC] [expires: 2024-03-24]
      47705D79F55713643556F499ECEC37F68FB73398
uid                 [ultimate] ekzyis <ekzyis@ekzyis.com>
ssb   rsa4096/57C6E94C763DA6C9 2023-11-23 [E] [expires: 2024-03-24]

Seems like I used to have a rsa3072 key:

$ gpg --list-keys --keyid-format long ekzyis@ekzyis.com
pub   rsa3072/DEECE3CF8D4D258F 2023-11-23 [SC] [expires: 2025-11-22]
      E13F6708015D2D55082A14F1DEECE3CF8D4D258F
uid                 [ultimate] ekzyis <ekzyis@ekzyis.com>
sub   rsa3072/72BBE6ACFD911E48 2023-11-23 [E] [expires: 2025-11-22]

pub   rsa4096/ECEC37F68FB73398 2023-11-23 [SC] [expires: 2024-03-24]
      47705D79F55713643556F499ECEC37F68FB73398
uid                 [ultimate] ekzyis <ekzyis@ekzyis.com>
sub   rsa4096/57C6E94C763DA6C9 2023-11-23 [E] [expires: 2024-03-24]

And the key that was used for encryption was that one since the ID matches for the encryption key:

sub   rsa3072/72BBE6ACFD911E48 2023-11-23 [E] [expires: 2025-11-22]

I guess the rsa4096 key was not used because it is marked as expired in the PGP keyfile that I host here:

$ gpg --show-keys pgp.txt
pub   rsa3072 2023-11-23 [SC] [expires: 2025-11-22]
      E13F6708015D2D55082A14F1DEECE3CF8D4D258F
uid                      ekzyis <ekzyis@ekzyis.com>
sub   rsa3072 2023-11-23 [E] [expires: 2025-11-22]

pub   rsa4096 2023-11-23 [SC] [expired: 2023-12-23]
      47705D79F55713643556F499ECEC37F68FB73398
uid                      ekzyis <ekzyis@ekzyis.com>
sub   rsa4096 2023-11-23 [E] [expired: 2023-12-23]

gpg: WARNING: No valid encryption subkey left over.

I think the warning mentions that the message won't be encrypted with that key but only with the rsa3072 key.

The above commands don't show the same expiration date since I manually updated it in the hope I could decrypt and don't have to write this message; mentioning that I wasn't able to decrypt the first PGP message that I received haha.

I uploaded a new PGP keyfile where the rsa4096 key is not expired:

$ gpg --show-keys pgp2.txt
pub   rsa3072 2023-11-23 [SC] [expires: 2025-11-22]
      E13F6708015D2D55082A14F1DEECE3CF8D4D258F
uid                      ekzyis <ekzyis@ekzyis.com>
sub   rsa3072 2023-11-23 [E] [expires: 2025-11-22]

pub   rsa4096 2023-11-23 [SC] [expires: 2024-03-24]
      47705D79F55713643556F499ECEC37F68FB73398
uid                      ekzyis <ekzyis@ekzyis.com>
sub   rsa4096 2023-11-23 [E] [expires: 2024-03-24]

Can you try again @Natalia? I would have loved to read your message! But I will never be able to read the original message now.

Thanks for testing! Didn't know my key expired haha

111 sats \ 7 replies \ @Natalia 23 Feb

deleted by author

0 sats \ 6 replies \ @ek 23 Feb

deleted by author

1 sat \ 4 replies \ @Natalia 23 Feb

deleted by author

100 sats \ 3 replies \ @ek 23 Feb

view replies

1 sat \ 0 replies \ @Natalia 23 Feb

deleted by author

0 sats \ 3 replies \ @franzap 24 Feb

Software verification with PGP has a terrible UX, and that is what I'm trying to fix with zap.store using nostr

22 sats \ 2 replies \ @Natalia 24 Feb

indeed, and the information of each software is in different place, even simple things like the public key of the Devs ( OMG ) which means certain manual work needs to be done, or maybe that's the charm of decentralization instead of depending on Apple or Google to do that for us?

what I'm trying to fix with zap.store using nostr

and how?

480 sats \ 1 reply \ @franzap 24 Feb

You're right!

I wrote about it here: #404908

22 sats \ 0 replies \ @Natalia 24 Feb

interesting read - the path of regaining freedom is like saying goodbye to the illusion of security/safety and taking things back into your own hands, from as simple as verifying software to making life decisions.