(untitled)

There is something I have not seen discussed before. You're on a site you want to say something to someone or send information to them but dont feel you can safely on the site you are using and >either you or they do not use and will not use a secure messaging app or make an account on an secure email service >you're just trying to see if this person is even worth giving other info to perhaps you don't trust them much >you just want to keep certain things off the website you are using due to permanence or lack of trust for staff and this can include information of other means to contact you which would potentially possibly provide an extra layer privacy by doing things this way if youre contacting via an account, maybe One way is saving an encrypted password protected text file and sending that via a link type file storage site that is password protected but there is so many issues with that such as risk of it being copied or the person you send it to being negligent to delete it after reading it. Even if you trust the person they may forget or their computer might be infected with malware that grabs files. Apparently there does exist sites that you can send messages encrypted and self deleting either on a timer or by view but is this site trustworthy or is there a more trustworthy option? I swore I saw another site like this that was also open source but I couldnt find it again unfortunately and even if it was they easily could have something else entirely on the back end, https://privenote.org/ Is this a good thing or not worth trusting?

any temp-messaging site without a warrant canary should be considered compromised afaik the only one that HAD a canary was temp.pm, and their canary has been expired for years (aka: compromised) sage because I cannot speak to the rest of the OP

>>24856 Use XMPP for communications. You can use a server that runs a hidden service (Tor onion address) for greater anonymity. AFAIK the only services that provide disappearing messages are apps like Signal and Burner, which either require a smartphone or a phone number to be used, and are centralized. Everyone just got to witness why centralization of any privacy-centric projects is a horrible idea with Telegram's corruption. Has anyone even tested to see if the disappearing messages still reside on devices? Disappearing messages seem like a gimmick to me, it probably doesn't even work reliably, virtually smartphones use SSDs with wear leveling. If your messages are stored on an encrypted device, and are encrypted themself with forward secrecy, it matters little. To initiate contact: Hash a very strong password using sha256 or sha512; Exchange contact information with the person over the website; Send them the hash over the website; Send them the password via private messaging. Then, once they have confirmed your identity, whichever one of you publicly shared their contact information should make a new account, send it to the other, delete the old account, and use the new one. Using a hashed password isn't an amazing technique, there are other ideas, but this seems simplest to me. Realistically, nobody is going to dehash the password in the time it takes for the process of initiating communication via an external channel to finish, maybe not even the NSA assuming they have the capability and care enough. This method does nothing to confirm the identity of the person you met over the website, but few techniques will when dealing with anonymous people without static identities on a website. Someone else can always come along and maliciously pretend to be you, no matter the method for which you try to initiate contact with the person you met through the website. If the website does not fingerprint users' browsers, then you can't get the website admin to vouch for your identity, assuming they care enough to do so. >privenote.org The notes aren't private from CloudFlare's perspective.

>>24857 >temp.pm >warrant canary >expired for years I just checked last one was April of 2023 so like a year and a half. Either you remembered it as longer than it was or the admin is really bad at their promise of updating it every month regularly forgetting the site exists. >>24858 >use XMPP In another thread I was seeing XMPP criticized for it being insecure or not depending on who runs the server and how it is set up. Regardless it needs an account, right? So that's a different scenario than described in the OP which may include people who don't understand or care much about security and privacy for themselves. Many people just don't want to deal with accounts or programs of something they think they wont use much. > Then, once they have confirmed your identity, whichever one of you publicly shared their contact information should make a new account, send it to the other, delete the old account, and use the new one. This makes sense if talking to someone shady you dont want anyone tying back to you and give guilt by association when you did nothing but im not sure what other scenarios someone would go this route and it would seem difficult to convince someone to go to this length unless they are very paranoid but worth noting. > The notes aren't private from CloudFlare's perspective. CloudFlare gets the content of the notes you are saying or just who made it and who viewed it?

>>24866 >In another thread I was seeing XMPP criticized for it being insecure or not depending on who runs the server and how it is set up. That is true that messages on XMPP are only as secure as the servers they are routed through, but that is the case for any kind of messenger that uses servers for routing messages. By using anything other than a P2P messaging program, you route your messages through another person's server, and you trust in that person's ability to run their server securely. If you want to find out if an XMPP server is secure, research it. If you can't discover information about the server's security practices, then don't use it, and use a server that explains its security practices. There's actually an article that analyzed xmpp servers on a mass scale, but for some reason I can't share it here. You should make a new account because you linked your current account to whatever imageboard or forum you posted to by sharing your contact information. That correlation alone is bad enough, but people could harass you with text messages as well. Alternatively, you could make an account specifically for initiating contact, and post that on the website. >CloudFlare gets the content of the notes you are saying or just who made it and who viewed it? The key that your browser generates to encrypt the note should be intercepted by CloudFlare's MiTM proxy, so it could be decrypted by them. CloudFlare also has all of the information that the website has on you, since all of the website's traffic is routed through CloudFlare. You can still use Tor with that note website to hide your IP, but I would avoid the note website completely, just use a messenger app instead.

>>24871 >There's actually an article that analyzed xmpp servers on a mass scale, but for some reason I can't share it here. Do you get a message saying "go away spammer" or "make a better post" or something along those lines? If so something is hitting the word filter. It mainly filters anyone talking like a 4channer. >P2P I may be derailing my own thread some saying this but I don't understand why P2P or otherwise no central server isn't used as much these days even in security messaging. I never found it that big a hassle for a program to just cue a message to send next time me and another person are both online especially since so many people these days keep their computers and phones on nearly 24/7. >The key that your browser generates to encrypt the note should be intercepted by CloudFlare's MiTM proxy, so it could be decrypted by them. Is that by design required for CloudFlare to work or is it just bad security in either web design or browser coding?

>>24876 Yes I got the message "go away spammer", but it was not a word filter. I actually changed the wording of my post several times because I thought I set it off, it happens rarely, but that wasn't it. It was just the url. I don't know why it's derezzed, the website hosting the article is obscure and irrelevant. Maybe it's some weird coincidence, I've never posted a derezzed url before. >Is that by design required for CloudFlare to work or is it just bad security in either web design or browser coding? CloudFlare is intended to work that way. They decrypt web traffic, scan it for "malicious activity", and then if they do not find signs of malice they route it to the website. I think people's fear with P2P is in leaking their IP address. Also probably just the idea that they are connecting directly to another person's machine, without a server in-between to route messages. The chances of a vulnerability in your client being exploited when using P2P are probably higher than with server-to-server. P2P to me seems best for chatting with people you trust, or know in real life.

I just found this. Open source and uses public and private key system. Only possible flaw I see is the generated URL is the message itself which basically makes it permanent so it not being on a central server doesn't really mean much. Also has issue of how it works seems more geared for business' to request passwords or credit card numbers I assume. https://retriever.corgea.io/why.html >>24886 There might be a word in the URL that is derezzed? > They decrypt web traffic, scan it for "malicious activity", and then if they do not find signs of malice they route it to the website. Doesnt that only mean they decrypt HTTPS traffic?

Onionshare? Run it on your device, invite the person of interest to it. They remain anonymous. You remain anonymous. Chat, share files, whatever. You destroy all traces whenever you want. No trust required.

>>24889 Can second this. For one-stop-shop communications where you need to send a few files or a few messages, its great. It's not meant to be used for long term convos, like Signal or Telegram is. Also requires to share the onion link along with an optional passcode to enter the site. Downside is, that you need another secure channel to deliver the link/code combo, otherwise your chat-service is instantly compromised

The elites don't want you to know this, but PGP is free. We can make first contact and DM each other right here in this thread, ain't a damn thing anybody can do about it. Problem with websites, even good ones that do proper cryptography might log your messages, you'll never know. You're running unverified obfuscated JS code that can change at any time in the background, covertly leaking everything. Same with "encrypted" chat apps where the client, which has access to private keys and decrypted content, is made by the same people who operate the service. Complex codebases, automatic updates, binary releases, even worse "app store" binary releases, code delivered by MITM-flare, in-house encryption schemes, cloud backups, these are just asking for trouble. Not to mention Telegram which is marketed as encrypted, but in reality it's not encrypted whatsoever, by default encryption is off for private chats, and for groups there isn't even an option to encrypt. Symmetric cryptography ("password") doesn't work for this use case because you can't securely share a password on an open channel. But that's a problem that public key cryptography solved ages ago. >>24889 OnionShare looks cool because it's open source and you host it yourself. Same concept can work over clearnet too. For the lulz, feel free to share throwaway PGP pubkeys and send each other encrypted messages in this thread, I'll send some bullshit back. My pubkey, lainon69 <lainon69@lainchan.org>, fingerprint 8E86 BCBE 6029 34B0 9DFB 7938 5E64 642F 3CA4 DB5C: -----BEGIN PGP PUBLIC KEY BLOCK----- mDMEZwAjpBYJKwYBBAHaRw8BAQdANjCcvXuRdsJUXRlrlKxOIwsY2JD3rPk9XCV3 Cp8Sn4i0IGxhaW5vbjY5IDxsYWlub242OUBsYWluY2hhbi5vcmc+iJMEExYKADsW IQSOhry+YCk0sJ37eTheZGQvPKTbXAUCZwAjpAIbAwULCQgHAgIiAgYVCgkICwIE FgIDAQIeBwIXgAAKCRBeZGQvPKTbXCwjAP9js2X5vawUJyJi3apL3b81gToJ5h/m 3bKWbY/AxRPaRgD+JQ3Wp2jaM2/RbkKpCI+Gdg4hBVuT2b1JJrgzUUn1nw24OARn ACOkEgorBgEEAZdVAQUBAQdAAhDZHqIFxImMHLGncK52aip1MtL/h2sySp7qPInB VlwDAQgHiHgEGBYKACAWIQSOhry+YCk0sJ37eTheZGQvPKTbXAUCZwAjpAIbDAAK CRBeZGQvPKTbXDNgAQCOlru3FyznpAscwtNAoIW7DSP3wOH4yfTgdxfiy6GmlQEA hbTuV0ZK0Q2ZgXtNhmnxikUbrmWQ05nHXP7DN/fxTAQ= =FUTQ -----END PGP PUBLIC KEY BLOCK----- GnuPG primer: # Generate your own private key interactively # For example, I used "lainon69" as the name, "lainon69@lainchan.org" # as the email, choose something unique gpg --full-generate-key # Export your public key to stdout gpg --armor --export you@lainchan.org # Import someone else's key from stdin gpg --import # Paste the above -----BEGIN... block, then EOF to finish # (GNU/Linux: Ctrl+D to input an EOF character, on Windows it's Ctrl+Z then Enter) # Show all keys you have gpg --list-keys --with-fingerprint # Encrypt simple message to stdout, use recipient's "email" echo 'wake up lainon' | gpg --armor --encrypt --output - --recipient lainon69@lainchan.org # Sign a message with your key, without encrypting it echo 'are you there?' | gpg --armor --clearsign --local-user you@lainchan.org # Decrypt an incoming message, copy-paste message then EOF gpg --decrypt # Verify signature of a message, copy-paste message then EOF gpg --verify There's decent GUI PGP software out there as well, for Windows there's Gpg4Win, this includes Kleopatra which lets you quickly encrypt/decrypt from clipboard. I'm sure there are browser extensions too which let you PGP soykafpost and decrypt seamlessly. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Signed unencrypted message example. I hereby declare: OP is a faghet! If your message gets word filtered, that messes up the signature, thank you Lain admins very cool. -----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQSOhry+YCk0sJ37eTheZGQvPKTbXAUCZwAxiwAKCRBeZGQvPKTb XNcPAQCwhXVThBXS+UnfjrlP/LG7OcElegRqpdwLhi6RKlsoZgEAxDwUtfQ48JGx nH1HU7nX0/2SEceA+za3omoCxEgoqAE= =gqFM -----END PGP SIGNATURE-----

>>24898 I partly agree with you - using PGP is a simple, effective platform/application independent way to communnicate securely. The only problem is that it requires that the person on the other end sets up and manages their keys. Often privacy enthusiastic people find themselves in the situation where the person they want to communicate with couldn't care less about privacy, which means it has to be *as easy as possible' to use. I mean, this is why Signal and Telegram have so much popularity - the feel just like SMS or iMessage to the average user. Noone has made software (to my knowledge) that enables the same user friendlines with PGP (sadly).

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 >>24899 >double digit IQ normal people This is why we can't have nice things. Somehow everyone knows how to use Tor and PGP when they need to buy their weed on darknet markets though. -----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQSOhry+YCk0sJ37eTheZGQvPKTbXAUCZwBePAAKCRBeZGQvPKTb XC1KAP40ruT1fmCzjskmOIj8ZFu/pJTBOwoPVkgLZ4ZruavrRQEAneigSEpwEfMm LhmEXjdv21QE9egJLr74mz4K1v9A5QI= =KNL+ -----END PGP SIGNATURE-----