Re: AI's take on my cipher...

Stefan Claas <stefan@mailchuck.com> wrote:

Rich wrote:

Stefan Claas <stefan@mailchuck.com> wrote:

Richard Heathfield wrote:

On 10/07/2025 18:19, Stefan Claas wrote:

Chris M. Thomasson wrote:

On 7/9/2025 12:53 PM, Stefan Claas wrote:

 

How does it work if A encrypts on local host and B should
decrypt on his local host, with that given link from A

 
Wrt the online version:
 
A needs to send/give B the ciphertext somehow, email, snail
mail, somehow, hand signals, ect...  ;^) Then B, assuming that A
and B have the same secret key, can use said ciphertext to
decrypt it.  So, if you notice the online program has a
ciphertext only, without a link prefix.  Say this example: I am
encrypting the message on my local host using the default key:

 
But how, for example, would you give me the secret key, from the
USA to Germany, without meeting in person?

 
Diffie-Hellman can establish a secret key in public.  Then
authenticate over an encrypted channel.

 
I know, but how do you protect the key on your online device against
Pegasus or FinSpy?  For proper encryption two parties have to do it
offline, but GnuPG users could never learn it, because it was never
explained to them.

 
Nor will anyone else who falls into the "average computer user
category" and thinks the "I have nothing to hide" excuse is valid.
 
You are not fighting "encryption" here, you are fighting the fact that
few care enough and are motivated to learn.  And that battle will not
be won by better cryptography, nor by better user interfaces.  The only
way those folks will use "secure means" is if the secure means happens
all automatically, by default, without their knowledge, for them.

 
And you know very well that this will not happen, because companies are
not willing to defeat this known issue

Never said I expected it to happen.  What I said was the only way for
it to happen for any but the select few who are motivated was to have
it present by default so they don't have to do anything.  That's not a
statement that companies would therefore provide such.

and only offline encryption and decryption is the way to go, for
secure communications.

That avoids (mostly) the issues of the "encryption computer" becoming
infected without your knowledge.  But the moment you point out to an
"average joe" who buys into the "if you have nothing to hide"
smokescreen, that to communicate with encryption they have to have an
air-gapped computing device and transfer the encrypted data over to
that device to decrypt, you will lose 99.9% of your audience.  They
simply will not be willing to put in the effort to do this.