4

I have a private website (i.e., I’m the only editor/visitor), but I don’t trust the hoster with my content.

What I want

  1. When entering something into a textarea, I want to encrypt it locally with OpenPGP (preferably using my GnuPG installation) before it gets sent to the server.

  2. When viewing this published content (resp. when editing it again), I want to have it automatically decrypted locally.

So: Everything I see should be the decrypted content, everything that gets sent to and retrieved from the server should be encrypted.

What kind of tool

It would be great if this works directly on the page (*), but a solution with a local text editor would be okay as long as it works automatically: I don’t want to have to copy and paste the content from the form to my text editor and back to the form.

So I guess in any case a browser extension is required, but I don’t require this (maybe there is a different solution I can’t think of).

(*) I’m aware that then a malicious hoster could possibly retrieve my decrypted content, e.g., by injecting some JavaScript.

Formal requirements

  • Everything involved must be FLOSS.
  • It must work with a FLOSS web browser (I don’t care which one, e.g., Firefox or Chromium or …) on GNU/Linux (natively).
  • Just if this helps: 1. Not PGP, but given it looks fairly easy to simply use as if it's PGP (it's AES) and says both 'There is also a possibility of automatic decryption' AND 'With this extension you can encrypt any content on the server, e.g. html, javascript or images', you may take a look at CryptoData for firefox, and 2. check if WebPG (FireGPG's spiritual successor) has an option for detecting PGP blocks on a given page (incl. source) and automatically decrypting it with the key from your linked store. – user2716 Jan 14 '15 at 14:18
4

Your scenario is a little sparse on details but I would like to suggest that you are probably barking up the wrong tree altogether.

If you are the only author and consumer of text data, it is unlikely that a web browser, hosting provider and text areas is the best way to manage that text data. There are in fact much better ways. Here are some possibilities:

  1. Use git. To translate your example as best I understand it, you could use a git repository for similar purposes. You could use any text editor you wanted locally (even if that was an offline browser based tool, but more likely something local). You would be able to deal with data in formats that wouldn't fit a in text area if you like, but even if you just keep a list of text files the flexibility will be superior to any way a random website host will let you organize encrypted blobs that it can't parse.

    You then have two options for encryption.

    • Most obviously, you could do it yourself with your usual suite of tools, GnuPG if that is your preference. In this model the data files are encrypted before being entered into the repository and are only decrypted locally on your wim.

    • If being able to do things like compare differences it the repository is useful to you or you just want to ease the process a little, a tool like git-crpyt could be used to transparently encrypt files on their way into and out of the repository. The data in the repository would still be encrypted but your working copy could be transparently decrypted locally for easy access.

    Either way, you could set this up locally and only later find a git hosting provider (or several) to push your repository out to. You would not be trusting such a provider with your data in any way, only using them to make it available. With git's built in distributed nature, this could even be several hosts that are easily kept in sync. Working from any of them as a base and merging changes to the others later would be easy to keep track of.

    See also my answer on Simple versioning for plain-text documents.

  • More ideas present themselves but the time to write does not. The user-story in the question could use some refining to make more tailored suggestions as well... – Caleb Mar 13 '14 at 21:37
  • +1 Thanks, that is a nice alternative/option for hosting data on untrusted hosts. It’s not a solution for my current case (as my data has to be on a specific website), but I’m sure I’ll come back to this for similar cases. – unor Mar 14 '14 at 11:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.