# Encrypted PGP Messaging
**URL:** https://meta.discourse.org/t/encrypted-pgp-messaging/19149
**Category:** Feature
**Created:** [August 21, 2014, 8:47pm UTC](https://meta.discourse.org/t/encrypted-pgp-messaging/19149 "2014-08-21T20:47:23Z")
**Posts on this page:** 15
**Page:** 3
### Author:  [@jetatomic](https://meta.discourse.org/u/jetatomic)
#### Post date: [March 20, 2017, 6:26am UTC](https://meta.discourse.org/t/encrypted-pgp-messaging/19149/42 "2017-03-20T06:26:54Z")
I basically outlined what I was getting at in my previous post attempting to articulate threat models and messaging models. My last post may have distracted from that.
###TLDR:
1. The social and technical landscape has changed since this thread stopped in 2014.
2. I really like the implementations of PGP notifications by Facebook and the aforementioned WP plugin. Discourse adding that capability would be helpful.
3. I’d also love to be able to use Discourse messaging secured by something like Signal Protocol so I could avoid Facebook Messenger altogether for private conversations with forum users (currently, we end up shifting back and forth).
4. My aesthetic preference for encrypting everything likely does not represent most users.
Email notifications with no content leakage would certainly be less useful, but it would alleviate some of the concerns. Thank you for pointing that out.
I don’t think I have anything further to add.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [March 20, 2017, 2:02pm UTC](https://meta.discourse.org/t/encrypted-pgp-messaging/19149/43 "2017-03-20T14:02:52Z")
> [@codinghorror](#):
>
> Not totally sure what you are getting at, but @falco has on his page for 1.8 a “no leaking content through email” mode for Discourse. It turns emails into notifications only with zero names or any other kind of site content leaked through email.
The way I see it this completely solves “Thread Model 3”
> Big Data: User email providers (Gmail, Yahoo!, Microsoft, etc.). Transactional email providers (Mandrill, etc.). Attacks on email in transmission or at rest.
I would only be comfortable solving
> [@jetatomic](#):
>
> Big Brother: NSA, CIA, FBI, Snowden revelations, Vault7 (and all below)
> Hosting company, server, admins, attacks on Discourse
Directly in the Discourse mobile app (or whatever packaged desktop app).
---
### Author:  [@pirhoo](https://meta.discourse.org/u/pirhoo)
#### Post date: [April 23, 2018, 9:08pm UTC](https://meta.discourse.org/t/encrypted-pgp-messaging/19149/44 "2018-04-23T21:08:27Z")
Hi there,
I work for a consortium of journalists ([ICIJ](http://icij.org/)) that investigates on highly sensitive projects. Most known being the Panama Papers and the Paradise Papers.
I’m about to use Discourse to help our network to coordinate and I wonder if anyone ever come out with solution for encrypted private messaging? Our main concern being: if ever the database get leaked, how can we prevent the attackers to read private messages which could reveal sensitive info about our sources.
With our current forum portal, we already setup a “proxy” service in front of our SMTP that uses GPG to automatically encrypt messages for the known keys. If the key for an email has not been provisioned, the email is not sent.
Thanks a ton!
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [April 23, 2018, 9:23pm UTC](https://meta.discourse.org/t/encrypted-pgp-messaging/19149/45 "2018-04-23T21:23:22Z")
> [@pirhoo](#):
>
> if ever the database get leaked, how can we prevent the attackers to read private messages which could reveal sensitive info about our sources.
My suggestion would be to have the actual source info referenced as a general codename – all direct source communication should be through a highly secure medium like Signal.
[https://medium.com/@mshelton/signal-for-beginners-c6b44f76a1f0](https://medium.com/@mshelton/signal-for-beginners-c6b44f76a1f0)
Derived from
> **[Security Advice for Congressional Campaigns (Tech Solidarity)](https://techsolidarity.org/resources/congressional_howto.html)**
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [April 23, 2018, 9:43pm UTC](https://meta.discourse.org/t/encrypted-pgp-messaging/19149/46 "2018-04-23T21:43:10Z")
Yeah. Where that document says:
> Assume that anything you say on Slack or in Twitter direct messages will one day be public.
Apply that to Discourse as well.
Discourse is trying to be a facilitator for public discussion and doesn’t put a lot of focus on protecting users from the admins.
As a case in point, the re-naming of “private messages” to “personal messages” – the forum admins need to be able to audit PMs for harassment etc without the abusive participant noticing.
Make sure that your journalists know how to go from a codename & document number to the actual document, and that this _actually WORKS,_ so you don’t have people uploading documents to the forum in order to get their work done.
---
### Author:  [@pirhoo](https://meta.discourse.org/u/pirhoo)
#### Post date: [April 23, 2018, 10:35pm UTC](https://meta.discourse.org/t/encrypted-pgp-messaging/19149/47 "2018-04-23T22:35:51Z")
Yes, we already advise them to use Signal, and of course we have many security instructions like the one @riking mentioned. But each investigation involve hundreds of journalists, not all of them are tech savvy and since there is no ways to ensure they follow our recommendations, we must encrypt as many things as possible to lower risks.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [April 23, 2018, 10:45pm UTC](https://meta.discourse.org/t/encrypted-pgp-messaging/19149/48 "2018-04-23T22:45:36Z")
The main things to check with regards to “database being leaked”:
- anyone who has **admin access to your Discourse** can download the DB so limit the number of admins, and perhaps only log in as admin when absolutely required, use a “regular” moderator account typically
- anyone who can **log into your hosting server** can directly grab the database, so strictly limit and control who has login credentials to your hosting server.
---
### Author:  [@pirhoo](https://meta.discourse.org/u/pirhoo)
#### Post date: [April 23, 2018, 10:51pm UTC](https://meta.discourse.org/t/encrypted-pgp-messaging/19149/49 "2018-04-23T22:51:07Z")
Gotcha, I’ll limit the number of admin, thanks!
So I suppose no one ever implemented OTR in PM then?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [April 23, 2018, 10:52pm UTC](https://meta.discourse.org/t/encrypted-pgp-messaging/19149/50 "2018-04-23T22:52:54Z")
It’s a very difficult problem space. I’d also STRONGLY recommend (require?) two factor auth for your hosting server login.
(We do support two factor auth in Discourse as well, but admins can override that as a technical support tool.)
---
### Author:  [@pirhoo](https://meta.discourse.org/u/pirhoo)
#### Post date: [April 23, 2018, 10:53pm UTC](https://meta.discourse.org/t/encrypted-pgp-messaging/19149/51 "2018-04-23T22:53:28Z")
We have 3-factors of authentication in fact, using our own SSO.
---
### Author:  [@fefrei](https://meta.discourse.org/u/fefrei)
#### Post date: [April 24, 2018, 6:49am UTC](https://meta.discourse.org/t/encrypted-pgp-messaging/19149/52 "2018-04-24T06:49:50Z")
> [@codinghorror](#):
>
> The main things to check with regards to “database being leaked”:
I’d like to add one point:
- **Keep Discourse and the host up to date.** As is the case for any complicated software, sometimes, security vulnerabilities surface that could lead to the database being compromised. Assuming you won’t be the target of sophisticated attacks that specifically target _you_, quickly installing patches can eliminate most of that risk.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [April 24, 2018, 11:33am UTC](https://meta.discourse.org/t/encrypted-pgp-messaging/19149/53 "2018-04-24T11:33:11Z")
The underlying issue is that you can not trust the server if you want truly secure messaging between members.
This means that the software used to encrypt and decrypt stuff should not be sent from the discourse server.
I second what was said here, you want something like keybase or signal for secure comms, you have to invest in training here. Treat the info you have on Discourse as potentially leaked, there are just too many vectors. People hosting the service, web browser caches on local computers running old exploitable operating systems and so on.
If I was pushed hard to come up with something for journalists discussing highly sensitive info that is Discourse I would
1. Host the physical server in my house or somewhere I can see it all the time
2. Use SSL clearly
3. Only have myself as admin
4. Enforce limited user agent support, demand everyone use a very specific browser and only allow that user agent on the site, this browser would not store any cached files on local disk
But… even with all of that .. signal/keybase is much better on so many levels
---
### Author:  [@vexnot](https://meta.discourse.org/u/vexnot)
#### Post date: [January 14, 2021, 9:55am UTC](https://meta.discourse.org/t/encrypted-pgp-messaging/19149/54 "2021-01-14T09:55:06Z")
It would be great if there were an **AutoCrypt** overlay for Discourse (or similar aynchronous posting platform)
> **[Autocrypt 1.1.0 documentation](https://docs.autocrypt.org/)**
It manages the “complexity” of PGP transparently for the user in a secure way. It’s ‘best effort’ mode still does not make known well enough to the user this allows fallback to clear text if without an explicit room configuration
Yes, I realize key exchange vs public out of loop. This would be without blind trust.
> [@elberet](#):
>
> Two Factor Authentication does authentication, it helps to securely establish a user’s identity
No. 2FA is nothing like ID management (like shibboleth). Are you obliquely making reference to _something I have and something I know?_ In that providing the proof of something I have is by extension an identity?
> [@elberet](#):
>
> encrypting emails generated by Discourse to protect against nosey MTAs
You will need also DANE confirmations.
> [@jetatomic](#):
>
> common email account providers
Are you implying ‘free’ accounts?
> [@jetatomic](#):
>
> share concerns about JS browser encryption
So did Movim which is why they abandoned OMEMO for their xmpp social web platform.
A github project worth reflecting upon is OverSec. While is is for android someone could pickup the gauntlet for android.
–
I will give more though to the threat models
> [@jetatomic](#):
>
> The problem with PGP traditionally has been the barrier of requiring 2 end users to jump through a bunch of hoops to get anything working
AutoCrypt ftw?
> [@jetatomic](#):
>
> I also realize that most people simply don’t care
Tolerance of the evils perpetrate against privacy have created the ground for the current menaces. I don’t know how solve indifference.
> [@jetatomic](#):
>
> Email is increasingly seen (by “the public”) as antiquated,
Using this reasoning I would invite them to discontinue using the far more antiquated internet.
Email, like xmpp and matrix, are federated.
> [@codinghorror](#):
>
> “no leaking content through email” mode for Discourse
Amen. Thank you
I disabled Digest Mode for this reason.
> [@jetatomic](#):
>
> My aesthetic preference for encrypting everything likely does not represent most users.
They need to be reeducated on this like adblocking.
> [@pirhoo](#):
>
> to use Signal,
Does this still problematically require a mobile number?
necro’d because it was a best match to a search
---
### Author:  [@Mevo](https://meta.discourse.org/u/Mevo)
#### Post date: [January 14, 2021, 12:41pm UTC](https://meta.discourse.org/t/encrypted-pgp-messaging/19149/55 "2021-01-14T12:41:30Z")
> [@vexnot](#):
>
> It would be great if there were an **AutoCrypt** overlay for Discourse
It would maybe also be great if people used more the search function before posting on a public forum (and/or read more before writing).
> [@Discourse Encrypt (deprecated)](https://meta.discourse.org/t/discourse-encrypt-for-private-messages/107918):
>
> play_button Original Plugin Description Last edited by @david 2024-12-03T15:46:08Z (UTC) play_button Check document
> [@vexnot](#):
>
> They need to be reeducated on this like adblocking.
It’s unclear to me: Are you advocating for more adblocking, or less?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [January 19, 2021, 9:15pm UTC](https://meta.discourse.org/t/encrypted-pgp-messaging/19149/56 "2021-01-19T21:15:57Z")
Yes, the main recommendations here are
- Install and use Discourse Encrypt plugin (very mature, we use it internally)
- Turn on “secure media” (warning, this is extremely difficult to configure)
- Turn on “private email” so no content leaks via email
[Previous page](https://meta.discourse.org/t/encrypted-pgp-messaging/19149.md?page=2)