You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+80-65Lines changed: 80 additions & 65 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,13 +3,18 @@
3
3
4
4
## About
5
5
6
-
WebCrypt is a serverless Web App that integrates with [OnlyKey](https://onlykey.io) and [keybase.io](https://keybase.io/) to provide PGP encryption everywhere on-the-go.
6
+
WebCrypt is a serverless Web App that integrates with [OnlyKey](https://onlykey.io) and [keybase.io](https://keybase.io/) to provide PGP encryption everywhere on-the-go. With OnlyKey and Keybase together you have offline cold storage of your OpenPGP keys and can still easily encrypt messages and files.
7
7
8
8
Supports Firefox, Google Chrome, Brave, and Edge (new) browsers!
9
9
10
-
Supports macOS, Windows, Linux, Chrome OS, and Android!
10
+
Supports macOS, Windows, Linux, Chrome OS, Android, and iPhone (Safari on iOS 13.3+)!
11
11
12
-
[Try it out here!](https://apps.crp.to/encrypt)
12
+
[Try it out here!](https://apps.crp.to)
13
+
14
+
[Encrypt Files](https://apps.crp.to/encrypt-file)
15
+
[Decrypt Files](https://apps.crp.to/decrypt-file)
16
+
[Encrypt Messages](https://apps.crp.to/encrypt)
17
+
[Decrypt Messages](https://apps.crp.to/decrypt)
13
18
14
19
## How it works
15
20
@@ -27,97 +32,93 @@ With Keybase user/key management is made easy and with OnlyKey private keys rema
27
32
28
33
{% include image.html file="webcrypt1.png" %}
29
34
30
-
{% include callout.html content="**Step 3. Receive an encrypted message or file -** To decrypt a message or file browse to [https://apps.crp.to/decrypt](https://apps.crp.to/decrypt) or [https://apps.crp.to/decrypt-file](https://apps.crp.to/decrypt-file). You can also create a unique link which allows anyone, with or without an OnlyKey to send you and encrypted file. This may be used in places such as an email signature to receive secure messages. The format is:
{% include callout.html content="**Step 3. Receive an encrypted message or file -** To decrypt a message or file browse to [https://apps.crp.to/decrypt](https://apps.crp.to/decrypt) or [https://apps.crp.to/decrypt-file](https://apps.crp.to/decrypt-file). " type="default" %}
39
36
40
37
{% include image.html file="webcrypt2.png" %}
41
38
39
+
{% include tip.html content="
40
+
You can receive encrypted messages and files from anyone, no tech skills are required!<br><br>
41
+
Receiving encrypted files is as easy as putting a custom link in your email signature:<br><br>
42
+
**Bob Smith**<br>
43
+
**Email:**Bobsmith@bobsmith.com<br>
44
+
**Phone:** 111.222.3333<br>
45
+
*Send me a secure [message](https://apps.crp.to/encrypt.html?type=e&recipients=bobsmith2) or [file](https://apps.crp.to/encrypt-file.html?type=e&recipients=bobsmith2)*<br>
- Link the text **'message'** to: https://apps.crp.to/encrypt.html?type=e&recipients=<mark>bobsmith2</mark>
49
+
<br><br>
50
+
- Link the text **'file'** to: https://apps.crp.to/encrypt-file.html?type=e&recipients=<mark>bobsmith2</mark>
51
+
<br><br>
52
+
- Change <mark>bobsmith2</mark> in the link to your Keybase user name
53
+
<br><br>
54
+
- Add a **'More info'** link to: https://onlykey.io/pages/webcrypt<br>
55
+
This link provides information to let your sender know what WebCrypt is, why it's secure, and includes a quick 30 second video that will shows how to use it.<br>
56
+
[](https://vimeo.com/374672956)" %}
57
+
42
58
### See WebCrypt in action {#openpgp-action}
43
59
44
-
After configuring your OnlyKey following [these instructions](#generating-keys) you can browse to the [Webcrypt app](https://apps.crp.to/encrypt) to send secure messages.
60
+
After configuring your OnlyKey following [these instructions](https://docs.crp.to/usersguide.html#generating-keys) you can browse to the [Webcrypt app](https://apps.crp.to/encrypt) to send secure messages/files.
45
61
46
-
- Enter a message to encrypt
47
-
{% include image.html file="encrypted-message.jpg" %}
62
+
{% include tip.html content="Watch a video [here](https://vimeo.com/374653109) that demonstrates using OnlyKey WebCrypt for file encryption<br>[](https://vimeo.com/374653109)" %}
48
63
49
-
- Enter the shown challenge code on the OnlyKey (i.e. 1,5,2)
50
-
{% include image.html file="encrypted-message2.jpg" %}
64
+
#### Sending secure messages/files
51
65
52
-
- Encrypted message shown, by clicking the button again it will be copied to clipboard
53
-
{% include image.html file="encrypted-message3.jpg" %}
54
-
{% include image.html file="encrypted-message4.jpg" %}
66
+
To create encrypted PGP message or file just:
67
+
- Browse to https://apps.crp.to/encrypt or https://apps.crp.to/encrypt-file
68
+
- Enter the recipient's Keybase ID in the first box
69
+
- Enter your Keybase ID (for the key you loaded onto OnlyKey) in the second box
70
+
- Enter your secure message in the third box
71
+
- Click "Encrypt and Sign"
72
+
- When prompted enter the challenge code onto the OnlyKey
55
73
56
-
- Paste the message into any email or chat (Sending via Gmail shown)
57
-
{% include image.html file="encrypted-message5.jpg" %}
74
+
The encrypted message will be displayed and you can paste it into an email, IM, app or pretty much anything. The encrypted .gpg file will be downloaded to your computer.
58
75
59
-
- When the recipient receives the message (email or chat) they can paste it into Webcrypt app to decrypt
60
-
{% include image.html file="encrypted-message6.jpg" %}
76
+
*Alternatively, if you don't want to use Keybase you can paste a public key*
61
77
62
-
- Enter the shown challenge code on the OnlyKey (i.e. 2,2,1)
63
-
{% include image.html file="encrypted-message7.jpg" %}
78
+
#### Receiving secure messages/files
64
79
65
-
- Decrypted message shown, if the sender signed the message you will see the sender's name (i.e. t) and their key ID.
66
-
{% include image.html file="encrypted-message8.jpg" %}
80
+
To decrypt PGP message or file just:
81
+
- Browse to https://apps.crp.to/decrypt or https://apps.crp.to/decrypt-file
82
+
- If you know the Keybase ID of the sender enter this in the first box, if you don't know this click the "Decrypt Only" radio button.
83
+
- Paste your encrypted PGP message in the second box or choose encrypted file
84
+
- Click Decrypt
85
+
- When prompted enter the challenge code onto the OnlyKey
67
86
68
-
- By clicking the button again the message will be copied to clipboard
69
-
{% include image.html file="encrypted-message9.jpg" %}
87
+
The decrypted message will be displayed or the decrypted zip file downloaded.
70
88
71
-
{% include note.html content="Messages sent via Webcrypt are never sent over the internet. The way it works is the necessary files are downloaded to your browser and all processing is done in your browser. Read more about [Webcrypt security here](https://docs.crp.to/webcrypt.html#security-goals)" %}
89
+
{% include note.html content="Messages and files sent via Webcrypt are never sent over the internet. The way it works is the necessary files are downloaded to your browser and all processing is done in your browser. Read more about [Webcrypt security here](https://docs.crp.to/webcrypt.html#security-goals)" %}
72
90
73
91
## Benefits
74
92
75
-
- This revolutionary approach makes PGP encryption easy and secure with OpenPGP keys securely stored on OnlyKey, not accessible to the app or to the browser. This is in contrast to for example PGP/GPG software, webmail (i.e. Protonmail), and smartphone apps.
76
-
- Physical user presence is required to process secure messages/files. This is in contrast to Smart Cards which only require a PIN code that can be captured and replayed without physical user presence.
77
-
- WebCrypt even allows Kebase user’s to receive secure messages and files from non-OnlyKey users. Anyone can use WebCrypt to send encrypted messages/files and can create a unique link to receive secure messages and files.
78
-
- With WebCrypt’s Keybase integration its easy to find Keybase users and send secure messages/files with the click of a button - https://apps.crp.to/search.
93
+
### Universal Support
79
94
95
+
This is accomplished by using the FIDO2 communication channel to communicate with a USB hardware device. The universal support for FIDO2 allows the web application to be used anywhere FIDO2 is supported including browsers on Android, iPhone (iOS 13.3+), Windows, Mac OS, Linux, and Chromebook. The web app can also be released as a native app that does not require a web browser if this is preferred.
80
96
81
-
##Setup
97
+
### Key Management
82
98
83
-
**Before using this app you must follow these instructions to generate PGP keys and load them on OnlyKey:**
84
-
-[Generate keys](https://docs.crp.to/usersguide.html#generating-keys) using Keybase
In addition to universal support, OnlyKey WebCrypt works with Keybase for easy user key management. Key management is one of the most difficult issues to solve when it comes to encrypting messages and files.
86
100
87
-
##Sending secure messages
101
+
### User Search
88
102
89
-
To create encrypted PGP message just:
90
-
- Browse to https://apps.crp.to/encrypt
91
-
- Enter the recipient's Keybase ID in the first box
92
-
- Enter your Keybase ID (for the key you loaded onto OnlyKey) in the second box
93
-
- Enter your secure message in the third box
94
-
- Click "Encrypt and Sign"
95
-
- When prompted enter the challenge code onto the OnlyKey
96
-
97
-
The encrypted message will be displayed and you can paste it into an email, IM, app or pretty much anything.
98
-
99
-
*Alternatively, if you don't want to use Keybase you can paste a public key instead as shown in the animation below:*
103
+
The first step in secure communication is often finding the person to communicate with and having assurance that it is them. With the OnlyKey WebCrypt Search its easy to find users on Keybase by:
104
+
- Twitter, Github, Reddit, or Hackernews Usernames
105
+
- Web domains
106
+
- PGP fingerprint
107
+
- Or Automatically search for best match
100
108
101
-
109
+
### Better than a Smart Card
102
110
103
-
## Receiving secure messages
111
+
Smart cards are a popular way for keeping keys offline but they are not exactly known for being easy to use and are definitely not universally supported. OnlyKey provides similar function to a token/smart card but no drivers or software is required. Additionally, physical user presence is required to process secure messages/files. This is in contrast to Smart cards which only require a PIN code that can be captured and replayed without physical user presence allowing malware to decrypt a user’s data.
104
112
105
-
To decrypt PGP message just:
106
-
- Browse to https://apps.crp.to/decrypt
107
-
- Enter your Keybase ID (for the key you loaded onto OnlyKey) in the first box
108
-
- Paste your encrypted PGP message in the second box
109
-
- Click "Decrypt and Verify"
110
-
- When prompted enter the challenge code onto the OnlyKey
111
-
112
-
The decrypted message will be displayed. Read it and then close the browser tab and there will be no trace of the decrypted message.
113
+
### Better than OpenPGP
113
114
114
-
115
+
OpenPGP is widely used but not exactly known for being easy to use. There have been efforts such as Keybase and Protonmail that make OpenPGP easier to use but require that private keys are accessible in software or the cloud. This means that in some cases user’s OpenPGP keys may be obtained by phishing attacks, malware, or software vulnerabilities. OnlyKey WebCrypt supports OpenPGP keys that are compatible with Protonmail, Keybase, Mailvelope, GPG, and others while allowing users to securely keep their keys offline.
115
116
116
-
## Security Goals
117
+
## Security Goals {#security-goals}
117
118
118
119
**Make PGP easy**: Traditional PGP makes journalists angry, we think you shouldn't have to be technologically savvy to use PGP so we built WebCrypt.
119
120
120
-
**Empower the people**: Give people the ability to securely send and receive messages using any computer or Android device with no complicated software/drivers required and no worrying about compromise of user's private identity.
121
+
**Empower the people**: Give people the ability to securely send and receive messages using any computer or Android/iOS device with no complicated software/drivers required and no worrying about compromise of user's private identity.
121
122
122
123
**Serverless**: All processing done via javascript in users own browser locally (no server to hack).
123
124
@@ -131,7 +132,21 @@ The decrypted message will be displayed. Read it and then close the browser tab
131
132
132
133
We are always working to make WebCrypt better, pull requests welcome!
133
134
134
-
## Protocol
135
+
## Societal Impact Goals {#society-goals}
136
+
137
+
The issues solved by OnlyKey WebCrypt are issues that affect many at-risk communities such as human rights
138
+
activists and journalists.
139
+
140
+
### Universal support
141
+
Many journalists may travel and may have to make do with whatever internet connection that is available such as using a shared computer or a mobile device. OnlyKey WebCrypt does not require installing software, all that is needed is a USB port, a common web browser (i.e. Chrome, Firefox), and an internet connection.
142
+
143
+
### Ease of Use
144
+
It is often the case that secure solutions are not adopted not because of lack of availability but that they require considerable technical skills. For example, installing smart card software may require command line utilities and a high level of technical proficiency. At-risk communities may not have the technical proficiency to do this, with OnlyKey there are no commands necessary, setup is as easy as following step by step directions to generate a private key on Keybase and load onto the OnlyKey. This opens up the solution to a much wider range of at-risk communities.
145
+
146
+
### Plausible Deniability
147
+
Human rights activists and journalists may reside in or travel to countries with encryption bans or mandatory key disclosure. OnlyKey already has a feature for this to provide plausible deniability. Full details of this feature are available [here](https://docs.crp.to/pdguide.html).
148
+
149
+
## Technical Specs
135
150
136
151
The protocol outlined below utilizes existing communication channel via FIDO2.
0 commit comments