Encrypted Messaging, The Puppy Way? [SOLVED]

[williams2]

I thought this meant I could use .zip, .gz, .bz2, but these aren't available on the command line version?

You can set the type of compression with -t For example:

Code: Select all

7z a -tzip compressed.zip files
7z a -t7z compressed.7z files
7z a -tbz2 compressed.bz2 files

You can set the compression level and other parameters for some types using -m For example:

Code: Select all

7z a -mhe -mx9 compressed.7z a-dir/

-mhe encrypts the header and file names as well as the content of the files.
-mx9 sets maximum (ultra) compression level.

I downloaded the 7-Zip 21.01 alpha (2021-03-09) for Linux: console version here:
https://www.7-zip.org/download.html
It seems to work properly in BionicPup64.

[JASpup]

Croc looks good. My thinking for an executable is the purpose of a container for the encrypted message itself and no complicated involvement, only trust required between parties.

If we could make a password prompting .sfx display the message without issuing another command, that would solve the problem.

run file - enter password - read message

Broadly such a simple setup would be vulnerable to a brute-force hack, but for this type of interpersonal communication it's just a quaint solution.

You can make a self extracting 7zip sfx file for Windows. Just click the file to unzip it, 7zip does not need to be installed on the other machine. The person needs the password, of course.

[JASpup]

The "method" I was looking for is "type". That's what I missed thanks.

I am not in Puppy atm, but I recall cli 7z installed default (still using Tahr and Xenial).

The gui is great if one exists for Linux but I should probably better in the terminal first.

I thought this meant I could use .zip, .gz, .bz2, but these aren't available on the command line version?

You can set the type of compression with -t For example:

Code: Select all

7z a -tzip compressed.zip files
7z a -t7z compressed.7z files
7z a -tbz2 compressed.bz2 files

You can set the compression level and other parameters for some types using -m For example:

Code: Select all

7z a -mhe -mx9 compressed.7z a-dir/

-mhe encrypts the header and file names as well as the content of the files.
-mx9 sets maximum (ultra) compression level.

I downloaded the 7-Zip 21.01 alpha (2021-03-09) for Linux: console version here:
https://www.7-zip.org/download.html
It seems to work properly in BionicPup64.

[JASpup]

Hmmm. In college (not recently), I don't remember compilers being that forbidding. We just usually had to pay for them (I remember liking Borland's products).

Linux seems so tech-user oriented you'd think compiling tools would be out there in front.

Maybe my aberrant thinking makes sense:

I'm not trying to write encryption software.

The most basic explanation is: imagine 30 lines of "echo" commands containing a single, static message in an executable displayed after a user-entered variable matches the set password. That's the entire program.

You can't read or decipher the text because it's complied. No encryption required.

GCC is in the PPM. <stdio.h>

You do not want to install GCC using PPM Puppy Package Manager. It would be difficult to get it to work properly.
You do want to download and use the devx sfs file, probably using QuickPet.

You usually do not want to write your own encryption software anyway. It is very very very easy to get it wrong.

[williams2]

I wrote:
7z a -tbz2 compressed.bz2 file
which is wrong, it should be -tbzip2

Some 7z examples here: https://thedeveloperblog.com/7-zip-examples

You can add comments to a 7z file, which could be the message.

I seem to remember that an sfx 7z file can extract files and automatically "run" one of the files.
For example, "running" a text file would be the same as if it was clicked.
I'm not sure that I'm remembering it properly. It sounds unsafe. I haven't really used Windows for a long time.

quote:
SFX module for installers (7zSD.sfx) allow you to create your own installation program. Such a module extracts the archive to the user's temp folder, and runs a specified program, and removes the temp files after the program finishes.

[JASpup]

Maybe new possibilities, A 7z solution would be a lot easier than writing a custom program.

I see zip offers comments:

-c add one-line comments -z add zipfile comment

yet don't see them in 7z. Encrypted zip files display both file and archive comments without the password.

The info I find on self-extracting archive automatic execution is geared towards application installers (e.g., "setup.exe") and not simple text.

EDIT: This Windows utility might work if we can execute associated files and not just .bat / .exe:
https://revocue.cz/en/make-sfx/index.php

I wrote:
7z a -tbz2 compressed.bz2 file
which is wrong, it should be -tbzip2

Some 7z examples here: https://thedeveloperblog.com/7-zip-examples

You can add comments to a 7z file, which could be the message.

I seem to remember that an sfx 7z file can extract files and automatically "run" one of the files.
For example, "running" a text file would be the same as if it was clicked.
I'm not sure that I'm remembering it properly. It sounds unsafe. I haven't really used Windows for a long time.

quote:
SFX module for installers (7zSD.sfx) allow you to create your own installation program. Such a module extracts the archive to the user's temp folder, and runs a specified program, and removes the temp files after the program finishes.

[JASpup]

This is interesting:

Code: Select all

root# 7z x sb.7z -so

7-Zip [64] 9.20  Copyright (c) 1999-2010 Igor Pavlov  2010-11-18
p7zip Version 9.20 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,4 CPUs)


Error:
I won't write data and program's messages to same terminal
root# 

I tried to extract a 7-zip archive to the standard output, yet it won't share.

[williams2]

You can make a self extracting encrypted 7zip executable, but it doesn't automatically run anything.

You can make a self extracting 7zip installer executable, and it will, for example, automatically "run" the readme.txt file in the 7z archive. But the 7zip archive can't be encrypted. The sfx installer file won't work with encryption.

If you want to send an executable attachment to a university's mail server, often the admin will configure the server to block all executable attachments.

If you run a 7zip self extracting installer, Windows pops up a message asking for permission to let the program make changes to the operating system.

[JASpup]

The sfx installer file won't work with encryption.

That's the fail line.

You're not plussed by ROT13 or by my neophyte coding aspirations, yet I wonder how exotic my functional requirements are:

• a password-encrypted message

• no automatically saved deciphered file output

• no installations, exotic command lines, & very little recipient thought

This post contains a plethora of useful technologies for more conventional encryption.

EncFS is working well and is an elegant storage solution. I passed on its CryptKeeper gui tray applet for being > 50MB. I like Vera but at the file-level it will probably be OpenSSL since no installation is required.

[williams2]

I wonder how exotic my functional requirements are

I remember, a long time ago, there was a MS Windows app.
You would type in a message, click a button, and it would create a small executable.
Clicking the executable would pop up a window with the decrypted message.
The message could be copied and pasted, if you liked.

I do not remember the name of the program. I'm sure I don't have a copy of the program.

There is a Windows driver for EncFS, I think. If you ever wanted one.

With tutanota, you can send encrypted emails to anyone. A link is sent to their email address. The person clicks the link, enters the password, and sees the decrypted email, and can reply also using encryption.
It is encrypted end-to-end so only that person can see the email.
Yes, the contents of the email are stored on the Tutanovas servers, but it is only stored as encrypted data. No one can access the encrypted emails unless they have your password. The owners of the Tutanota servers can not decrypt the data, because they do not have the password. Your isp can not see the decrypted data.

Of course, you can delete anything that you don't want to keep on their servers.

Tutanota is all open source. You can download and examine the code at Sourceforge.

[JASpup]

I remember, a long time ago, there was a MS Windows app.
You would type in a message, click a button, and it would create a small executable.
Clicking the executable would pop up a window with the decrypted message.
The message could be copied and pasted, if you liked.

Reads like it would work. I've never heard of such an app.

I do not remember the name of the program. I'm sure I don't have a copy of the program.

[trying not to veer too off-topic]
Searching is tricky. I just loaded a Palemoon SFS I couldn't find after loading, thus execute. Tahr default version was too old for the page I was trying to view, and the Updater doesn't work.

I'm in Firefox Light (X-Tahr default) by SFS at the moment. I have a bunch of browsers around but wanted Mozilla.

Anyway, like these well thought-out forum groups, it's not easy to organize folders and volumes before we know what goes in them.

I'm just making two copies of everything and hoping for the best. Maybe you have it.

There is a Windows driver for EncFS, I think. If you ever wanted one.

I'm trying to stay out but I might. I print there but also seek to use a USB condensermic that's plug-in-play for Windows. If it's even possible to work in Puppy the solution has to be easier than the hassle of booting Windows.

With tutanota, you can send encrypted emails to anyone. A link is sent to their email address. The person clicks the link, enters the password, and sees the decrypted email, and can reply also using encryption.
It is encrypted end-to-end so only that person can see the email.
Yes, the contents of the email are stored on the Tutanovas servers, but it is only stored as encrypted data. No one can access the encrypted emails unless they have your password. The owners of the Tutanota servers can not decrypt the data, because they do not have the password. Your isp can not see the decrypted data.

Of course, you can delete anything that you don't want to keep on their servers.

Tutanota is all open source. You can download and examine the code at Sourceforge.

I read Snapchat is working on encrypted messaging, if it doesn't have it by now (non user):
https://www.digitalinformationworld.com ... sages.html

I would trust Tutanota more, but the issue of an unnecessary third party persists.

On this idea of secure encryption, I'm trying to wrap my head around how the level of security matters if the data is always accessible with a password. It's as if the password is the encryption. Otherwise how we name the file(s) themselves give would-be hackers the indication of what they're looking at.

[williams2]

Reads like it would work. I've never heard of such an app.

It was something like one of these apps. https://tinyapps.org/file.html
It might have been mpcrypt, but it's a self extracting 7zip file with a password. i don't know the password.
I tried privyCrypt (after scanning it on https://www.virustotal.com/ ). It works but doesn't save a message in an executable.

Passwords are always a weak link. Some encryption schemes allow you to create key files instead of passwords. The key file would be a strong key, vs. a weak password.

[JASpup]

Yes, I've seen those. A key file is like another password you'll be tempted to encrypt with a password because it's not hidden and you can't remember it.

Wrote earlier, OpenSSL would have worked if my counterparty didn't have to install it in Windows for the two great features of password encryption and printing to screen sans file output.

It's funny how the functional demands are so small but not conventional, thus not easily achieved.

[williams2]

I guessed the password for mpcrypt.7z.
The password is "tinyapps.org", without the quotes.

https://tinyapps.org/file.html
https://tinyapps.org/downloads/mpcrypt.7z

[JASpup]

I guessed the password for mpcrypt.7z.
The password is "tinyapps.org", without the quotes.

https://tinyapps.org/file.html
https://tinyapps.org/downloads/mpcrypt.7z

Imagined working:

This is the app you described and thought you didn't have?

MP-Crypt 0.5b [26k] + Easy file and directory encryption. Option to create self-decrypting files. (With the kind permission of MP-Crypt's author, this download is hosted by TinyApps. MP-Crypt 0.6 is shareware and twice as large. As always, download and use at your own risk and joy.)

From it alone, and not your description, I wouldn't think it could display the deciphered output (in its own window? notepad?) on its own.

EDIT: The first attachment is the response to the decipher password. In this case it simply extracted the text file from .exe. The second is MP-Crypt 0.5 options dialog running under wine:

[FredW]

Personally, I like Telegram. One reason is that you can have the same login on several devices, unlike WhatsApp or Signal. Thus, you can have it on several cellphones, your Windows laptop, your Windows desktop, a Mac desktop, etc., all with the same identity. The only feature that is unique to a given device is what they call a "secret" chat, one that is device-encrypted at each end, and that is, of course, because it is *device* encrypted. Normal chats are server-side encrypted, and all video and voice chats are end-to-end encrypted. Telegram says their source code is available for public viewing, which sounds good. And it's not owned by Facebook.

Since I use FossaPup64 much more than Windows, I was keen to try to get Telegram working here, and, much to my surprise, the "Get Telegram for Linux 64" button on the https://desktop.telegram.org/ page let me down load a compressed file which, when extracted to my home folder on my desktop contained what appeared to be an appimage, and when I clicked on that it opened right up and looks like it works fine. What a pleasant surprise! Now I'll just add a link to my Puppy desktop.

[JASpup]

Personally, I like Telegram.

2 points, 2 problems

point 1.
This post is open for new alternatives, but it's directed at a specific goal and list of constraints at a lower technical sophistication threshold than normal (why a sledge hammer can't twist a screw).

point 2.
The constraint posed by Telegram is using an outside service and requiring the communication partner to sign up for a new service. It seems powerful for free with no ads.

As posed:

• a password-encrypted message

• no automatically saved deciphered file output

• no recipient installations, exotic command lines, services & very little recipient thought

Why Telegram Is Now 'Dangerous' For Millions Of You
https://www.forbes.com/sites/zakdoffman ... -10-users/

Based on initial impressions, I would prefer Signal.

problem 1.
I was just informed by a seemingly knowledgable party that compiled c code doesn't jumble text. Iow, if you compile a .c with a password and plain text in "echo" commands, you can still read the complied text.

problem 2.
OpenSSL is a solution except for the Windows installation requirement. Generally it's not normal to decipher without creating an output file. That's the goal, and it has to work in Windows, created there or in Linux.

[JASpup]

My solution is three files in an archive:

• Windows 7z cli utility

• password protected message

• a simple batch file (script) to decipher the message to screen

The batch command needs a pipe to print to screen (| more/less), but it works.
Without pipe: viewtopic.php?f=2&t=2490&p=23092&hilit=output#p23092

It appears only two supported formats allow passwords, .zip & .7z. I'm partial to .zip, but a .zip utility is built-in to Windows and my .zip password was being 'remembered' (bug?) by File Explorer. I could extract the file without the archive password.

To my surprise, tar is also native to Windows these days.

[williwaw]

7zip can also be had as a portable for windows. keep it on a usb or a self contained "Install" on the desktop.

Did you work out the syntax for extracting a message to sdout in windows? Is the script interactive by asking for the password?

[JASpup]

Did you work out the syntax for extracting a message to sdout in windows? Is the script interactive by asking for the password?

If I were going to have a message partner on Windows install an app, it would be OpenSSL.

Dr. Receiver may already have 7-zip on their system. I just have to work with basic assumptions.

Both questions yes.

The 7z standard out switch is -so, and as linked in last post it requires a pipe to work (thank you Stack Exchange!). Windows doesn't like "| less" so "more" it is.

I'm very rusty on batch files and was never that advanced to begin with, but this works:

Code: Select all

echo enter password below:
7z e -so [given filename].7z | more

Message is printed to screen while no output file is created.