NEWSCARD: Decentralized, Encrypted Paste Bin via Usenet Newsgroups

• NEWSCARD * Publish and fetch permanent named records via Network News

Newscard creates a decentralized, encrypted, named record paste bin.

[git repo] https://codeberg.org/OCTADE/newscard (use most recent version only)

With a single command, name the card, snarf the file and encrypt it.

With another command, push the encrypted file to the public network.

With another short command, snarf a file from the network.

Only users knowing the name [key] of the record will be able to decrypt it.

If a strong passphrase is used to name the file, it will be very secure.

This is useful for quickly snarfing, encrypting, and publishing a text file:

$~: card enc [passphrase] [file]
$~: card put [passphrase]

It is useful for retrieving a text file with just a key:

$~: card get [passphrase]
$~: card show [passphrase]

If and when you want the general public to access the record just share the keyword.

Newscard uses nine (9) (NINE) layers of encryption with OpenSSL chacha20 cipher.

Newscard generates 9 each of: cipher keys, salts, key iteration parameters.

It would be nice if something like this were added to the ActivityPub protocol, such that keyword[@]host.url would do the same thing. Then secret text records could be stored securely for later retrieval or revelation.

#NewsCard #Pastebin #Usenet #NNTP #NetworkNews #Encryption #Cryptography #Messaging #Anonymity #Protocols #OpenSource #FreeSoftware #BlackHackJack #Censorship #Retro #InfoSec #Ciphers #Codes #FOSS #CyberSecurity #Privacy #ComSec #OpSec #OpenSSL #ChaCha20

@usenet
@cryptography

[image description]

Playing card of the Jack of Clubs. The Jack is a moustached man in a black top hat and suit in a oval center cameo. The colors are inverted so that everything on the face is black except the lines which are white, like a charcoal cutout picture., giving it a retro digital appearance mixed with retro handicraft vibes.

OpenSSL's latest advisory covers 9 patched vulnerabilities. Our engineers Filipe Casal and Opal Wright found 4 of them as part of Patch the Planet.

The headline finding is CVE-2026-63072: a deterministic 8-byte heap overflow in CMS key unwrapping that an attacker triggers by changing one byte in a legitimate message. Reachable from CMS_decrypt() on every supported branch back to 1.1.1.

https://openssl-library.org/news/secadv/20260825.txt

#openssl #infosec

OCTADE Project Software : Signed Papers Portal

I am hacking on a cryptographic verification web portal. I seek comments and suggestions on the user interface (UX) and feature set.

Accessibility perspectives might be helpful since this involves slightly complex signatures and verification commands.

The server software automatically hashes and signs all files uploaded to the site. The software also generates 'verification bundles' that users may download to verify signatures using 'gnupg' and 'openssl'.

https://files.octade.net/publications/

Feedback would be helpful for improving the software before I release any source code.

#cryptography #cryptology #signatures #DataIntegrity #verification
#keys #gpg #pgp #openssl #crypto

[demo] https://files.octade.net/

I drafted a prototype for a PHP server application that automatically hashes and signs files and presents visitors with verification archives containing digital signatures for offline verification. The site allows readers to view, download, hash, and verify signatures of files. Since I occasionally like to publish puzzles and bits of cryptology, I just had to make this to scratch the old itch.

The neat thing about this design is that the current version has zero JavaScript. It uses CSS3 hacks with anchors and URL probing to emulate JavaScript and AJAX functionalities for modal dialogs to present server-side JSON data as HTML text.

When I upload files or documents to the server, the interface automatically presents them to the user in a grid. So now all I have to do is upload files and documents and the server generates the site.

The reader can then click buttons to hash, sign, view, verify, and download files.

GnuPG and OpenSSL Signatures are generated automatically on user demand. The site visitors can download these signatures and the public keys to verify files.

What should I add / change in the application and its interface?

What accessibility components might be warranted?

Should the application parse and present EXIF data, or is that too much?

#PHP #CSS3 #HTML5 #WebDesign #UX #cryptology #cryptography #crypto #signatures #OpenSSL #GnuPG #GPG #PGP #encryption #papers #preprints #documents #SelfHosted #WebLord #WebMaster #WebSerf #NoJS #Apache #CyberSecurity

@cryptography@soc.octade.net