Does it exist, some sort of encrypted journal-like app where I can type things which will be forever locked away? In my mind and in a place I can feel confident about, without a doubt.

Pen and paper requires burning afterwards, I don’t think I want to do this.

I know no opsec solution is perfect. I need some sort of outlet. I need some sort of solution.

I was thinking. Maybe, at least, some solution where even though access is non-negotiable, if somebody does get in, I can accept that the entity was already determined enough to end things.

Thanks.

Edit: I should I guess mention the obvious such as encryption and possibly authentication with a hardware security key. Any other features that might be out there I am hoping to hear about.

  • notabot@piefed.socialEnglish
    9·
    1 day ago

    An airgapped machine is certainly going to be most robust from external attack, but even then you should probably encrypt your files to ensure privacy should you ever discard, or otherwise lose control of, the storage media.

    An encrypted partition may be sufficient, but your journal entries will still be “plain text” when it is mounted, and so you will be able to read them without extra effort. If you want to make it so that once an entry is written it is encrypted and can only be read with deliberate effort, you could use GPG encryption.

    First generate a key pair with a really strong passphrase, and store it on a USB drive. Then import just the public key onto your journaling machine and store the USB drive somewhere safe. With just the public key on your machine you can encrypt files, but you can’t decrypt them. Ideally you’ll set up your journalling tool to only write via GPG, but if not, you can just encrypt each entry after you write it.

    As to what journalling tool to use, I like VIM, although I know not everyone gets on with it. You can have it start up with a template ready to go, not write temporary files, and save via GPG so the plaintext never hits persistent storage.

    • ehguyitsmebuddy@lemmy.worldOPEnglish
      4·
      1 day ago

      Thank you. This is really insightful and something that I think might be a robust solution for me. I’ll research GPG more, I clearly need to.

      • observantTrapezium@lemmy.caEnglish
        1·
        1 day ago

        The fundamental difference between GPG encryption and encrypted partition is that of asymmetric vs. symmetric encryption. Whether you mount encrypted storage or decrypt a file with GPG, there’s some “effort” in putting in the passphrase and in both cases the system’s keyring is briefly aware of it and the plaintext is saved to memory (volatile, unless you have encrypted swap or other edge cases).

        Asymmetric encryption is not normally used for personal stuff but mostly to exchange material with one party holding the private key, and other having access to the public key (which is public). Of course you can act as both parties if you like. If you do, keep in mind:

        1. Asymmetric encryption algorithms may be vulnerable to quantum computing attacks in the coming years. There are quantum-resistant algorithms, but to my understanding they are not necessarily quantum-proof and could potentially be broken in the more distant future.
        2. If you do choose to use GPG, make sure that the plaintext never touches the disk, for example save it to /dev/shm before encryption.
        3. You can also protect your private key with a passphrase.

        Personally I use Joplin. On the clients it’s secure because the database is saved on encrypted storage secured by my login phrase. On the server it’s secure by Joplin encrypting the files saved to WebDAV storage. Is it 100% safe? Probably not, but probably good enough to stop all but a nation-state level actor.