Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil.
-
No spam.
-
Posts are to be related to self-hosting.
-
Don't duplicate the full text of your blog or readme if you're providing a link.
-
Submission headline should match the article title.
-
No trolling.
-
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
-
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
view the rest of the comments
~~Are you sure they can't decrypt? They have your certificate after all.~~ Besides, if the Orange has a bad day, he can ban certificates export or just for a single company or individual.
Edit: First two sentences were stupid, I apologize.
Yes, the private key never leaves your machine.
You send them a certificate signing request with your public key, they put their verification stamp on it and send it to you.
The only part they have to play is verifying that your certificate is trusted by a root certificate.
The CA cannot decypt: they don't have the secret key which only the server has. When requesting a new certificate from the CA, the server generated a secret key (aka private key) and then generated a derived public key that goes into a Certificate Signing Request (CSR). The CSR is what the CA receives, not the secret key, and then the CA returns the certificate file to the server, which has been endorsed by the CA and thus trusted by the user base.
Phrased another way, a certificate is the instrument that confirms that a purported public key can in-fact be safely used, and that no MITM attack is happening (assuming you trust the CA that signed the cert). But once you've confirmed the public key, the rest of the cryptography is public key cryptography, meaning the secrecy of the secret key is the whole game.
Yep, you guys are right.
A MITM doesn't require decrypting. It just requires telling a convincing enough lie to each side of a conversation that they think they're talking to the other party. Then you end up encrypting to their key which they can just read. That's different from breaking the encryption.
No, and none of the state actors who do that kind of stuff will ever tell you. Watch The Imitation Game for a good/bad time and some context.
If you had a break for the modern crypto schemes and published it right now you would shut down all digital commerce, a lot of the spy traffic if not most of it^1^, and nothing could be started back up again until everything was redone from scratch. Best hope would be that the post quantum algorithms^2^ the cryptographers have aren't succeptible to whatever you did to break the existing algorithms. It'd take a bit to get the software implementations and keys in place, etc. The hardware stuff would take longer.
Quantum computers only threaten asymmetric ciphers, so every symmetric cipher is still safe, not just one-time-pads but things like AES and ChaCha20 aren't affected at all.
Ah. That's a misunderstanding on my part, and a good news story. Still don't want to wake up tomorrow and see a published AES break, though.
The certificate is only used for authentication. The actual data is encrypted with a temporary symmetric key that is generated via a diffie-hellman exchange
Even if they had your private key they still wouldn't be able to decrypt the data
They don't have your private key
The private key isn't used for encryption