Re: org-crypt ?

[David Masterson <dsmasterson@gmail.com>]

Tim Cross <theophilusx@gmail.com> writes:

> David Masterson <dsmasterson@gmail.com> writes:
>
>> Tim Cross <theophilusx@gmail.com> writes:
>>
>>> David Masterson <dsmasterson@gmail.com> writes:
>>>
>>>> Tim Cross <theophilusx@gmail.com> writes:
>>>>
>>>>> Warning: I have not used org-crypt for many years. These days, I just
>>>>> use a .org.gpg extensions and symmetrically encrypt the whole file.
>>>>> However, I think I can probably answer some of your questions -
>>>>
>>>> Hmm, two questions that this brings up:
>>>>
>>>> 1. Do you access your files on (say) iPhone?
>>>> 2. Do you store your files in Git (say Github)?
>>>>
>>>
>>> Well, yes and yes, but I don't tend to need to access encrypted files on
>>> iphone. I do have encrypted files in github. For example, I have a
>>> private repository of files I share across computers (Linux and macOS).
>>> Some of these files are gpg encrypted.
>>
>> Exactly the system I'm looking for! (or almost)
>>
>> I am already using (Emacs, Org, MaGit) on Linux, (BeOrg, Working Copy)
>> on the iPhone, and a Github private repository.  This is complicated to
>> the new user (like me w/ 42yrs [off and on] of Emacs usage), but Git has
>> saved me a number of times on resyncing if I change things on both
>> sides.  But I would like to use more encryption with this.  When it's
>> secure, I'd like to roll it out on my family's iPhones as well.
>>
>
> I suspect the challenge will be in getting gnuPG support on the iphone.
> I've never tried that and don't know if there is a gnuPG version for
> iphone. That would be the first thing I'd try to verify. If you can
> encrypt/decrypt on the iphone, it should be possible to handle the
> rest.

Ah, that's the "almost" that I'm still figuring out.  BeOrg can work
with symmetric encryption and org-crypt (perhaps also epa) which stores
the encrypted stuff as text in the Org file (therefore, fully Git
compatible).  I'll have to look at BeOrg more about asymmetric
encryption as well as full file encryption.

> The one problem you can run into with gpg files and git is that git can
> see those as binary files. The general 'rule of thumb' is that you don't
> put binary files into git. The thinking is that binary files are
> typically generated from some text file and it is the original source
> text which you would put into git. There are also some minor technical
> issues, mainly with large binary files, which make git somewhat
> inefficient.

> The big issue however is that by default, most git forges, like github,
> have a limit on the siace of binary files they will allow in git. That
> size is reasonably large, but there is a limit which I think you have to
> pay to have increased. I've not run into that limit with encrypted
> files, but have with PDFs and other formats I wanted to include in my
> git repo. 

Yeah, saw some discussion on that and shied away...

> Based on your desire to roll something out to your family, I would
> actually recommend a different route. There are some very good open
> source password managers out there. Many of them, for a very small fee
> (i.e. $12pa), will also provide a few Gb of encrypted file storage as
> well.

Been using free versions of KeePass w/ Cloud storage.  Very powerful on
Windows.  Reasonable elsewhere.

The family is relatively easy when I have a stable environment.  That
involves full documentation with key things encrypted. I'm not sure
about having them use BeOrg yet, though.

> What I find good with some of these is that provided you select the
> right one, you have full control over the encryption (so the server the
> provider uses has your data encrypted and only you have the key) and
> they usually have mobile device support. The big benefit is that the
> mobile clients will take care of the encryption/decryption bits.

I wanted to use Keybase (encrypted cloud-based Git) which would've
covered everything, but it seems to have been bought out and died.

-- 
David Masterson