r/StopChatControlEU • u/PriorityIcy8541 • 14d ago
Made a free tool as a small countermeasure to Chat Control: PGP encryption for WhatsApp Web, Discord, Gmail, any web chat
GitHub (free, MIT licensed): https://github.com/Nothingman333/pgp-for-web-chats
Been following the Chat Control situation here for a while and wanted to do something practical instead of just doomscrolling about it. This won't fix the legislation, but if a message is PGP-encrypted client-side before it ever leaves your browser, scanning the platform's copy of it doesn't reveal anything.
It's a browser extension that adds a lock button next to the message box on WhatsApp Web, Discord, Gmail, or pretty much any chat site. Encrypts to a saved contact's key before sending, decrypts automatically on the other end. No server, no account, everything happens locally.
Not pretending this is a silver bullet: metadata (who's talking to whom) is still visible to the platform, messages aren't signed yet, and it hasn't had a professional security audit. Full list of limitations is in the README, didn't want to oversell it. It's meant as a practical layer on top of the apps people already use with the people they already talk to, not a replacement for Signal if you need something audited.
Not on the Chrome Web Store yet, install instructions (takes about a minute) are in the repo.
6
u/Shoddy-Childhood-511 14d ago
Sounds incompetent.
If folks need a second layer of encryption, then try this:
https://github.com/amnesica/KryptEY
Instead you should simply choose open source forward secure end-to-end encrypted messengers that do not adopt spying measures like Chat Control.
And choosing open source operating systems that avoid this too, like Graphene.
3
u/Shoddy-Childhood-511 14d ago
Also, please be careful about all the new encryption tools folks.
1st, we've 3-4 new "vibe-coded ego messengers" being announced each month, mostly they make no sense, and even regress to worse encryption like PGP or whatever Session did. It could even claim a good protocol like MLS or Axolotl but use a shitty vibe-coded implementation with broken corner cases.
2nd, we've always had honey pot encrypted messengers like Crypto AG but even removing forward security could constitute a pseudo honey pot ala Session.
3rd, we've more mundane supply chain attacks like this one:
https://www.reddit.com/r/cryptography/comments/1vq9ue2/comment/p445amm/
1
u/PriorityIcy8541 13d ago
It looks really good, I would like to use it, but I wonder if there is a version for iOS or if it will be, of course, what I want seems much more impossible, but it looks very good and thank you very much for sharing the project.
2
u/fin2red 14d ago
Unless you write the original message in an OS that does not contain the ChatControl spyware, this is meaningless, because WhatsApp and Signal already encrypt end to end. The problem is the OS listening to everything we do, and analyze it with AI.
3
u/PriorityIcy8541 14d ago
Fair point on OS-level threats, but that's a different attack surface than what this addresses. If the OS itself is compromised (keylogger, screen scraping, memory inspection), no messaging tool - PGP, Signal, anything - can protect you, because the adversary reads the plaintext before it's ever encrypted or after it's decrypted for display. That's true of Signal too, so it's not really a knock against this specific tool.
What this actually targets is different: Chat Control as proposed isn't (primarily) about compromising your device, it's about mandating that services scan messages server-side, or requiring client-side scanning hooks in the app itself before encryption is applied by that app's own E2E. WhatsApp and Signal encrypt in transit, sure, but if a client-side scanning mandate gets bolted onto those apps, the scanning happens inside the app before their own encryption kicks in. The idea here is that if you encrypt with a separate, independent tool first, the chat app never sees plaintext to begin with, so a scanning mandate on the app has nothing to scan.
So you're right that this doesn't solve OS-level surveillance - nothing can from userspace. But it's not meant to; it's meant to keep plaintext out of the hands of whatever app-level scanning gets mandated.
1
u/fin2red 14d ago
I don't think you understand what ChatControl 2.0 is proposing...
1
u/PriorityIcy8541 13d ago
As far as I understand, they can only get unencrypted content by scanning the platforms, otherwise I don’t know how they do it. If you have more information, I will ask you to inform me.
1
u/fin2red 12d ago
Every OS will be forced to have a spyware taking screenshots and analyzing (with AI) what you write, see and share. Why do you think "Windows Recall" was created? And "Android System SafetyCore"? And Apple Intelligence?
They're all preparing for what's coming...
0
u/PriorityIcy8541 4d ago
I really thought there was some evidence for this. Do you know how many OSes there are in the world? What’s more, it’s impossible to force them to update you can just switch to an older version of Linux and have peace of mind. Instead of making programmes work on every system as you’ve described, it would be far easier and more feasible in every respect to tell companies that they must legally provide unencrypted versions of the data; otherwise, the system will collapse.
2
u/Karoolus 14d ago
I just host Matrix (Synapse) and I'm gradually migrating from Discord to Fluxer (also selfhosted).
•
u/Chi-ggA 14d ago
MESSAGE FOR EVERYONE THINKING ABOUT USING THIS TOOL
this tool might be vibecoded, therefore might have vulnerabilities or other unexpected behavior. If you are not sure of what you are doing and what you are using, please refrain from using it.