Offline Decryption Messenger: Concept Proposal and Request for Constructive Feedback

Hello everybody, Some activist friends and I have been discussing a problematic gap in the current landscape of secure messaging tools: the lack of user‑friendly communication systems that remain secure even in the presence of spyware. Standard E2E encrypted messengers such as Signal or Element become ineffective once the communication device itself is compromised. If spyware is able to read the screen, capture keystrokes, or access memory, E2E-encryption no longer protects the message content. For this reason, we “developed” a concept we call Offline Decryption Messaging. The core idea is that each communication participant uses two distinct devices: an online device with normal internet access, and an air‑gapped device that is physically incapable of network communication. All sensitive operations, like writing, decrypting, and displaying clear messages, take place exclusively on the offline device. The online device is used only to transmit encrypted data via standard messaging services. In practice, the user writes the clear message on the offline device, where it is encrypted and immediately deleted. The resulting ciphertext is then transferred to the online device (for example via a QR code) and sent over an existing messenger. The online device never has access to either the clear message or the cryptographic keys. On the receiving side, the process is reversed: the encrypted message is transferred to the recipient’s offline device and decrypted there. Under this model, even if all participating online devices are fully compromised by spyware, no sensitive information can be exfiltrated. While spyware on the online device may observe or manipulate transmitted ciphertext, it never encounters the decrypted message. At the same time, spyware on the offline device has no communication channel through which it could leak information to an attacker. The goal of our project, currently called HelioSphere, is to explore whether this security model can be implemented in a way that is not only robust against modern spyware, but also practical enough for real‑world activist use. We would love feedback from this community, especially regarding: potential weaknesses in this threat model, existing tools or projects we may have overlooked, usability challenges we should expect, cryptographic and operational improvements. The concept is further introduced in the document accessible via the link above. The link also contains information about our first functional prototype. Thanks for reading! We’re looking forward to your thoughts. submitted by /u/calzone_rivoluzione [link] [comments]Technical Information Security Content & DiscussionRead More