dsig
GPG message signing for Vencord / Vesktop. Authorship attestation for every message.
Signs Discord messages with your GPG key. Verifies authorship, prevents impersonation. Compact and invisible footer formats.
Tests
142
Test lines
1,817
Source lines
3,782
Footer size
113 chars
Problem
Discord has no native message signing. Anyone can impersonate anyone by copying their display name and avatar. There is no cryptographic way to verify that a message was actually written by the claimed author.
Threat model
Key decisions
Invisible encoding
Signatures are encoded as Unicode invisible characters (zero-width spaces, non-joiners) appended to the message, tested against Discord's actual client behavior.
Content canonicalization
NFC normalization, CRLF to LF conversion, whitespace collapsing. Prevents trivial bypasses via Unicode normalization or line-ending differences.
gpg-agent isolation
Verification uses a throwaway GNUPGHOME to prevent verification from accessing the signing key. Each verify operation runs in isolation.
Desktop-only by design
Web browsers cannot access gpg-agent. The plugin is desktop-only (Vencord/Vesktop) because the security model requires local key access.
Tradeoffs
- Desktop-only (web cannot access gpg-agent)
- Requires GPG key pair setup
- Invisible encoding may be stripped by some clients
- Key compromise is out of scope (standard GPG limitation)