Live data from Hacker News

Show HN: Portable Secret – How I store my secrets and communicate privately

mprimi.github.io

141–150 of 385 posts

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#141

Earlier quoted context omitted.

That's a good point, I wasn't very specific about this (trying to keep it concise). To be specific here, the con is that there isn't what the industry calls Cryptographic Agility. https://en.wikipedia.org/wiki/Cryptographic_agility . It is not true this con applies to all cryptography (e.g. look at TLS). It has more to do with how cryptography is configured, parameters are negotiated and keys are managed, than with p…

Contrary to what Wikipedia says, I don't think agility is considered a desirable property by most cryptographers: you still have the "attacker stored encrypted material" problem, and now you have to worry about downgrade attacks. Many of the most interesting/effective attacks on SSL/TLS have been downgrade attacks that stem directly from the protocol's (historically) agile design.

I disagree with your speculation as to what most cryptographers think. Are you basing this on any data you can share?

Please also see the other thread about how this secret storage system is different from a communication protocol. Namely, communication protocols have a two step attack: first attacker must MITM and record ciphertext, then they must wait. This secret storage method is different (one step attack): attacker looks for ciphertexts on either targeted or non-targeted basis that use old standard. Persistence, caches and publication of these secrets has been done for them.

It's a good point about downgrade attacks. They have been brutal for TLS to deal with.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#142
post #75

Earlier quoted context omitted.

2 sides of obsolescence: - Too old, no software can decrypt it: not worried about this. These are NIST-standard algorithms, there built-in in most programming languages, they'll be around for a while - Too old, trivial to crack: this is a bit more concerning to me. It's possible that some entities around the world can already crack this encryption in minutes/hours days Regarding the second, I'm already working on an…

Well, your cipher text could decrypt to a non-published URL that has some cipher text which decrypts to another non-published URL (as many layers of indirection that you need), with the final non-published URL containing the actual cipher text you wanted to decrypt. You can check server logs to see if those URLs are ever hit. And if you ever need to, you can abandon the original link after changing what those non-pub…

Genius.

As the old adage says 'any problem can be resolved by adding one more layer of indirection'.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#143

> Crack me if you can This reminds me of LifeLock CEO's Todd Davis public challenge [1] when he revealed his Social Security number prominently on his site and billboards with overconfidence that his identity cannot be stolen but, unfortunately, he's been a victim of identity theft at least 13 times. 1. https://www.wired.com/2010/05/lifelock-identity-theft/

I'm not that confident in my tool. That said, I ask myself every day if having my public identity associated to my project, website, etc. Was a good idea. It certainly helped with jobs in the past, but it's scary to hear stories of devs impersonated by others.

> Portable Secret is not a product and it is barely a project

You are such a humble person as you clearly stated why this thing was built. I am, in no way, claiming that you are too confident in your work, despite it being a cool project that can be used by privacy-aware techies. Your expression Crack me if you can just triggered LifeLock's story from the deepest part of my mind.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#144
post #137

So, a self-extracting password-protected archive made portable via web browser APIs?

Yes, that's one way to put it.

p.s. don't use password protected archives: https://security.stackexchange.com/questions/35818/are-passw...

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#145

Earlier quoted context omitted.

This is a smart use of crypto too. The verifiable and public parts of crypto here are a benefit and not a con.

If someone tells you: This secret image contains a Bitcoin wallet recovery key If you can crack the secret, the funds are yours! You can check the status of the wallet here: https://www.blockchain.com/explorer/addresses/btc/1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa Now here's the secret: 0002146273a3774b3828effff3382000someGarbageSecretThatsActuallyIs{https://youtu.be/eBGIQ7ZuuiU}EnctyptedUsingARandom4096BitStringAsPassword…

They didn't do it here, but you can sign a message that includes a checksum of the application with the private key of that address. The signed message can be proved using just the public key that they have linked to.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#146
I'm a security professional and this looks like a great tool for OP's use case, especially with strong passwords and great password hints. I think your secrets are well stored - unless your mother stores the password to these files insecurely, a problem that is not new to this solution.

This also applies to most if not all challenges mentioned by other posters. Take phishing for example, at the moment all methods to exchange information of interest that are at the same time user friendly are relatively easy to phish, be it email, discord or WhatsApp.

I still wouldn't store "top-level secrets" in here and upload this to a cloud drive and forget about it. Someone smarter than me could spot a bug in your code (or the API's code) in a year and that renders your solution vulnerable. A browser's implementation of the API could be flawed in a particular version. Someone adversarial to me could bribe a number of people to get answers to 10 different password hints. There are some other scenarios that are implementation specific, I'm sure.

All in all, great tool. I hope you find more users if you are looking for more! :)

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#147

I wrote a similar software for the same reasons. One goal for mine was that the generated output is small enough to quickly verify that the code sent to the browser is the one you expect. Total code size is under 100 lines. https://github.com/dividuum/html-vault

Neat! I knew I could not possibly be the only one that had this idea.

Linked your project.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#148

One possible attack is someone changing either the encrypt or decrypt source code, either via Github (if they get access to the OP account) to log keystrokes. Or if someone has hosted it themselves then hack that hosting provider. Or they could do something like this: https://www.theverge.com/2018/4/24/17275982/myetherwallet-ha... Phishing is another potential one. Browser extensions, or supply chain attack on packag…

I agree phishing is the most scary vulnerability for this. In practice, when exchanging emails with my mom, I'm not concerned about it. A sophisticated attacker has many easier ways to get into my stuff than creating a fake PortableSecret. (more detail in a different comment: https://news.ycombinator.com/item?id=34084887 )

If you get 100,000 people using your site to exchange secrets, the bounty got a lot bigger. For phishing you and your mum might be immune, but one of the 100,000 might get phished. For taking over the account (which is now more juicy, could be some bitcoins there) then everyone would be vulnerable who doesn't check the source code each time they load the page.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#149
post #50
post #10

Earlier quoted context omitted.

Do you mind expanding? Specifically, what do you mean by de-golfed (I'm only vaguely aware of what 'kids' mean by code-golf these days, and I'm kinda lost on de-golfing). What would you like to fit into a QR code? A PortableSecret (e.g. html file)?

Like sibling comment elucidates, code-golfing is just using tricks to get the size of a program down without impacting its functionality. This could be as simple as using single-character variable names or something more complicated like including a decompressor that expands some packed code before execution. If you got the decryption code plus the payload small enough you could theoretically put the whole thing into…

> If you got the decryption code plus the payload small enough you could theoretically put the whole thing into a data URL (a URL that doesn't link to a remote resource, but contains all the data needed to display a web page)

This is how the 'secret creator' page works :-)

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#150
post #19

Nice idea but it seems not resilient against a rainbow attack.

Yeah, plus they even give hints to the password complexity, so unless that is a red herring, this should be pretty simple to crack, if not CPU consuming. Just combine https://github.com/mejdoubi/rainbow-table and their algorithm together. It would probably take me a few hours to put together, but for someone who is very familiar with cryptography, it would be minimal work.

I think the author of that repo misunderstands what a rainbow table is. I only quickly skimmed the code, but it doesn't seem to do anything related to rainbow tables.

On top of that, a rainbow table (if that is what you're looking to use) would not help here. The password is both very long and salted.

Post reply on HN