Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Portable Secret – How I store my secrets and communicate privately

mprimi.github.io

Post reply on HN
Print view View original

191–200 of 385 posts

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#191

Post by aidenn0 »

gregwebs wrote: post #14

This is password protected, so then an attacker must crack the password. The author exchanges the password over a phone call, which requires the password to be relatively weak, meaning the password is probably crackable. Exchanging the password via a second channel that the other user can copy and paste a more difficult password from to decyrpt the document might be more secure. The password may be more exposed, but…

I took a list of "2000 most common English words" used metaphopne to eliminate words that sound similar to other words on the list, and reduced it to a power of 2. I ended up with 512 words that are probably in all fluent English speakers vocabularies so can easily be read over the phone. It's 9 bits per word, so 7 words is 63 bits of entropy which means it's (on average) 2^62 times more computational work to brute-force than it is do decrypt. That's a pretty good margin to have.

If they were using a stupid hash like, say, MD5 the time to brute force that would still be months on a GPU, but they are using PBKDF2/SHA-1 which is significantly more work.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#192

Post by ithrow »

distcs wrote: post #178
httpz wrote: post #131

If anyone is actually going to use this for their top secrets, I can find two things to be aware of. * When you decrypt then close the tab and open the tab again via the recently closed tab, the password is still there. * Browser extensions could read the contents of the webpage. So if anyone is going to use this, they should do it in a "clean" incognito browser without any extensions.

For me the biggest problem with a setup like this is complete loss of access to my secrets. The crypto functions supported by browsers may change in future. A cipher algorithm used to encrypt my secrets may get deprecated and removed by the browser in future. Then I will be left with a bunch of HTML files with data that the browsers cannot decrypt anymore. GPG or vim -x might be much better choices for secrets that n…

Just download an older version of the browser?

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#193

Post by EVa5I7bHFq9mnYK »

"long sequence of words that are trivial for me to remember"

I also thought so until I suddenly forgot a master password I have been using for several years. Luckily, I was able to recollect it after several days. Then, I forgot it again.

Age, decease and head trauma can happen.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#194

Post by ksbrooksjr »

It looks like the plaintext is being padded so that its length is a multiple of the block size [1]. I can't find any resources that say you need to pad a message before encrypting it with AES-GCM though. The official examples from MDN [2][3] don't pad the message before encrypting. The source code links to a wikipedia article that states that padding isn't necessary for counter mode, which the code is using (GCM is Galois Counter Mode)[4].

[1] https://github.com/mprimi/portable-secret/blob/6efdb4618216f...

[2] https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypt...

[3] https://github.com/mdn/dom-examples/blob/main/web-crypto/enc...

[4] https://en.wikipedia.org/wiki/Padding_(cryptography)#PKCS#5_....

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#195

Post by mprime1 »

distcs wrote: post #178
httpz wrote: post #131

If anyone is actually going to use this for their top secrets, I can find two things to be aware of. * When you decrypt then close the tab and open the tab again via the recently closed tab, the password is still there. * Browser extensions could read the contents of the webpage. So if anyone is going to use this, they should do it in a "clean" incognito browser without any extensions.

For me the biggest problem with a setup like this is complete loss of access to my secrets. The crypto functions supported by browsers may change in future. A cipher algorithm used to encrypt my secrets may get deprecated and removed by the browser in future. Then I will be left with a bunch of HTML files with data that the browsers cannot decrypt anymore. GPG or vim -x might be much better choices for secrets that n…

> For me the biggest problem with a setup like this is complete loss of access to my secrets. The crypto functions supported by browsers may change in future. A cipher algorithm used to encrypt my secrets may get deprecated and removed by the browser in future

These are NIST-recommended algorithms, they'll be around for a while...

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#196

Post by delaaxe »

distcs wrote: post #180
blintz wrote: post #126

Cool project! This stuff is all possible thanks to the SubtleCrypto API ( https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypt... ), which became widespread in browsers in the last ~5 years. It's so great we don't have to use weird libraries (some with pretty gnarly side channel leakage) to do cryptography anymore. It wouldn't be that crazy for the browser to do the encryption part for me, right? Like, what i…

What level of confidence is there that all this API will work exactly as it works now after 30 years? I am concerned that they might at the very least deprecate and remove the ciphers used to encrypt my data in portable secret. Worse what if they remove support for the API? Then I am going to have HTML files with data I cannot decrypt anymore, right?

If you’re worried about “30 years from now” you might as well store the decryption software alongside the message

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#197

Post by leokennis »

xvinci wrote: post #176

Can anyone enlighten me on Some secrets don’t belong in your password manager. Things like backup private keys, 2FS recovery keys, wallet keys, safe combinations, treasure maps, etc. I am a 1password user and am aware that I am trusting a 3rd party with most of my life basically (minus the 2FA, my phone), but that's the way I decided for convenience. But why would I keep passwords in there but not PKs, wallet keys et…

Honestly that statement sounds like BS to me. Also, this person is trusting his life to a third party as well: the browser vendors’ cryptography implementation.

I think for an average person, the biggest factor is not the strength of the security. You’re already better than 99% of people if you use different passwords per site and store them behind a password. No hacker will spend weeks cracking your passwords if he can get the passwords of those other 99% for free.

So I’d say, pick the solution most convenient for you that is least likely to break over time. And an established name like 1Password sounds great for that.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#198

Post by mprime1 »

hamburglar wrote: post #190
distcs wrote: post #178

Earlier quoted context omitted.

For me the biggest problem with a setup like this is complete loss of access to my secrets. The crypto functions supported by browsers may change in future. A cipher algorithm used to encrypt my secrets may get deprecated and removed by the browser in future. Then I will be left with a bunch of HTML files with data that the browsers cannot decrypt anymore. GPG or vim -x might be much better choices for secrets that n…

A neat feature of this would be to have the source of the html include instructions for decrypting the data outside the browser using command line tools for just this scenario.

Looking at the HTML/JS code does tell you how to implement decryption in a different language.

That's because it only uses NIST recommended encryption, which is baked in or available in most languages.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#199

Post by mprime1 »

EVa5I7bHFq9mnYK wrote: post #193

"long sequence of words that are trivial for me to remember" I also thought so until I suddenly forgot a master password I have been using for several years. Luckily, I was able to recollect it after several days. Then, I forgot it again. Age, decease and head trauma can happen.

By "long sequence of words that are trivial for me to remember" I meant concatenation of secret questions, like in the bounty example: https://mprimi.github.io/portable-secret/examples/bounty.htm...

Unless I hit my head really hard, there's zero chance I will forget this passphrase.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#200

Post by mprime1 »

delaaxe wrote: post #196
distcs wrote: post #180

Earlier quoted context omitted.

What level of confidence is there that all this API will work exactly as it works now after 30 years? I am concerned that they might at the very least deprecate and remove the ciphers used to encrypt my data in portable secret. Worse what if they remove support for the API? Then I am going to have HTML files with data I cannot decrypt anymore, right?

If you’re worried about “30 years from now” you might as well store the decryption software alongside the message

And there are ciphers who have lived much longer than 30 years...

https://en.wikipedia.org/wiki/Caesar_cipher

Post reply on HN