Earlier quoted context omitted.
Does a password-protected zip file work?
Password-protected ZIP shared on dropbox, with password communicated via phone or SMS?
I've resorted to this before, but there must be a better way!
Show HN: Get encrypted data from people that don’t know how to encrypt
71–80 of 96 posts
Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#72I feel like you could knock out something similar to this using Vault, from hashicorp.
Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#73Earlier quoted context omitted.
The code is supposed to be self hosted, so if you give someone else this link it will be at https://yourdomain.com/.. .
But the person has to trust that you understand security well enough to prevent your server being compromised, which is not trivial. That is, it's much easier for an average developer to install this on their server than it is for them to understand the security well enough to guarantee that no one else is snooping on said server. Right?
The alternative, using local encryption software has its own risks. As a user, I'd much rather run some code in a browser sandbox than on my desktop, where it has potentially far more access (even if not run as root).
Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#74Hi, I'm one of the contributors of the project and we started this because of the need to deal with clients sending us information through insecure channels. We have been using it for a while at Whitesmith and it entered our team's workflow smoothly. Please feel free to ask any question and I will try to answer the best I can. Note: The project is open-source so you can self-host it. Contributions are welcome. Edit:…
This is a great idea but I often have this problem the other way around. I regularly want to send encrypted data to companies that don't know how to decrypt it. The number of firms that ask for sensitive info to be emailed across (or not much better - use dropbox) is crazy. Anyone got any good solutions to this?
Thats an use case that we also encounter often, we are still thinking about a solution (be it through Hawkpost or something else).
The other way around is definitely an harder problem, if we want to keep it simple for the non-tech savvy user.
Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#75I feel like you could knock out something similar to this using Vault, from hashicorp.
Vault is an awesome tool, but I'm not sure if it lets an "outsider" submit information in an easy way.
Some sort of integration with vault looks like a nice idea.
Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#76I built something like this in 2015 that didn't gain a ton of traction: https://privateforms.com
That looks cool. I think you might get better traction by selling it to businesses such as solicitors and brokers. You could white-label it with their branding and host it for them on a sub-domain - upload.low-tech-accountants.com.
Yeah, it's hard to find a market for this.
One unique proposition that Private Forms has is a form-builder so you can create custom forms rather than just contact forms.
Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#77I usually use a burn-after reading paste in 0bin.net for that, but I like the idea of sending an email. Altough it could be use for spam don't you think ?
That was one of our concerns, to receive information you can setup different "boxes" with an expiration date. Each box as an hard to guess url (such as https://hawkpost.co/box/19f1e7b9-f200-47ec-b5ff-918a9483a546), so only the people you shared it with, will know how to access it.
You can also set the maximum number of messages you wish to receive through that box.
I think these measures will help users avoid spam.
Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#78Earlier quoted context omitted.
Password-protected ZIP shared on dropbox, with password communicated via phone or SMS?
I've resorted to this before, but there must be a better way!
That is essentially corporate policy at my workplace. We use in-house file-sharing system, and I think the recommendation is to prefer 7z over vanilla zip. Typical channel for sending password is via SMS.
Its not elegant, but in the end I find it reasonably good compromise between security and practicality.
Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#79Python and PostGreSQL. Not exactly a tiny footprint for a tiny application.
C and flat files would've been a clearly better choice, I agree.
Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#80Earlier quoted context omitted.
I agree that it's confusing. To get the expected result, the user would have to use either $ gpg --clearsign (makes it obvious that the message is part of the resulting message.txt.asc file) or $ gpg --detachsign (which creates a .txt.sig file) or $ gpg -a --detachsign (which creates a .txt.asc file).
I use pgp daily with my email. I value it. It's good software. But let's be honest, SSL and pgp are the best we can do to secure comms from http to smtp today? Key/cert management is an epic fail from a usability pov. Is it done? Yes, because there is NO other choice. But pgp will never ever be anything but a niche application for the paranoid. SSL? I don't think anyone is going to argue it doesn't need to be scrappe…
PGP-People often talk about a "web of trust". Sometimes I wonder if any of them ever saw a web (like a spider web)? From the UX of popular PGP tools I can only assume no one did, because none of them can answer basic questions (and indeed, the data model doesn't support it, either), like "What's the relation of key XYZ [from an untrusted source, say keyserver] to my key?"