Live data from Hacker News

Show HN: Get encrypted data from people that don’t know how to encrypt

github.com

91–96 of 96 posts

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#91
This is actually an extremely common kind of enterprise security product --- though none of them do the Javascript/PGP dance.

Enterprise security teams know, of course, that email is insecure, and that partners and clients want to send sensitive stuff via email. So they buy these products and stand them up, and then instruct their partners to follow a link to upload their documents or sensitive emails, rather than using their email client.

The box itself forwards the email to user inside the enterprise.

I think there's something useful here, but, like 'Tepix said: a simple form on an HTTPS site is already doing 99.999% of the useful work here (that's all the expensive enterprise products do, too).

A direction you can take this to be even more useful is to strip and sanitize attachments, as a way of quarantining malicious email.

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#92
post #90
post #89

Earlier quoted context omitted.

Subresource integrity still requires you to trust the server sending the hashes.

Ok so publish the hashes on a blockchain and have the client verify them there

Not a bad idea, but this isn't a thing browsers currently do, and the average person can't do that with ease. Especially considering this web app is aimed at non-tech savvy individuals.

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#93
post #92
post #90

Earlier quoted context omitted.

Ok so publish the hashes on a blockchain and have the client verify them there

Not a bad idea, but this isn't a thing browsers currently do, and the average person can't do that with ease. Especially considering this web app is aimed at non-tech savvy individuals.

Make the whole page hosted on IPFS, and make your DNS point to it. Then you just need to trust the DNS. So use namecoin.

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#95
post #83

Earlier quoted context omitted.

This is the most basic step, but even this is non-trivial. There are multiple ways of password protecting a zip, ZipCrypto is insecure and not all software supports AES-256. Self-extractors will get stopped by AV and sometimes even password protected zips (as the AV can't read them). You then have to communicate the password out-of-band, as emailing it would defeat the purpose. It may be hard to read over the phone a…

Microsoft solves this with RMS for Individuals: https://portal.aadrm.com/ (also called the RMS Sharing App, now getting rebranded to Azure Information Protection). The recipient's identity is the key to opening the content - no need to communicate anything out-of-band. Depending on the file format chosen, you get DRM features limiting granular actions on the file beyond view/edit. To open the protected files, your re…

This actually looks like it might be the least-worst solution, thanks!

This is the product page: https://www.microsoft.com/en-us/cloud-platform/azure-informa...

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#96

Earlier quoted context omitted.

This is a great idea but I often have this problem the other way around. I regularly want to send encrypted data to companies that don't know how to decrypt it. The number of firms that ask for sensitive info to be emailed across (or not much better - use dropbox) is crazy. Anyone got any good solutions to this?

Protonmail has the ability to send a password-encrypted message to anyone. They just get a link and you have to give them the password through other means. All encryption is handled client-side in js (they recently became maintainers of that library as well, iirc). The message can also expire after x days and the recipient can reply. I'm not sure if I like how they're basically inventing their own encryption scheme f…

Interesting. The feature is buried at the bottom of this page: https://protonmail.com/security-details

Could be quite useful. The biggest problem is the recipient not having a compatible decompresser that can decrypt the archive.

Post reply on HN