Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Get encrypted data from people that don’t know how to encrypt

github.com

Post reply on HN
Print view View original

21–30 of 96 posts

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#21

Post by witty_username »

edejong wrote: post #7
leni536 wrote: post #5

js crypto's trust problem isn't solved yet. One has to trust hawkpost.co to not serve compromised client side js.

Yes, there is no JS source signing in the browser yet. Then again, do you check the (compiled) code that is delivered to you via source repositories with which you sign/encrypt your GPG messages? How many people read the OpenSSL source code? How trustworthy are the signatures on Debian packages?

At least with the Debian system it might be possible to get some information about the attackers.

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#22

Post by smnscu »

StavrosK wrote: post #13
martin-adams wrote: post #11

Earlier quoted context omitted.

I don't think I'm smart enough to infer what you're trying to say. Care to elaborate?

He's saying that, even though he changed the message, the signature still validated. He doesn't realize that the resulting GPG file contains the message, so it's verifying it against its own, stored copy.

This reminds me of Craig Wright's blog post where he "proved" he is Satoshi, albeit that one was deliberately misleading.

Off-topic, I think in addressing people with 'they' is more polite when the gender is ambiguous, despite the stats being in your favour.

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#23

Post by Tepix »

dvh wrote: post #8

$ echo "Hello world" > message.txt gpg --sign message.txt $ gpg --verify message.txt.gpg gpg: Signature made Wed 19th october 2016, 12:19:19 CEST using RSA key ID D9AE6E9E gpg: Good signature from "John Smith " $ echo "evil" > message.txt $ gpg --verify message.txt.gpg gpg: Signature made Wed 19th october 2016, 12:19:19 CEST using RSA key ID D9AE6E9E gpg: Good signature from "John Smith "

I agree that it's confusing.

To get the expected result, the user would have to use either

$ gpg --clearsign

(makes it obvious that the message is part of the resulting message.txt.asc file) or

$ gpg --detachsign

(which creates a .txt.sig file) or

$ gpg -a --detachsign

(which creates a .txt.asc file).

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#24

Post by eli »

StavrosK wrote: post #14
haywirez wrote: post #10

Earlier quoted context omitted.

What about SRI? "Subresource Integrity (SRI) is a security feature that enables browsers to verify that files they fetch (for example, from a CDN) are delivered without unexpected manipulation. It works by allowing you to provide a cryptographic hash that a fetched file must match." [0] https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

SRI is a great way to make an html page that loads all the js from a server, tell the user to store that locally, and be sure that the loaded js files will never change (otherwise they won't get loaded).

Why not just store all the js locally too?

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#25

Post by Freak_NL »

StavrosK wrote: post #13
martin-adams wrote: post #11

Earlier quoted context omitted.

I don't think I'm smart enough to infer what you're trying to say. Care to elaborate?

He's saying that, even though he changed the message, the signature still validated. He doesn't realize that the resulting GPG file contains the message, so it's verifying it against its own, stored copy.

I think dvh is confused about detached signatures and signatures that contain their payload.

For detached signatures:

    gpg --verify message.sig message
For signed files:

    gpg --verify message.sig
    gpg --output message --decrypt message.sig
It's all documented¹.

Dvh: what are you getting at?

1: https://www.gnupg.org/gph/en/manual/x135.html

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#26

Post by Tepix »

A contact form that is hosted on a HTTPS protected website already does the job. The main difference is that it is usually (but not necessarily) only transmitted encrypted, not stored in encrypted form.

Here's a tip: If you generate an email from the content of the contact form anyway, why not make it an encrypted mail? It's rather easy if you use mailx from the heirloom-mailx package that is part of Debian, Ubuntu and probably a lot of other Linux/BSD/UNIX distributions. Here are the required steps:

In ~/.mailrc:

   set smime-ca-dir=/home/user/smime

   set smime-ca-file=/home/user/smime/1_Intermediate.crt

   set smime-encrypt-user@example.com=/home/user/smime/2_user@example.com.crt
Then every mail sent to user@example.com using "mailx" will be encrypted using S/MIME.

Got no local MTA installed? You can make mailx send the mail directly via SMTP:

$ echo mail body | mailx -s "subject" -S smtp=mail.example.com:25 -S smtp-use-starttls user@example.com

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#27

Post by Tepix »

leni536 wrote: post #5

js crypto's trust problem isn't solved yet. One has to trust hawkpost.co to not serve compromised client side js.

The code is supposed to be self hosted, so if you give someone else this link it will be at https://yourdomain.com/...

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#28

Post by Tepix »

eli wrote: post #24
StavrosK wrote: post #14

Earlier quoted context omitted.

SRI is a great way to make an html page that loads all the js from a server, tell the user to store that locally, and be sure that the loaded js files will never change (otherwise they won't get loaded).

Why not just store all the js locally too?

It's slower but also provides better privacy.

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#29

Post by nspassov »

diasp wrote: post #20

Similar project https://encrypt.to

This is handy but I don't find it particularly pleasant that my email address would be written in plain text on the web page. A service like keybase.io helps with the key discovery and encryption part while not revealing my email address in such a way.

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#30

Post by gravypod »

Tepix wrote: post #26

A contact form that is hosted on a HTTPS protected website already does the job. The main difference is that it is usually (but not necessarily) only transmitted encrypted, not stored in encrypted form. Here's a tip: If you generate an email from the content of the contact form anyway, why not make it an encrypted mail? It's rather easy if you use mailx from the heirloom-mailx package that is part of Debian, Ubuntu a…

That's still vulnerable to coldboot style attacks. If the data is never unencrypted unless you're readining it that's technically safer. But yes you are right that would work as well.
Post reply on HN