Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Get encrypted data from people that don’t know how to encrypt

github.com

Post reply on HN
Print view View original

51–60 of 96 posts

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#51

Post by cardigan »

dkopi wrote: post #31

The weakest link I can identify here is MITM attacks when you're sending the link. Imagine: Alice generates a link. Sends the link to Bob over an unencrypted/unauthenticated link. Mallory intercepts the link. Generates his own link and send that link to bob. Bob enters the confidential information on Mallory's link. Mallory sees the confidential information, and then sends it to Alice's original link. The only way to…

The channel does not need to be secure, only authenticated. So e.g, you could send them a Slack message then have them call you to confirm you just sent that link and not someone who hacked your Slack account.

It's fine to have someone snoop and see the link, as long as they can't change the link in transit.

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#52

Post by OJFord »

bugmen0t wrote: post #46
OJFord wrote: post #41

> or use the official server (that is running an exact copy of this repo) Is there any project that attempts to prove claims like this? I don't know what that would look like; it would probably just move the point of trust, just interested to see it if such a thing exists.

What you are looking for is called "remote attestation". (In open source software the solution to this problem is "well, you could always just host your own instance" ;))

    > In open source software the solution to this problem is
    > "well, you could always just host your own instance"
That doesn't always work though - end-users can't trust you more because you host it instead of using the version hosted by the OSS team for whom it's the main focus. (Arguably they should actually trust the latter more!)

Consider Keybase for example. If someone builds a service on top of Keybase, their end-users can't trust them with their private keys* if they host it themselves instead of using upstream hosting.

*I know this is not required in order to use Keybase - I use it with gnupg and keep my keys local. It's the easiest example of needing to trust Keybase, though.

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#54

Post by delinka »

teaearlgraycold wrote: post #53

I'm curious, when is this level of security necessary for civilians?

Always. All the time. Every day.

Lest your unencrypted messages one day be used in a fishing expedition to facilitate oppression at the hands of the current political regime.

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#55

Post by dethos »

Hi, I'm one of the contributors of the project and we started this because of the need to deal with clients sending us information through insecure channels. We have been using it for a while at Whitesmith and it entered our team's workflow smoothly.

Please feel free to ask any question and I will try to answer the best I can.

Note: The project is open-source so you can self-host it. Contributions are welcome.

Edit: to fix typo

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#57

Post by X86BSD »

Tepix wrote: post #23
dvh wrote: post #8

$ echo "Hello world" > message.txt gpg --sign message.txt $ gpg --verify message.txt.gpg gpg: Signature made Wed 19th october 2016, 12:19:19 CEST using RSA key ID D9AE6E9E gpg: Good signature from "John Smith " $ echo "evil" > message.txt $ gpg --verify message.txt.gpg gpg: Signature made Wed 19th october 2016, 12:19:19 CEST using RSA key ID D9AE6E9E gpg: Good signature from "John Smith "

I agree that it's confusing. To get the expected result, the user would have to use either $ gpg --clearsign (makes it obvious that the message is part of the resulting message.txt.asc file) or $ gpg --detachsign (which creates a .txt.sig file) or $ gpg -a --detachsign (which creates a .txt.asc file).

I use pgp daily with my email. I value it. It's good software.

But let's be honest, SSL and pgp are the best we can do to secure comms from http to smtp today?

Key/cert management is an epic fail from a usability pov. Is it done? Yes, because there is NO other choice. But pgp will never ever be anything but a niche application for the paranoid.

SSL? I don't think anyone is going to argue it doesn't need to be scrapped and rewritten from scratch or replaced entirely.

Encryption must be transparent for it to be ubiquitous. We're not there yet. I know this is a hard problem to solve but someone eventually will.

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#58

Post by jsingleton »

dethos wrote: post #55

Hi, I'm one of the contributors of the project and we started this because of the need to deal with clients sending us information through insecure channels. We have been using it for a while at Whitesmith and it entered our team's workflow smoothly. Please feel free to ask any question and I will try to answer the best I can. Note: The project is open-source so you can self-host it. Contributions are welcome. Edit:…

This is a great idea but I often have this problem the other way around.

I regularly want to send encrypted data to companies that don't know how to decrypt it. The number of firms that ask for sensitive info to be emailed across (or not much better - use dropbox) is crazy.

Anyone got any good solutions to this?

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#59

Post by SamBam »

Tepix wrote: post #27
leni536 wrote: post #5

js crypto's trust problem isn't solved yet. One has to trust hawkpost.co to not serve compromised client side js.

The code is supposed to be self hosted, so if you give someone else this link it will be at https://yourdomain.com/.. .

But the person has to trust that you understand security well enough to prevent your server being compromised, which is not trivial.

That is, it's much easier for an average developer to install this on their server than it is for them to understand the security well enough to guarantee that no one else is snooping on said server. Right?

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#60

Post by burkaman »

jsingleton wrote: post #58
dethos wrote: post #55

Hi, I'm one of the contributors of the project and we started this because of the need to deal with clients sending us information through insecure channels. We have been using it for a while at Whitesmith and it entered our team's workflow smoothly. Please feel free to ask any question and I will try to answer the best I can. Note: The project is open-source so you can self-host it. Contributions are welcome. Edit:…

This is a great idea but I often have this problem the other way around. I regularly want to send encrypted data to companies that don't know how to decrypt it. The number of firms that ask for sensitive info to be emailed across (or not much better - use dropbox) is crazy. Anyone got any good solutions to this?

Does a password-protected zip file work?
Post reply on HN