I built something like this in 2015 that didn't gain a ton of traction: https://privateforms.com
Show HN: Get encrypted data from people that don’t know how to encrypt
61–70 of 96 posts
Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#62I'm curious, when is this level of security necessary for civilians?
In my opinion when it is possible to secure the data. People often need to share secrets such as passwords or keys to access some service or server. When compromised depending on the key it can bring some serious consequences (example: http://www.theregister.co.uk/2015/01/06/dev_blunder_shows_gi...)
Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#63Earlier quoted context omitted.
That's still vulnerable to coldboot style attacks. If the data is never unencrypted unless you're readining it that's technically safer. But yes you are right that would work as well.
Hawkpost (the project introduced here) is also vulnerable to a coldboot attack - if the server that sends the page with the javascript is compromised, all bets are off.
You need to trust the server at some point. Assuming you do then it doesn't matter if the at-rest encryption is done in the browser or on the server.
I'd be happy with HTTPS upload and PGP encryption before writing to disk or forwarding. I think the biggest risk of a secure upload server is a vulnerability exposing a disk full of secure content in the future.
Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#64Earlier quoted context omitted.
>But if you already have a secure channel - what's the use case? You can use Whatsapp, or some other E2E-encrypted service that is easy to use, and then transmit the sensitive data over encrypted email, which is more convenient for long-form text.
Personally, I find the Whatsapp web version pretty convenient for long-form text
For text yes, but not so much for sending attachments like documents or other arbitrary files.
Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#65Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#66I built something like this in 2015 that didn't gain a ton of traction: https://privateforms.com
That looks cool. I think you might get better traction by selling it to businesses such as solicitors and brokers. You could white-label it with their branding and host it for them on a sub-domain - upload.low-tech-accountants.com.
Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#67Looks great, this is something that is missing from Keybase (specifically, the email sending part).
Hi, one of Hawkpost contributors here.
We actually use Keybase as well, and that was one of our inspirations for the exact same reasons! Since one of our main use-cases was to receive secure data from non-tech-savvy people we wanted to remove as much friction as possible, and that included sending the encrypted blob. We're actually thinking of ways of integrating Hawkpost with Keybase.io, namely fetching/verifying keys (as we already do with keyservers).
Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#68Hi, I'm one of the contributors of the project and we started this because of the need to deal with clients sending us information through insecure channels. We have been using it for a while at Whitesmith and it entered our team's workflow smoothly. Please feel free to ask any question and I will try to answer the best I can. Note: The project is open-source so you can self-host it. Contributions are welcome. Edit:…
This is a great idea but I often have this problem the other way around. I regularly want to send encrypted data to companies that don't know how to decrypt it. The number of firms that ask for sensitive info to be emailed across (or not much better - use dropbox) is crazy. Anyone got any good solutions to this?
Same thing here. This + HawkPost would be interesting.
Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#69Earlier quoted context omitted.
This is a great idea but I often have this problem the other way around. I regularly want to send encrypted data to companies that don't know how to decrypt it. The number of firms that ask for sensitive info to be emailed across (or not much better - use dropbox) is crazy. Anyone got any good solutions to this?
Does a password-protected zip file work?
Password-protected ZIP shared on dropbox, with password communicated via phone or SMS?
Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#70Earlier quoted context omitted.
This is a great idea but I often have this problem the other way around. I regularly want to send encrypted data to companies that don't know how to decrypt it. The number of firms that ask for sensitive info to be emailed across (or not much better - use dropbox) is crazy. Anyone got any good solutions to this?
Does a password-protected zip file work?
This is the most basic step, but even this is non-trivial. There are multiple ways of password protecting a zip, ZipCrypto is insecure and not all software supports AES-256. Self-extractors will get stopped by AV and sometimes even password protected zips (as the AV can't read them).
You then have to communicate the password out-of-band, as emailing it would defeat the purpose. It may be hard to read over the phone and you have to trust it was not written down and the file is not then stored/forwarded unencrypted. Explaining the process to someone non-technical may be challenging.
Symmetric crypto is a mess, asymmetric would be great if secure key exchange could be easy. If only the software was as ubiquitous as zip handling is in the OS.