Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Get encrypted data from people that don’t know how to encrypt

github.com

Post reply on HN
Print view View original

81–90 of 96 posts

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#81

Post by dom0 »

X86BSD wrote: post #57
Tepix wrote: post #23

Earlier quoted context omitted.

I agree that it's confusing. To get the expected result, the user would have to use either $ gpg --clearsign (makes it obvious that the message is part of the resulting message.txt.asc file) or $ gpg --detachsign (which creates a .txt.sig file) or $ gpg -a --detachsign (which creates a .txt.asc file).

I use pgp daily with my email. I value it. It's good software. But let's be honest, SSL and pgp are the best we can do to secure comms from http to smtp today? Key/cert management is an epic fail from a usability pov. Is it done? Yes, because there is NO other choice. But pgp will never ever be anything but a niche application for the paranoid. SSL? I don't think anyone is going to argue it doesn't need to be scrappe…

GPG - without trying to devalue the good work put into it - is also one of the tools with one of the worst command line interfaces I know; by default it prints a confusing amount of wholly irrelevant, debug level information, to the point where it's hard to see where the actual output is (eg. --verify success). A slew of different key identificators (short ID, long ID, fpr, name, email, ...) that are all mixed in a bunch of places and only sometimes interchangeable etc. etc.

The UX is just horrendous, and none of the GUI tools improve on that.

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#83

Post by srpeck »

jsingleton wrote: post #70
burkaman wrote: post #60

Earlier quoted context omitted.

Does a password-protected zip file work?

This is the most basic step, but even this is non-trivial. There are multiple ways of password protecting a zip, ZipCrypto is insecure and not all software supports AES-256. Self-extractors will get stopped by AV and sometimes even password protected zips (as the AV can't read them). You then have to communicate the password out-of-band, as emailing it would defeat the purpose. It may be hard to read over the phone a…

Microsoft solves this with RMS for Individuals: https://portal.aadrm.com/ (also called the RMS Sharing App, now getting rebranded to Azure Information Protection).

The recipient's identity is the key to opening the content - no need to communicate anything out-of-band. Depending on the file format chosen, you get DRM features limiting granular actions on the file beyond view/edit.

To open the protected files, your recipients will have to download/install the (free) app from Microsoft. This is generally pretty painless.

Definitely worth checking out, especially good for consultants' workflows.

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#84

Post by matt4077 »

jsingleton wrote: post #58
dethos wrote: post #55

Hi, I'm one of the contributors of the project and we started this because of the need to deal with clients sending us information through insecure channels. We have been using it for a while at Whitesmith and it entered our team's workflow smoothly. Please feel free to ask any question and I will try to answer the best I can. Note: The project is open-source so you can self-host it. Contributions are welcome. Edit:…

This is a great idea but I often have this problem the other way around. I regularly want to send encrypted data to companies that don't know how to decrypt it. The number of firms that ask for sensitive info to be emailed across (or not much better - use dropbox) is crazy. Anyone got any good solutions to this?

Protonmail has the ability to send a password-encrypted message to anyone. They just get a link and you have to give them the password through other means.

All encryption is handled client-side in js (they recently became maintainers of that library as well, iirc). The message can also expire after x days and the recipient can reply.

I'm not sure if I like how they're basically inventing their own encryption scheme for emails instead of supporting pgp, but for these use-cases it's quite slick.

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#85

Post by j2kun »

dethos wrote: post #55

Hi, I'm one of the contributors of the project and we started this because of the need to deal with clients sending us information through insecure channels. We have been using it for a while at Whitesmith and it entered our team's workflow smoothly. Please feel free to ask any question and I will try to answer the best I can. Note: The project is open-source so you can self-host it. Contributions are welcome. Edit:…

It would be lovely to have keybase integration! I've just copy/pasted my GPG public key and fingeprrint from the keybase website into the hawkpost settings, and it works great!

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#86

Post by j2kun »

dkopi wrote: post #31

The weakest link I can identify here is MITM attacks when you're sending the link. Imagine: Alice generates a link. Sends the link to Bob over an unencrypted/unauthenticated link. Mallory intercepts the link. Generates his own link and send that link to bob. Bob enters the confidential information on Mallory's link. Mallory sees the confidential information, and then sends it to Alice's original link. The only way to…

You can publicly provide the link to the box, e.g., on a Twitter account using keybase for authenticity.

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#87

Post by dethos »

j2kun wrote: post #85
dethos wrote: post #55

Hi, I'm one of the contributors of the project and we started this because of the need to deal with clients sending us information through insecure channels. We have been using it for a while at Whitesmith and it entered our team's workflow smoothly. Please feel free to ask any question and I will try to answer the best I can. Note: The project is open-source so you can self-host it. Contributions are welcome. Edit:…

It would be lovely to have keybase integration! I've just copy/pasted my GPG public key and fingeprrint from the keybase website into the hawkpost settings, and it works great!

Agree. Currently keybase can be used as the key-sever url supplied by the user, but in the future making a real integration to take advantage of some cool keybase features would be nice.

Added the suggestion to the discussion issue on github: https://github.com/whitesmith/hawkpost/issues/41

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#88

Post by EGreg »

jsingleton wrote: post #63
Tepix wrote: post #49

Earlier quoted context omitted.

Hawkpost (the project introduced here) is also vulnerable to a coldboot attack - if the server that sends the page with the javascript is compromised, all bets are off.

You need to trust the server at some point. Assuming you do then it doesn't matter if the at-rest encryption is done in the browser or on the server. I'd be happy with HTTPS upload and PGP encryption before writing to disk or forwarding. I think the biggest risk of a secure upload server is a vulnerability exposing a disk full of secure content in the future.

Your don't need to trust the server. You can implement subresource integrity checks!

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#89

Post by nsgi »

EGreg wrote: post #88
jsingleton wrote: post #63

Earlier quoted context omitted.

You need to trust the server at some point. Assuming you do then it doesn't matter if the at-rest encryption is done in the browser or on the server. I'd be happy with HTTPS upload and PGP encryption before writing to disk or forwarding. I think the biggest risk of a secure upload server is a vulnerability exposing a disk full of secure content in the future.

Your don't need to trust the server. You can implement subresource integrity checks!

Subresource integrity still requires you to trust the server sending the hashes.

Re: Show HN: Get encrypted data from people that don’t know how to encrypt

#90

Post by EGreg »

nsgi wrote: post #89
EGreg wrote: post #88

Earlier quoted context omitted.

Your don't need to trust the server. You can implement subresource integrity checks!

Subresource integrity still requires you to trust the server sending the hashes.

Ok so publish the hashes on a blockchain and have the client verify them there
Post reply on HN