Live data from Hacker News

Show HN: Instantly pass your passwords securely

news.ycombinator.com

1–10 of 60 posts

Show HN: Instantly pass your passwords securely

#1
Hey HN!

I made a service to share passwords easy and secure but never promoted it. It's called instapass.io I noticed that people besides my friends and clients actually started to use, so maybe it will be helpful for you too! You share one-time self-destruct message using one time links and I won't even be able to see what you wrote.

How does it work? When you generate a message the client-side makes a random password and use that to encrypt the message. The password is appended as an anchor tag which all modern browsers never send to the server. This way, I don't even know what you shared. Why this and not one of the fancy solutions that exist? Time and complexity. In my experience, people never get around to setup the services especially if you're a consultant like me. And then comes the part of trying to explain to a non-technical person how a master password is and how to share it and signup etc. Instapass offers high security, zero setup time and works for non-developers.

Martin.

Re: Show HN: Instantly pass your passwords securely

#6
What's wrong with this trusted-third-party type of services (where neither you nor service provider cannot prove your data can't be used maliciously) is that people get used to them (because "time and complexity"). And then malicious actors start asking email on signup and harvesting passwords.

Re: Show HN: Instantly pass your passwords securely

#7
Don't forget to read all of the javascript loaded every time you use this website to verify that it hasn't had `$.get('?secret_msg=' + encodeURIComponent($('#id_text').val()))` or similar added to it.

Also, don't forget to let the recipient know to also read all of the javascript so that they can let you know if the plaintext was sent off to the provider the moment they open the link you sent them.

Re: Show HN: Instantly pass your passwords securely

#8
It seems like this is relying on the server to delete the message when accessed?

I made a pastebin years ago that does similar using an anchor tag for the key, except it doesn’t guarantee deletion. https://paste.sh

I’ve been thinking about making it more secure using service workers (something like a service worker combined with resource signing, so it can be cached in browsers and people have to explicitly “upgrade” — along with the hash of the script shown, which can be verified with a reproducible build from a git revision hash).

Re: Show HN: Instantly pass your passwords securely

#10
post #2

What kind of client side encryption does this use?

It's just some symmetric encryption with a randomly generated key (in the hash of the generated url).

Meaning you now have to find a way to safely send this URL ... and you are right where you started. It's no safety at all.

Post reply on HN