Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Instantly pass your passwords securely

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 60 posts

Re: Show HN: Instantly pass your passwords securely

#21

Post by mattigames »

mike-cardwell wrote: post #7

Don't forget to read all of the javascript loaded every time you use this website to verify that it hasn't had `$.get('?secret_msg=' + encodeURIComponent($('#id_text').val()))` or similar added to it. Also, don't forget to let the recipient know to also read all of the javascript so that they can let you know if the plaintext was sent off to the provider the moment they open the link you sent them.

There is a way to make sure the website never changes without having to check each time, and that is to append it as a data:text/html link and add such link as a bookmark (example data:text/html,alert('hi');), as long as the script tags have SRI (Subresource Integrity Check[0])

[0] https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

Re: Show HN: Instantly pass your passwords securely

#22

Post by NudaVeritas »

I recommend https://nachricht.co

Pros: messages are deleted completely, messages are individually AES-256 encrypted, can only be decrypted with the generated link, the wehsite itself cannot read or decrypt messages, no ip logging, multiple languages, exists since 2014, PWA available

Cons: ads (but deactivatable)

Re: Show HN: Instantly pass your passwords securely

#23

Post by abionic »

wrote an OSS `Dory` using golang, this for similar self-hosted use-case a while back

https://github.com/abhishekkr/dory

* this is a secret sharing service for masses, where you don't need to be authenticated at service to store and share secret

* anyone with access to service can upload a secret and share the token with people they wanna share it

* if accessed without an explicit retention parameter, the secret gets purged on first fetch

* if stored in cache mode, it self expires after a TTL if not accessed for that duration

* even service admin can't decipher a secret posted by any user

Re: Show HN: Instantly pass your passwords securely

#24

Post by bko »

Cool product.

Regarding paid service you write:

> If you already like this service, I am sure you will love the next version! The next version will include paid features, but signing up now you will get two months of premium features once they are ready. By signing up you also accept I will send you occasional emails when new stuff happens, such as premium features. I will never sell nor give your email to anyone, and I will send 2 emails maximum per month.

Its unclear what I'm signing up for. Am I signing up for the service or newsletter? I would suggest you phrase it as notify me of version 2.0 or something similar.

Re: Show HN: Instantly pass your passwords securely

#25

Post by _tk_ »

I'm sorry but this unfortunately is not a secure solution and should not be treated as such.

Either you are able to transmit the link via a secure channel, then you are able to transmit the message via this channel in the first place.

Logging might be something that can be circumvented with this service, but this instantly raises a second question: Why should users trust you versus any other service provider?

Please do not advertise this service as secure.

Re: Show HN: Instantly pass your passwords securely

#26

Post by z3t4 »

mike-cardwell wrote: post #7

Don't forget to read all of the javascript loaded every time you use this website to verify that it hasn't had `$.get('?secret_msg=' + encodeURIComponent($('#id_text').val()))` or similar added to it. Also, don't forget to let the recipient know to also read all of the javascript so that they can let you know if the plaintext was sent off to the provider the moment they open the link you sent them.

You not only have to trust the websites, you also need to trust your operating system, your web browser, and the web browser extensions. It's for example common for browsers to call home with anything you type/paste in the URL-bar. Both Chrome and Firefox did that last time I checked.

Re: Show HN: Instantly pass your passwords securely

#28

Post by GlitchMr »

NudaVeritas wrote: post #22

I recommend https://nachricht.co Pros: messages are deleted completely, messages are individually AES-256 encrypted, can only be decrypted with the generated link, the wehsite itself cannot read or decrypt messages, no ip logging, multiple languages, exists since 2014, PWA available Cons: ads (but deactivatable)

The messages AREN'T encrypted, they are very much visible with web developer tools, sent in plain text in requests. Ads can easily read messages (so you need to trust Google and random Google Ads users to not read messages in addition to the website owner... which is lol, not happening). This website is dangerous snake oil.

That's not to say other websites like this are trustworthy (they aren't, JavaScript can change at any time), but this is blatantly non-trustworthy.

Re: Show HN: Instantly pass your passwords securely

#29

Post by mattigames »

z3t4 wrote: post #26
mike-cardwell wrote: post #7

Don't forget to read all of the javascript loaded every time you use this website to verify that it hasn't had `$.get('?secret_msg=' + encodeURIComponent($('#id_text').val()))` or similar added to it. Also, don't forget to let the recipient know to also read all of the javascript so that they can let you know if the plaintext was sent off to the provider the moment they open the link you sent them.

You not only have to trust the websites, you also need to trust your operating system, your web browser, and the web browser extensions. It's for example common for browsers to call home with anything you type/paste in the URL-bar. Both Chrome and Firefox did that last time I checked.

you forgot to mention you also need to trust the CPU, the motherboard among other hardware components, you also need to trust lack of cameras on the room you see the message among other physical eavesdropping.

Re: Show HN: Instantly pass your passwords securely

#30

Post by mattigames »

_tk_ wrote: post #25

I'm sorry but this unfortunately is not a secure solution and should not be treated as such. Either you are able to transmit the link via a secure channel, then you are able to transmit the message via this channel in the first place. Logging might be something that can be circumvented with this service, but this instantly raises a second question: Why should users trust you versus any other service provider? Please…

Yeah, in its current implementation it isn't secure, but if you added SRI checks for each CSS and SCRIPT link and then converted the site to a data:text/html link to be added to the user's bookmark bar it would be secure (in the sense that after auditing the code once you can be sure it cannot be changed)
Post reply on HN