Show HN: Instantly pass your passwords securely
31–40 of 60 posts
Re: Show HN: Instantly pass your passwords securely
#32Earlier quoted context omitted.
You not only have to trust the websites, you also need to trust your operating system, your web browser, and the web browser extensions. It's for example common for browsers to call home with anything you type/paste in the URL-bar. Both Chrome and Firefox did that last time I checked.
you forgot to mention you also need to trust the CPU, the motherboard among other hardware components, you also need to trust lack of cameras on the room you see the message among other physical eavesdropping.
You also have to trust yourself! Many people have given up their encrypted messages after having a few too many fermented malt beverages!
Re: Show HN: Instantly pass your passwords securely
#33https://sharelock.io/ https://github.com/auth0/sharelock
I'd like to hear HN's take on ShareLock. I think the service is ingenious; my only issues after using it for so long:
1) The 500 character limit
2) If you enter someone's Gmail, and it's actually one of their aliases, then they can't decrypt the message when they sign in.
Re: Show HN: Instantly pass your passwords securely
#34https://sharelock.io/ https://github.com/auth0/sharelock
I'd like to hear HN's take on ShareLock. I think the service is ingenious; my only issues after using it for so long: 1) The 500 character limit 2) If you enter someone's Gmail, and it's actually one of their aliases, then they can't decrypt the message when they sign in.
I don't understand how this relates to the original post. ShareLock is not end-to-end encrypted.
Re: Show HN: Instantly pass your passwords securely
#35I'm sorry but this unfortunately is not a secure solution and should not be treated as such. Either you are able to transmit the link via a secure channel, then you are able to transmit the message via this channel in the first place. Logging might be something that can be circumvented with this service, but this instantly raises a second question: Why should users trust you versus any other service provider? Please…
Yeah, in its current implementation it isn't secure, but if you added SRI checks for each CSS and SCRIPT link and then converted the site to a data:text/html link to be added to the user's bookmark bar it would be secure (in the sense that after auditing the code once you can be sure it cannot be changed)
I think the most important point is, that this solution requires a way to securely transmit the generated link. As described in another comment by @ryandvm this has two advantages over transmitting the password directly:
1. It won't show up in logs or be otherwise accidentally stored.
2. If the link expires after a single use you get security in the covert model. However, this comes with problems because some tools like virus scanners automatically hit links.
Re: Show HN: Instantly pass your passwords securely
#36I recommend https://nachricht.co Pros: messages are deleted completely, messages are individually AES-256 encrypted, can only be decrypted with the generated link, the wehsite itself cannot read or decrypt messages, no ip logging, multiple languages, exists since 2014, PWA available Cons: ads (but deactivatable)
The messages AREN'T encrypted, they are very much visible with web developer tools, sent in plain text in requests. Ads can easily read messages (so you need to trust Google and random Google Ads users to not read messages in addition to the website owner... which is lol, not happening). This website is dangerous snake oil. That's not to say other websites like this are trustworthy (they aren't, JavaScript can change…
It always depends on who you want to hide these messages from. Of course, end-to-end encryption is more secure than pure server-side encryption. But do you really need end-to-end encryption for such a webtool? After all, all TCP packets are already encrypted via TLS. The advantage of these web tools is in the temporary storage without being able to restore these messages, not hyper secure NSA-proof messaging.
Re: Show HN: Instantly pass your passwords securely
#37Don't forget to read all of the javascript loaded every time you use this website to verify that it hasn't had `$.get('?secret_msg=' + encodeURIComponent($('#id_text').val()))` or similar added to it. Also, don't forget to let the recipient know to also read all of the javascript so that they can let you know if the plaintext was sent off to the provider the moment they open the link you sent them.
You not only have to trust the websites, you also need to trust your operating system, your web browser, and the web browser extensions. It's for example common for browsers to call home with anything you type/paste in the URL-bar. Both Chrome and Firefox did that last time I checked.
[deleted]
Re: Show HN: Instantly pass your passwords securely
#38Since I have found, Keybase is my favorite for this kind of situations. https://keybase.io
Re: Show HN: Instantly pass your passwords securely
#39Hey guys, thanks for all the comments. I'll try to address them before I am going to bed.
How I use instapass.io is sending an email/slack/telegram/etc. with the password in instapass. This way your password isn't stored on a email/slack/etc.. server in clear text forever. It also makes it possible to see if an attacker opened the password and take appropriate action. There is a slim risk of an MIIM where you edit the link super fast and have control over messaging service. This is exactly what @johnmarcus wrote. If you don't trust my service then you can just keep the password in Instapass and the other login info (url to login, email, username, etc..) inside the email. How should I know what you sent a password to? I think that's a better choice than sending login info in clear text.
Re: Show HN: Instantly pass your passwords securely
#40Don't forget to read all of the javascript loaded every time you use this website to verify that it hasn't had `$.get('?secret_msg=' + encodeURIComponent($('#id_text').val()))` or similar added to it. Also, don't forget to let the recipient know to also read all of the javascript so that they can let you know if the plaintext was sent off to the provider the moment they open the link you sent them.
All my JavaScript is self-hosted and easy to read.
If you don't trust my service then you can just keep the password in Instapass and the other login info (url to login, email, username, etc..) inside the email.
How should I know what you sent a password to?
I think that's a better choice than sending login info in clear text.