Show HN: Instantly pass your passwords securely • Hacker News Board

Re: Show HN: Instantly pass your passwords securely

#41

Post by pinehqcom » Tue, Nov 12, 2019, 6:49 PM UTC

t0astbread wrote: post #19

mike-cardwell wrote: post #7

Don't forget to read all of the javascript loaded every time you use this website to verify that it hasn't had `$.get('?secret_msg=' + encodeURIComponent($('#id_text').val()))` or similar added to it. Also, don't forget to let the recipient know to also read all of the javascript so that they can let you know if the plaintext was sent off to the provider the moment they open the link you sent them.

I feel like this should be a browser extension: Automatically checking resources for changes and blocking new versions until the diff has been approved

That's actually not a bad idea. You could add different kinds of auditors and see who approved it. I'll add that to my never-ending list of "Good Business Ideas When I have time"

Re: Show HN: Instantly pass your passwords securely

#42

Post by pinehqcom » Tue, Nov 12, 2019, 6:51 PM UTC

mattigames wrote: post #30

_tk_ wrote: post #25

I'm sorry but this unfortunately is not a secure solution and should not be treated as such. Either you are able to transmit the link via a secure channel, then you are able to transmit the message via this channel in the first place. Logging might be something that can be circumvented with this service, but this instantly raises a second question: Why should users trust you versus any other service provider? Please…

Yeah, in its current implementation it isn't secure, but if you added SRI checks for each CSS and SCRIPT link and then converted the site to a data:text/html link to be added to the user's bookmark bar it would be secure (in the sense that after auditing the code once you can be sure it cannot be changed)

For this reason I host all the JS/CSS myself and don't have any other JS running. I.e. no google analytics or ad shit.

Re: Show HN: Instantly pass your passwords securely

#43

Post by pinehqcom » Tue, Nov 12, 2019, 6:53 PM UTC

_tk_ wrote: post #25

I'm sorry but this unfortunately is not a secure solution and should not be treated as such. Either you are able to transmit the link via a secure channel, then you are able to transmit the message via this channel in the first place. Logging might be something that can be circumvented with this service, but this instantly raises a second question: Why should users trust you versus any other service provider? Please…

It is secure. The password is not sent to my service. Try setup an `netcat -l -p 8000` and go into your browser and write `http://localhost:8000/#hi` You will see the hi is never sent to the server

Re: Show HN: Instantly pass your passwords securely

#44

Post by pinehqcom » Tue, Nov 12, 2019, 6:54 PM UTC

hagreet wrote: post #35

mattigames wrote: post #30

Earlier quoted context omitted.

Yeah, in its current implementation it isn't secure, but if you added SRI checks for each CSS and SCRIPT link and then converted the site to a data:text/html link to be added to the user's bookmark bar it would be secure (in the sense that after auditing the code once you can be sure it cannot be changed)

I think the most important point is, that this solution requires a way to securely transmit the generated link. As described in another comment by @ryandvm this has two advantages over transmitting the password directly: 1. It won't show up in logs or be otherwise accidentally stored. 2. If the link expires after a single use you get security in the covert model. However, this comes with problems because some tools l…

Exactly exactly. I made sure to be resilient to Google bots/Virus Scanners by doing some fancy javascript tricks

Re: Show HN: Instantly pass your passwords securely

#45

Post by prophesi » Tue, Nov 12, 2019, 9:48 PM UTC

hagreet wrote: post #34

prophesi wrote: post #33

Earlier quoted context omitted.

I'd like to hear HN's take on ShareLock. I think the service is ingenious; my only issues after using it for so long: 1) The 500 character limit 2) If you enter someone's Gmail, and it's actually one of their aliases, then they can't decrypt the message when they sign in.

I don't understand how this relates to the original post. ShareLock is not end-to-end encrypted.

It solves the issue of secret-sharing much better than any of the other proposed solutions here, including InstaPass. You can post the URL in a public channel with confidence, as even if an attacker accesses the URL, they have to verify themselves with their social identity to decrypt the data.

But yes, it's not end-to-end encrypted, so you're better off self-hosting your own instance of sharelock.

Re: Show HN: Instantly pass your passwords securely

#46

Post by dang » Wed, Nov 13, 2019, 8:29 AM UTC

jthomerson wrote: post #16

So. Many. Problems. So. Much. Insecure.

Please don't be a jerk in HN comments, and especially not when someone is sharing their work. Would you mind reading https://news.ycombinator.com/showhn.html? Note these:

Be respectful. Anyone sharing work is making a contribution, however modest.

Instead of "you're doing it wrong", suggest alternatives. When someone is learning, help them learn more.

When something isn't good, you needn't pretend that it is. But don't be gratuitously negative.

Re: Show HN: Instantly pass your passwords securely

#47

Post by ben509 » Wed, Nov 13, 2019, 1:29 PM UTC

pinehqcom wrote: post #43

_tk_ wrote: post #25

I'm sorry but this unfortunately is not a secure solution and should not be treated as such. Either you are able to transmit the link via a secure channel, then you are able to transmit the message via this channel in the first place. Logging might be something that can be circumvented with this service, but this instantly raises a second question: Why should users trust you versus any other service provider? Please…

It is secure. The password is not sent to my service. Try setup an `netcat -l -p 8000` and go into your browser and write ` http://localhost:8000/#hi` You will see the hi is never sent to the server

It's insecure because anyone who intercepts the message can trivially decrypt it by pasting it into their browser.

Yes, self-destructing messages are more secure than simply pasting plain text. But it's offering no protection against eavesdropping, so it's not secure.

Re: Show HN: Instantly pass your passwords securely

#48

Post by ben509 » Wed, Nov 13, 2019, 1:31 PM UTC

stabbles wrote: post #10

samdung wrote: post #2

What kind of client side encryption does this use?

It's just some symmetric encryption with a randomly generated key (in the hash of the generated url). Meaning you now have to find a way to safely send this URL ... and you are right where you started. It's no safety at all.

It's adding self-destructing messages, so there's that. But, yeah, the lack of protection from eavesdropping is a show stopper.

Re: Show HN: Instantly pass your passwords securely

#49

Post by dfalfndfk » Wed, Nov 13, 2019, 9:27 PM UTC

ben509 wrote: post #47

pinehqcom wrote: post #43

Earlier quoted context omitted.

It is secure. The password is not sent to my service. Try setup an `netcat -l -p 8000` and go into your browser and write ` http://localhost:8000/#hi` You will see the hi is never sent to the server

It's insecure because anyone who intercepts the message can trivially decrypt it by pasting it into their browser. Yes, self-destructing messages are more secure than simply pasting plain text. But it's offering no protection against eavesdropping, so it's not secure.

At least you'd know the message has been compromised, no? Although I guess a perp can feed you a different link and delay the realization.

Re: Show HN: Instantly pass your passwords securely

#50

Post by pinehqcom » Thu, Nov 14, 2019, 2:12 PM UTC

dfalfndfk wrote: post #49

ben509 wrote: post #47

Earlier quoted context omitted.

It's insecure because anyone who intercepts the message can trivially decrypt it by pasting it into their browser. Yes, self-destructing messages are more secure than simply pasting plain text. But it's offering no protection against eavesdropping, so it's not secure.

At least you'd know the message has been compromised, no? Although I guess a perp can feed you a different link and delay the realization.

It's not a perfect solution. As @dfalfndfk says you will know that you're eavesdropped.