Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: html-vault – create self-contained HTML for password protected content

github.com

Post reply on HN
Print view View original

11–20 of 23 posts

Re: Show HN: html-vault – create self-contained HTML for password protected content

#11

Post by dividuum »

aurorabbit wrote: post #8

On the topic of toy web crypto projects, here's mine: https://emojicrypt.com/ It offers scrypt + aes-gcm, encoded into 256 emoji; all the crypto is in https://github.com/aurorabbit/libemojicrypt/blob/master/prot... (I could have went without a subrepo, but in theory it makes non-web integration or alternate interfaces simple.) It's based off of ricmoo's scrypt.js, pfrazee's base-emoji, and WebCrypto. Output contains…

Nice. Did you measure the performance of scrypt.js? The PBKDF2 implementation in Python and both Chrome/Firefox are similar for me and the Python documentation states something like 3x slower that the OpenSSL implementation [1]. So it sounds pretty usable to strengthen the password while still being usable.

[1] https://docs.python.org/3/library/hashlib.html#hashlib.pbkdf...

Re: Show HN: html-vault – create self-contained HTML for password protected content

#12

Post by aurorabbit »

dividuum wrote: post #11
aurorabbit wrote: post #8

On the topic of toy web crypto projects, here's mine: https://emojicrypt.com/ It offers scrypt + aes-gcm, encoded into 256 emoji; all the crypto is in https://github.com/aurorabbit/libemojicrypt/blob/master/prot... (I could have went without a subrepo, but in theory it makes non-web integration or alternate interfaces simple.) It's based off of ricmoo's scrypt.js, pfrazee's base-emoji, and WebCrypto. Output contains…

Nice. Did you measure the performance of scrypt.js? The PBKDF2 implementation in Python and both Chrome/Firefox are similar for me and the Python documentation states something like 3x slower that the OpenSSL implementation [1]. So it sounds pretty usable to strengthen the password while still being usable. [1] https://docs.python.org/3/library/hashlib.html#hashlib.pbkdf...

Thanks! I didn't, but maybe I should have. I thought the API of scrypt.js would work well and don't think I came across anything better. I also figure scrypt is plainly better than PBKDF2; being designed from ground up for key lengthening and offering memory hardness. I figure bitcoin ASICs might be repurpose-able to attack PBKDF2; though I'm not sure if that's a threat, and I imagine it mostly somewhat applies to scrypt anyway because of litecoin and friends. If I were more worried I would have researched the default parameters more, I think this is 128- vs 256-bit territory.

Re: Show HN: html-vault – create self-contained HTML for password protected content

#13

Post by mc3 »

dividuum wrote: post #5
bmsleight_ wrote: post #4

Works, but takes a little while. Nice -useful

That's very much by design. The idea is that even if the file is stolen, a good password should still protect against a lot of bruteforcing.

By design? Or running code in the browser is inefficient? (not your fault, that's the way it is) Keepass (Desktop app) for example doesn't take ages to open.

Re: Show HN: html-vault – create self-contained HTML for password protected content

#14

Post by brokensegue »

mc3 wrote: post #13
dividuum wrote: post #5

Earlier quoted context omitted.

That's very much by design. The idea is that even if the file is stolen, a good password should still protect against a lot of bruteforcing.

By design? Or running code in the browser is inefficient? (not your fault, that's the way it is) Keepass (Desktop app) for example doesn't take ages to open.

You can configure keepass to take forever to open.

Re: Show HN: html-vault – create self-contained HTML for password protected content

#15

Post by maxlaumeister »

Hey! I also made something similar to this (uses a password-derived key to create protected, self-contained HTML).

https://www.maxlaumeister.com/pagecrypt/

Mine was originally in-browser, but thanks to some contributors (Zoltán Gálli and Nial Francis) it has Python and PowerShell CLIs now.

I like your use of async to make sure the work stays off the main thread.

Re: Show HN: html-vault – create self-contained HTML for password protected content

#16

Post by eitland »

dividuum wrote: post #3
eitland wrote: post #2

This might take a moment it said but I think I waited two minutes with no result in sight.

If there's no error message in the browser console, I guess the 20 million PBKDF2 might be a bit much. Which browser are you using?

Recent release of Firefox, on a developer laptop.

Edit: add more details.

Re: Show HN: html-vault – create self-contained HTML for password protected content

#17

Post by Tepix »

It took way too long on my laptop (i5-6200U). With a decent random password (say, 14 letters), the search space will be very large. If a determined attacker (with a couple of GPUs) can attempt 100.000 passwords per second it will still be impossible to crack in an acceptable time.

If we assume that this determined attacker is calculating these hashes 100.000 faster than the average browser, it should be enough if the user has to wait for one second, not one minute.

On the other hand everyone has different security requirements so perhaps making it configurable is the best way to go proceed (with some recommendations).

PS according to https://github.com/analsec/hashcatbenchmark/blob/master/Nvid... a RTX 2080Ti can crack 750k WPA-EAPOL-PBKDF2 with 4096 rounds per second.

Re: Show HN: html-vault – create self-contained HTML for password protected content

#18

Post by Tepix »

maxlaumeister wrote: post #15

Hey! I also made something similar to this (uses a password-derived key to create protected, self-contained HTML). https://www.maxlaumeister.com/pagecrypt/ Mine was originally in-browser, but thanks to some contributors (Zoltán Gálli and Nial Francis) it has Python and PowerShell CLIs now. I like your use of async to make sure the work stays off the main thread.

I like it! Works well. Do you see a way to reduce the required code?

Re: Show HN: html-vault – create self-contained HTML for password protected content

#20

Post by dividuum »

sowbug wrote: post #19

Similar: https://github.com/sowbug/quaid

Indeed. The project motivation is even similar to mine (bootstrap yourself in case everything gets lost). I guess the main difference between the two is that I tried to make the generated HTML minimal so it's easier to verify before entering a password.
Post reply on HN