Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PurritoBin: Ultra fast, minimalistic, encrypted command line paste-bin

github.com

Post reply on HN
Print view View original

21–30 of 30 posts

Re: PurritoBin: Ultra fast, minimalistic, encrypted command line paste-bin

#21

Post by cjones26 »

ta17711771 wrote: post #20
rakoo wrote: post #13

Earlier quoted context omitted.

Just don't use openssl's command line for encrypting anything, there are better tools for that. My guess is that the fixed IV is used because the IV is needed for decrypting, which means either you prepend the ciphertext with it (which means you need to buffer the whole ciphertext in memory, defeating the streaming functionality of the service) or you already know it because it's hardcoded. In any case there is no au…

Just don't use OpenSSL for anything - how many times does the community have to be burned by the same project before they switch?

What's a good alternative?

Re: PurritoBin: Ultra fast, minimalistic, encrypted command line paste-bin

#22

Post by pwdisswordfish2 »

The author calls this "command line" pastebin. It uses curl and openssl to encrypt and submit. However it uses a Javascript-enabled web broswer to do the retrieval and decryption. Can we use the command line to do the retrieval and decryption?

This way, we are not restricted to the ciphers supported by the "Crypto-JS" NodeJS package. Not meaning to take anything away from the venerable Crypto-JS library of "standards" including RC4 and TripleDES.

Re: PurritoBin: Ultra fast, minimalistic, encrypted command line paste-bin

#23

Post by tialaramex »

StavrosK wrote: post #16

Is encryption a popular requirement? I made (and thus prefer) https://www.pastery.net/ , but nobody has asked me to add encryption, I assume that privacy (not having a list of pastes anywhere and deleting them from disk when they expire) is enough, at least for me.

I can think of one very good reason to have clients encrypt pastes for you as service provider:

If the pastes are encrypted by somebody else you simply have no idea what's inside them. You can easily find an expert who will explain to a jury, or a journalist, that you had no way to know it was an assassination plot / stolen bitcoin wallet / confession of child molestation. I'm sure you don't look (other people's business is quickly boring) but it may be difficult today to prove you didn't, because you could have.

But in terms of what I've used, in some tech jobs I've used in-house HTTPS pastebin sites. If we control the machine with the data in it then we get to decide what policies to apply, and if things go bad we know who (us) needs to fix that. In the last place I worked they used GitHub gists, so in principle Microsoft could snoop those and I'd have been uncomfortable seeing anything secret in them.

Re: PurritoBin: Ultra fast, minimalistic, encrypted command line paste-bin

#25

Post by faaabio1618 »

pwdisswordfish2 wrote: post #22

The author calls this "command line" pastebin. It uses curl and openssl to encrypt and submit. However it uses a Javascript-enabled web broswer to do the retrieval and decryption. Can we use the command line to do the retrieval and decryption? This way, we are not restricted to the ciphers supported by the "Crypto-JS" NodeJS package. Not meaning to take anything away from the venerable Crypto-JS library of "standards…

You have missed the "meow" command.

Re: PurritoBin: Ultra fast, minimalistic, encrypted command line paste-bin

#27

Post by rakoo »

tialaramex wrote: post #18
rakoo wrote: post #8

> openssl enc blablabla Don't use that line for encrypting stuff. There is no authentication and the IV is static. You're just asking for your secrets to be decrypted or modified without anyone noticing

The static IV is a brown M&M but not in itself fatal because this seems to use fresh random keys each time. If your keys end up re-used (NB don't fret about somehow choosing the same random key as somebody else that's astronomically unlikely, but do fret about your choices not actually being random after all) then you're screwed anyway. There's no obvious route to decrypt these messages without the secret key, though…

Indeed in that particular case since key is randomly generated it's ok to have a static IV. However I feel it's important to understand why it's ok in that case; in the general case, even though it's not technically required, it's always easier to have a random IV

Re: PurritoBin: Ultra fast, minimalistic, encrypted command line paste-bin

#28

Post by rakoo »

gruez wrote: post #14
rakoo wrote: post #13

Earlier quoted context omitted.

Just don't use openssl's command line for encrypting anything, there are better tools for that. My guess is that the fixed IV is used because the IV is needed for decrypting, which means either you prepend the ciphertext with it (which means you need to buffer the whole ciphertext in memory, defeating the streaming functionality of the service) or you already know it because it's hardcoded. In any case there is no au…

>which means you need to buffer the whole ciphertext in memory, defeating the streaming functionality of the service Can't you generate an IV, write it out to the stream, then encrypt/write the ciphertext?

You could indeed, I didn't think of that. But it starts to beheavier and heavier, and the risk of making subtle mistakes increases. That's why it's better to use tools that do it properly, like age (https://github.com/FiloSottile/age)

Re: PurritoBin: Ultra fast, minimalistic, encrypted command line paste-bin

#29

Post by ta17711771 »

cjones26 wrote: post #21
ta17711771 wrote: post #20

Earlier quoted context omitted.

Just don't use OpenSSL for anything - how many times does the community have to be burned by the same project before they switch?

What's a good alternative?

libressl is the only one I'm aware of.

Re: PurritoBin: Ultra fast, minimalistic, encrypted command line paste-bin

#30

Post by pwdisswordfish2 »

faaabio1618 wrote: post #25
pwdisswordfish2 wrote: post #22

The author calls this "command line" pastebin. It uses curl and openssl to encrypt and submit. However it uses a Javascript-enabled web broswer to do the retrieval and decryption. Can we use the command line to do the retrieval and decryption? This way, we are not restricted to the ciphers supported by the "Crypto-JS" NodeJS package. Not meaning to take anything away from the venerable Crypto-JS library of "standards…

You have missed the "meow" command.

No, that is an incorrect assumption. The meow command does not decrypt data. The author is suggesting that users resort to using a web browser and Crypto-JS in order to decrypt.
Post reply on HN