Show HN: Doppler Share – Share one-off secrets with end-to-end encryption
1–10 of 23 posts
Re: Show HN: Doppler Share – Share one-off secrets with end-to-end encryption
#2Brian from Doppler here. We are an easy way to manage environment variables across projects and services. We did a Launch HN last year: https://news.ycombinator.com/item?id=24719722. Since then, we've been hearing repeatedly from our users that they want a more secure way to share one-off secrets, like API keys, passwords, credit cards, coupons, wire info, lockbox codes, etc. This is understandable, since using Slack, SMS, or email for this leads to your secrets living unencrypted in those systems forever.
So we've made a new product to address this. It is a one-click way to share one-off secrets, end-to-end encrypted with links that auto-expire after a certain number of views and days.
All the encryption is done browser-side so our servers never see the raw secret or the encryption key. We use AES-GCM to encrypt your secrets, with a symmetric key derived from a cryptographically random 64 character passphrase using PBKDF2. If you want to dive deeper into how the data flows, we documented every step of the send and receive flows: https://docs.doppler.com/docs/share-security
We built this so anyone can use it immediately without needing to create an account or jump through any hoops.
Try it out: https://share.doppler.com/s/zg5aqzfbidn9femgnaas2wf2syedqf0s...
Would love to hear what you guys think!
Re: Show HN: Doppler Share – Share one-off secrets with end-to-end encryption
#3This is what I see when I try to share a link:
I'm using Firefox with uBlock Origin, it might be hiding your field based on its ID if it's called "share" or something. I was very confused.
Re: Show HN: Doppler Share – Share one-off secrets with end-to-end encryption
#4Looks very similar to https://github.com/pinterest/snappass
Re: Show HN: Doppler Share – Share one-off secrets with end-to-end encryption
#5This is what I see when I try to share a link: https://imgz.org/i3EfPoDo.png I'm using Firefox with uBlock Origin, it might be hiding your field based on its ID if it's called "share" or something. I was very confused.
Exactly same configuration here and exact same result.
Re: Show HN: Doppler Share – Share one-off secrets with end-to-end encryption
#6I am browsing docs at https://docs.doppler.com and I noticed that in all your examples you do not authenticate even though this is needed when interacting with doppler. In most examples the required authentication is not even one extra line of code. Why would you leave that out?
I have an OCD where I want the examples to be complete, sorry for that. Otherwise the service looks interesting.
It seems that the main doppler product is not end-to-end encrypted, is that correct?
Re: Show HN: Doppler Share – Share one-off secrets with end-to-end encryption
#7This is what I see when I try to share a link: https://imgz.org/i3EfPoDo.png I'm using Firefox with uBlock Origin, it might be hiding your field based on its ID if it's called "share" or something. I was very confused.
Thanks for reporting! We have a fix coming out in the next hour.
Re: Show HN: Doppler Share – Share one-off secrets with end-to-end encryption
#8I am browsing docs at https://docs.doppler.com and I noticed that in all your examples you do not authenticate even though this is needed when interacting with doppler. In most examples the required authentication is not even one extra line of code. Why would you leave that out? I have an OCD where I want the examples to be complete, sorry for that. Otherwise the service looks interesting. It seems that the main dopp…
This is great feedback! I have updated the docs to show a placeholder token.
You are correct, the main Doppler product is not end-to-end encrypted. We use tokenization instead to secure the data. Here's a link that goes more in-depth on how that works: https://docs.doppler.com/docs/security-fact-sheet
Re: Show HN: Doppler Share – Share one-off secrets with end-to-end encryption
#9Cool app! Doppler looks great but i have a tiny concern about the Bugsnag 3rd party script. Unless Doppler own Bugsnag, i think for a sensitive tool like secret sharing, you should remove it.
Shameless plug: I made a similar tool base off another project after FirefoxSend shuts down but deploy on AWS instead of GCP :) It is hosted here if anyone wanna take a look or roll their own https://www.relaysecret.com/. The design philosophy is the same (everything is encrypted on clientside, no plaintext or password leave clients browser, minimal backend).
Re: Show HN: Doppler Share – Share one-off secrets with end-to-end encryption
#10This is what I see when I try to share a link: https://imgz.org/i3EfPoDo.png I'm using Firefox with uBlock Origin, it might be hiding your field based on its ID if it's called "share" or something. I was very confused.
Thanks for reporting! We have a fix coming out in the next hour.
We think we shipped the fix. Is the issue still occurring for you?