21–30 of 68 posts
Hi, normally i dont post at all. But this is my attempt to share pieces of information anonymously that expires in a certain time. Site is made in Angular and and the backend is a simple thread safe dictionary that resets every 24 hours. It is by no means a commercial solution to any problem. This is something i came up with half an hour of dev work, coz i could not find anything similar.
I never really got the point of (digital) self destructing messages, since the reader can easily just copy the text/data, i.e. destruct only means not available anymore after future point in time. So you're just relying on the receiver of the message to follow protocol -- as always.
one hackathon later we had a one time secret sharing slash command (which you can only reveal the message once and is then lost/deleted). self-hosted.
it's the thing i'm asked most about if it was OSS after i left the company (by other ex-colleagues looking to have the same thing elsewhere).
Hi, normally i dont post at all. But this is my attempt to share pieces of information anonymously that expires in a certain time. Site is made in Angular and and the backend is a simple thread safe dictionary that resets every 24 hours. It is by no means a commercial solution to any problem. This is something i came up with half an hour of dev work, coz i could not find anything similar.
It looks very good for something whipped up in an hour. Did you consider using Redis as a data store for this? Seems like it would be quite easy to just generate a UUID as a key and set it with an expire time in redis. If you did consider Redis, any reason why you didn't end up using it?
Instead of a UUID, just read 16 bytes from /dev/urandom (getentropy() if you've got it). Base85 or Base64 encode the bytes if you need a string.
for the longest time we had issues with people pasting passwords in slack to share them within the org. one hackathon later we had a one time secret sharing slash command (which you can only reveal the message once and is then lost/deleted). self-hosted. it's the thing i'm asked most about if it was OSS after i left the company (by other ex-colleagues looking to have the same thing elsewhere).
I ll publish the code on github too. The idea is that on every startup, system generates a new keys to encrypt data. This site is hosted on a single docker instance and there is no output (logs etc) for now. I dont intend to capture anything at all from this. Litreally. The dictionary lives in memory and there is a background service on the same docker that new(s) the Dictionary every 24 hours.
I never really got the point of (digital) self destructing messages, since the reader can easily just copy the text/data, i.e. destruct only means not available anymore after future point in time. So you're just relying on the receiver of the message to follow protocol -- as always.
Taking advantage of this post to ask about this -- can anyone explain to me why Signal can't be implemented as a completely offline-first/PWA web-app. If we throw away the more advanced requirements of perfect forward secrecy, non repudiation, ratcheting for groups, non repudiation, why is it a bad idea to get 80% of the way there with basic offline-first/WPA (+/- secure enclave, WebAuthN, whatever else) messages tha…