11–20 of 385 posts
As in, here's a link to a file, you know the password, it'll self-destruct (disappear) in 24 hours.
Please add this: decrypt also on pressing key "Enter". Thank you!
The "lost thumbdrive" comment makes me wonder if a browser from 20 years (or more) in the future will still have enough legacy functionality to decrypt these payloads.
So, the next step would be to have this in front of a S3 upload dropzone that generates a public link which self-expires after a few days? As in, here's a link to a file, you know the password, it'll self-destruct (disappear) in 24 hours.
All I wanted to show with this project is the concept of self-contained, self-extracting, super-portable secrets.
It would be awesome if this could be code-golfed into a small enough package to fit in a QR code.
Do you mind expanding? Specifically, what do you mean by de-golfed (I'm only vaguely aware of what 'kids' mean by code-golf these days, and I'm kinda lost on de-golfing). What would you like to fit into a QR code? A PortableSecret (e.g. html file)?
neat tool. I would encrypt the payload type and extension tho >Some browsers disable window.crypto on local files and non-TLS servers which ones do that?
Brave and Safari that I know of. i.e. if you run the creator with a simple HTTP server on localhost:8080 it'll block the fetch to localhost:8080/foo
This is password protected, so then an attacker must crack the password. The author exchanges the password over a phone call, which requires the password to be relatively weak, meaning the password is probably crackable. Exchanging the password via a second channel that the other user can copy and paste a more difficult password from to decyrpt the document might be more secure. The password may be more exposed, but…
That said, the password strength and the strength of the side-channel to transmit it depend on your use case.
If we were friends for example, I may not need to send you a password at all. I could just add some secret questions we both know in the hint.
Or, at the opposite side of the spectrum, I could send you a secret as email attachment and *include the password in the email itself*. This adds zero security in certain scenarios, but for example it keeps Google bots out of your private correspondence. Which is all I want sometimes.
This is really cool! The "lost thumbdrive" comment makes me wonder if a browser from 20 years (or more) in the future will still have enough legacy functionality to decrypt these payloads.