Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Portable Secret – How I store my secrets and communicate privately

mprimi.github.io

Post reply on HN
Print view View original

21–30 of 385 posts

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#21

Post by Phemist »

mprime1 wrote: post #10
c22 wrote: post #4

It would be awesome if this could be code-golfed into a small enough package to fit in a QR code.

Do you mind expanding? Specifically, what do you mean by de-golfed (I'm only vaguely aware of what 'kids' mean by code-golf these days, and I'm kinda lost on de-golfing). What would you like to fit into a QR code? A PortableSecret (e.g. html file)?

Code golfing is the act of finding ever and ever smaller, but functionally equivalent, expressions of a specific piece of code. Usually involves a lot of tricks specific to the language the golfing is done in.

So yes, it would contain the PortableSecret minimized to such an extent that the whole thing fits in a QR-code (which has a practical upperlimit of a few KB?)

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#22

Post by bryanlarsen »

gregwebs wrote: post #14

This is password protected, so then an attacker must crack the password. The author exchanges the password over a phone call, which requires the password to be relatively weak, meaning the password is probably crackable. Exchanging the password via a second channel that the other user can copy and paste a more difficult password from to decyrpt the document might be more secure. The password may be more exposed, but…

The author recommends the use of XKCD correct-horse-battery-staple style passwords (aka diceware), which have a high ratio of entropy to ease of transmission effort.

In other words they're relatively easy to exchange over a phone call but still secure.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#23

Post by [deleted] »

gregwebs wrote: post #14

This is password protected, so then an attacker must crack the password. The author exchanges the password over a phone call, which requires the password to be relatively weak, meaning the password is probably crackable. Exchanging the password via a second channel that the other user can copy and paste a more difficult password from to decyrpt the document might be more secure. The password may be more exposed, but…

[deleted]

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#26

Post by mprime1 »

throwaway0x7E6 wrote: post #17
mprime1 wrote: post #7

Earlier quoted context omitted.

Brave and Safari that I know of. i.e. if you run the creator with a simple HTTP server on localhost:8080 it'll block the fetch to localhost:8080/foo

for local files as well?

Yes.

If that wasn't the case, then "HTML virus" would be a thing: I send you an HTML file and, if you open it, it read files from your hard drive and uploads them to my server.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#27

Post by lcnPylGDnU4H9OF »

mprime1 wrote: post #6
ortusdux wrote: post #2

"Do you think this cannot possibly be secure? Great, prove it. This secret contains the recovery key for a Bitcoin wallet. Crack it and take my money!" Love it.

The first few times I shared this with (security professional) colleagues and friends, they'd dismiss it right away "this can't possibly work", but it was because they _assumed_ it didn't work (too simple). Attaching a challenge made a big difference, they'd spend 5 minutes trying to crack it and, in the process, realize it is actually sound (despite the simplicity).

> despite the simplicity

FWIW, it's a simple composition of complex things. Still really cool, thanks for the idea!

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#28

Post by RajT88 »

Just was playing with this more.

Visiting the secret's page from the "recently closed" or "history" views of Brave/Chrome leaves the password in text entry box.

Edge doesn't do it.

Probably there's some easy fix for it, I'd guess, but I'm not really a web dev.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#30

Post by mprime1 »

RajT88 wrote: post #28

Just was playing with this more. Visiting the secret's page from the "recently closed" or "history" views of Brave/Chrome leaves the password in text entry box. Edge doesn't do it. Probably there's some easy fix for it, I'd guess, but I'm not really a web dev.

Interesting, thanks for saying something.

I'm also not a web dev, but I think I can manage to clear out the password once the secret is decrypted successfully.

Post reply on HN