I can confirm that the password for the bitcoin wallet is not banana.
Show HN: Portable Secret – How I store my secrets and communicate privately
31–40 of 385 posts
Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#32Why not use any of a bunch of other services? Surely you can't think your threat model allows for this but not 1pass?
Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#33This is password protected, so then an attacker must crack the password. The author exchanges the password over a phone call, which requires the password to be relatively weak, meaning the password is probably crackable. Exchanging the password via a second channel that the other user can copy and paste a more difficult password from to decyrpt the document might be more secure. The password may be more exposed, but…
The author recommends the use of XKCD correct-horse-battery-staple style passwords (aka diceware), which have a high ratio of entropy to ease of transmission effort. In other words they're relatively easy to exchange over a phone call but still secure.
And you can compose them from "pre shared" secrets.
For example, the password hint for a secret I send to my sister:
- The name of our neighbors cat
- The name of your first boyfriend who scratched dad's car
- Mom's nickname for aunt Ilda
Concatenate those three with a dot. And voila, a pretty secure password without need of a side channel.
(just made this up, I don't have a sister...)
Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#34So, the next step would be to have this in front of a S3 upload dropzone that generates a public link which self-expires after a few days? As in, here's a link to a file, you know the password, it'll self-destruct (disappear) in 24 hours.
I had the exact same idea years ago when I was working on a secrets manager (hobby project)..
Self Destruction, Unique link + password makes it pretty secure.
With the exception of Internal sabotage, I don't see any other issue.
Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#35Earlier quoted context omitted.
for local files as well?
Yes. If that wasn't the case, then "HTML virus" would be a thing: I send you an HTML file and, if you open it, it read files from your hard drive and uploads them to my server.
The problem with your scenario is the reading the local files without permission, not the use of the crypto API.
Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#36This is password protected, so then an attacker must crack the password. The author exchanges the password over a phone call, which requires the password to be relatively weak, meaning the password is probably crackable. Exchanging the password via a second channel that the other user can copy and paste a more difficult password from to decyrpt the document might be more secure. The password may be more exposed, but…
It does not mean the password needs to be weak at all. Make it a full sentence with punctuation, like:
"Don't you hate passwords that need a number and symbol?"
Easy enough to transmit over the phone and definitely more difficult than the ubiquitous "Password1!" that most people I know end up using to meet password "security" requirements.
Also, phone exchange can be preferable for many people who are less tech comfortable
Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#37This is password protected, so then an attacker must crack the password. The author exchanges the password over a phone call, which requires the password to be relatively weak, meaning the password is probably crackable. Exchanging the password via a second channel that the other user can copy and paste a more difficult password from to decyrpt the document might be more secure. The password may be more exposed, but…
This is not meant as a solution. It's a demo of a self-contained, self-extracting, portable encrypted file. That said, the password strength and the strength of the side-channel to transmit it depend on your use case. If we were friends for example, I may not need to send you a password at all. I could just add some secret questions we both know in the hint. Or, at the opposite side of the spectrum, I could send you…
the author even says that this is more for convenience rather than impenetrable security:
> I created Portable Secret to securely exchange documents via email with my mother, who can’t be expected to learn PGP, age, or similar.
Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#38This is password protected, so then an attacker must crack the password. The author exchanges the password over a phone call, which requires the password to be relatively weak, meaning the password is probably crackable. Exchanging the password via a second channel that the other user can copy and paste a more difficult password from to decyrpt the document might be more secure. The password may be more exposed, but…
Passwords being transmitted over a voice call does not equate to a weak password. You can very easily communicate 4-6 English words outside the 10,000 most common to produce a password with 49-83 bits of entropy. And most people will have just as easy a time remembering 5 words as 5 alphanumerics, if not easier.
Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#39Earlier quoted context omitted.
Do you mind expanding? Specifically, what do you mean by de-golfed (I'm only vaguely aware of what 'kids' mean by code-golf these days, and I'm kinda lost on de-golfing). What would you like to fit into a QR code? A PortableSecret (e.g. html file)?
Code golfing is the act of finding ever and ever smaller, but functionally equivalent, expressions of a specific piece of code. Usually involves a lot of tricks specific to the language the golfing is done in. So yes, it would contain the PortableSecret minimized to such an extent that the whole thing fits in a QR-code (which has a practical upperlimit of a few KB?)
Gotcha. Thank you.
IDK about including a full HTML into a QR code (how would you even open it? Wouldn't a reader get confused expecting a URL or plain string?)
But...
You can publish portable secrets on your website (just make sure they aren't advertised/linked/crawled) and then create a QR code of the (secret-by-obscurity) URL.
Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#40"Do you think this cannot possibly be secure? Great, prove it. This secret contains the recovery key for a Bitcoin wallet. Crack it and take my money!" Love it.
The first few times I shared this with (security professional) colleagues and friends, they'd dismiss it right away "this can't possibly work", but it was because they _assumed_ it didn't work (too simple). Attaching a challenge made a big difference, they'd spend 5 minutes trying to crack it and, in the process, realize it is actually sound (despite the simplicity).
Why would they dismiss this?