41–50 of 385 posts
Earlier quoted context omitted.
Yes. If that wasn't the case, then "HTML virus" would be a thing: I send you an HTML file and, if you open it, it read files from your hard drive and uploads them to my server.
The problem with your scenario is the reading the local files without permission, not the use of the crypto API.
I'm pretty sure Brave was blocking window.crypto but can't remember if it was on a file or over plain HTTP
neat tool. I would encrypt the payload type and extension tho >Some browsers disable window.crypto on local files and non-TLS servers which ones do that?
If you put:
window.crypto.subtle.generateKey(
{name: "ECDSA", namedCurve: "P-256"},
false, ["sign", "verify"])
.then(function(key){alert(key.publicKey)})
[1] https://developer.mozilla.org/en-US/docs/Web/API/Crypto/subt...
[2] https://developer.mozilla.org/en-US/docs/Web/Security/Secure...
Earlier quoted context omitted.
The first few times I shared this with (security professional) colleagues and friends, they'd dismiss it right away "this can't possibly work", but it was because they _assumed_ it didn't work (too simple). Attaching a challenge made a big difference, they'd spend 5 minutes trying to crack it and, in the process, realize it is actually sound (despite the simplicity).
Why would they dismiss this?
(People are busy, attention is scarce, etc)
"Do you think this cannot possibly be secure? Great, prove it. This secret contains the recovery key for a Bitcoin wallet. Crack it and take my money!" Love it.
Very creative and efficient use of $400 on PR/advertising!
Nice idea but it seems not resilient against a rainbow attack.
https://github.com/mprimi/portable-secret/blob/main/creator/...
Earlier quoted context omitted.
The author recommends the use of XKCD correct-horse-battery-staple style passwords (aka diceware), which have a high ratio of entropy to ease of transmission effort. In other words they're relatively easy to exchange over a phone call but still secure.
And you can compose them from "pre shared" secrets. For example, the password hint for a secret I send to my sister: - The name of our neighbors cat - The name of your first boyfriend who scratched dad's car - Mom's nickname for aunt Ilda Concatenate those three with a dot. And voila, a pretty secure password without need of a side channel. (just made this up, I don't have a sister...)
"Do you think this cannot possibly be secure? Great, prove it. This secret contains the recovery key for a Bitcoin wallet. Crack it and take my money!" Love it.
Very creative and efficient use of $400 on PR/advertising!
I don't think of it as PR/Ad. It's a bounty. If you put in time to find a flaw, you deserve at least that much (and I'll give you more if you help me fix it).
Earlier quoted context omitted.
Very creative and efficient use of $400 on PR/advertising!
What is your comment referring to? I must have missed something...
[1] https://mprimi.github.io/portable-secret/examples/bounty.htm...
It would be awesome if this could be code-golfed into a small enough package to fit in a QR code.
Do you mind expanding? Specifically, what do you mean by de-golfed (I'm only vaguely aware of what 'kids' mean by code-golf these days, and I'm kinda lost on de-golfing). What would you like to fit into a QR code? A PortableSecret (e.g. html file)?
If you got the decryption code plus the payload small enough you could theoretically put the whole thing into a data URL (a URL that doesn't link to a remote resource, but contains all the data needed to display a web page). This data url could theoretically then be encoded into QR and accessed entirely locally on anyone's smart device.