Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Portable Secret – How I store my secrets and communicate privately

mprimi.github.io

Post reply on HN
Print view View original

71–80 of 385 posts

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#71

Post by chadlavi »

mprime1 wrote: post #30
RajT88 wrote: post #28

Just was playing with this more. Visiting the secret's page from the "recently closed" or "history" views of Brave/Chrome leaves the password in text entry box. Edge doesn't do it. Probably there's some easy fix for it, I'd guess, but I'm not really a web dev.

Interesting, thanks for saying something. I'm also not a web dev, but I think I can manage to clear out the password once the secret is decrypted successfully.

changing the type of the input from text to password will help. also the required attribute does nothing in html if the input is not part of a form.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#72

Post by theamk »

clarge1120 wrote: post #52

Cyphers, the algorithms used to encrypt the secret file, become obsolete over time. We still need to solve for obsolescence. You can encrypt a file today using a cypher that will eventually be removed from all browsers, desktops, and phones.

I guess this is a downside of the browsers.

If I want to run ancient app (MS-DOS or even ZX Spectrum), there are plenty of well supported modern emulators. But a 5 year browser with feature removed for security reasons like Flash? That's much harder.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#73

Post by ivalm »

vorpalhex wrote: post #56
ortusdux wrote: post #2

"Do you think this cannot possibly be secure? Great, prove it. This secret contains the recovery key for a Bitcoin wallet. Crack it and take my money!" Love it.

This is a smart use of crypto too. The verifiable and public parts of crypto here are a benefit and not a con.

but you are not guaranteed that the decrypted key is valid.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#74

Post by dariusj18 »

amelius wrote: post #19

Nice idea but it seems not resilient against a rainbow attack.

Yeah, plus they even give hints to the password complexity, so unless that is a red herring, this should be pretty simple to crack, if not CPU consuming.

Just combine https://github.com/mejdoubi/rainbow-table and their algorithm together. It would probably take me a few hours to put together, but for someone who is very familiar with cryptography, it would be minimal work.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#75

Post by mprime1 »

clarge1120 wrote: post #52

Cyphers, the algorithms used to encrypt the secret file, become obsolete over time. We still need to solve for obsolescence. You can encrypt a file today using a cypher that will eventually be removed from all browsers, desktops, and phones.

2 sides of obsolescence:

- Too old, no software can decrypt it: not worried about this. These are NIST-standard algorithms, there built-in in most programming languages, they'll be around for a while

- Too old, trivial to crack: this is a bit more concerning to me. It's possible that some entities around the world can already crack this encryption in minutes/hours days

Regarding the second, I'm already working on an Elliptic Curve version of this.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#76

Post by huehehue »

mkl95 wrote: post #60
lolinder wrote: post #25

Earlier quoted context omitted.

There's a ~$400 bounty for anyone who'd like to try.

Hold my beer for a few billion years while I crack it.

The bounty password looks like 2 names, a type of flower, and a two word object. That significantly reduces the search space. Though, it's likely at least one of those words are non-standard or wouldn't be found in any wordlist.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#78

Post by aporetics »

c22 wrote: post #50
mprime1 wrote: post #10

Earlier quoted context omitted.

Do you mind expanding? Specifically, what do you mean by de-golfed (I'm only vaguely aware of what 'kids' mean by code-golf these days, and I'm kinda lost on de-golfing). What would you like to fit into a QR code? A PortableSecret (e.g. html file)?

Like sibling comment elucidates, code-golfing is just using tricks to get the size of a program down without impacting its functionality. This could be as simple as using single-character variable names or something more complicated like including a decompressor that expands some packed code before execution. If you got the decryption code plus the payload small enough you could theoretically put the whole thing into…

This used to be called munging

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#79

Post by falcolas »

clarge1120 wrote: post #52

Cyphers, the algorithms used to encrypt the secret file, become obsolete over time. We still need to solve for obsolescence. You can encrypt a file today using a cypher that will eventually be removed from all browsers, desktops, and phones.

I'd argue this isn't a cryptography problem, or at least not a purely cypto problem. Because we have the exact same issues with almost all file formats and storage mediums.

It requires a maintenance toil task to make the occasional conversion from unsupported cyphers to supported cyphers.

Maybe the page needs a second button and JS function - re-encrypt.

Post reply on HN