Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Portable Secret – How I store my secrets and communicate privately

mprimi.github.io

Post reply on HN
Print view View original

91–100 of 385 posts

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#91

Post by falcolas »

jononomo wrote: post #66
gregwebs wrote: post #14

This is password protected, so then an attacker must crack the password. The author exchanges the password over a phone call, which requires the password to be relatively weak, meaning the password is probably crackable. Exchanging the password via a second channel that the other user can copy and paste a more difficult password from to decyrpt the document might be more secure. The password may be more exposed, but…

Over the phone I could tell someone: "the password is the first 28 words of Psalm 23 from the King James Version." Would that be a weak password?

Funny enough, the Bible's well enough indexed, and in small enough chunks, that you could just send someone:

Psalms23:2

and have a 14 word passphrase.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#92

Post by booi »

jononomo wrote: post #66
gregwebs wrote: post #14

This is password protected, so then an attacker must crack the password. The author exchanges the password over a phone call, which requires the password to be relatively weak, meaning the password is probably crackable. Exchanging the password via a second channel that the other user can copy and paste a more difficult password from to decyrpt the document might be more secure. The password may be more exposed, but…

Over the phone I could tell someone: "the password is the first 28 words of Psalm 23 from the King James Version." Would that be a weak password?

Yes because the paraphrase already exists in plain text somewhere public

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#93

Post by jck »

raybb wrote: post #80

Works pretty well on Android! Unfortunately, today I learned that FireFox doesn't seems to support opening html files. When I download the html file FF isn't one of the options to open it. Only Chrome. Anyone know an way around this?

There is no workaround: https://github.com/mozilla-mobile/fenix/issues/7546

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#94

Post by unethical_ban »

>Some secrets don’t belong in your password manager. Things like backup private keys, 2FS recovery keys, wallet keys, safe combinations, treasure maps, etc.

Uh, I put everything in my Keepass safe, then write the password down in an envelope in a secure location in my house.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#95

Post by mprime1 »

dariusj18 wrote: post #59

if you've got to communicate the decryption key separately anyway, might as well just use password protected zip files, no?

Indeed, it's functionally similar to password-protected PDF or ZIP for some use cases.

You should probably not treat password-protected zips as secure: https://security.stackexchange.com/questions/35818/are-passw...

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#96

Post by forgotpw2726 »

I've been thinking about something similar, it really should be much easier to send encrypted messages.

I'm not sure if this is a problem, but one thing that is unclear to me is how/if this protects against an adversary that can modify the html file.

If the adversary can modify the HTML file in transit they can just add some code that sends the password to the adversary's server when the real recipient opens the file. (Of course, the recipient can run it in some air gapped browser etc, but that limits the practical use case quite a lot.)

And if you want to use this to send messages over e.g. email this seems like a somewhat important thing to protect against. I guess you could send the portable secret html file separately, and then the user copy-pastes the message in some text-box, but again this makes it more clunky.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#97

Post by ncallaway »

europeanguy wrote: post #86
ortusdux wrote: post #2

"Do you think this cannot possibly be secure? Great, prove it. This secret contains the recovery key for a Bitcoin wallet. Crack it and take my money!" Love it.

What happened to the "don't roll your own crypto" that HN loves?

They didn’t roll their own crypto? They used the web crypto API provided by the web browser.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#98

Post by mprime1 »

huehehue wrote: post #76
mkl95 wrote: post #60

Earlier quoted context omitted.

Hold my beer for a few billion years while I crack it.

The bounty password looks like 2 names, a type of flower, and a two word object. That significantly reduces the search space. Though, it's likely at least one of those words are non-standard or wouldn't be found in any wordlist.

All words appear in some wordlist.

This is the kind of password I use to protect my actual secrets. So if someone is able to crack it, I'd like to know. The bounty is for a 'realistic' use case.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#99

Post by falcolas »

dariusj18 wrote: post #74
amelius wrote: post #19

Nice idea but it seems not resilient against a rainbow attack.

Yeah, plus they even give hints to the password complexity, so unless that is a red herring, this should be pretty simple to crack, if not CPU consuming. Just combine https://github.com/mejdoubi/rainbow-table and their algorithm together. It would probably take me a few hours to put together, but for someone who is very familiar with cryptography, it would be minimal work.

Sounds like a quick $400 for you then. :)

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#100

Post by ninkendo »

ivalm wrote: post #73
vorpalhex wrote: post #56

Earlier quoted context omitted.

This is a smart use of crypto too. The verifiable and public parts of crypto here are a benefit and not a con.

but you are not guaranteed that the decrypted key is valid.

I hate that I’m saying this because I believe all of cryptocurrency to be a pyramid scheme, but… this is the perfect use case for a smart contract on ethereum…

(Now I gotta go wash my hands after typing this.)

Post reply on HN