Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Portable Secret – How I store my secrets and communicate privately

mprimi.github.io

Post reply on HN
Print view View original

101–110 of 385 posts

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#101

Post by mprime1 »

dariusj18 wrote: post #74
amelius wrote: post #19

Nice idea but it seems not resilient against a rainbow attack.

Yeah, plus they even give hints to the password complexity, so unless that is a red herring, this should be pretty simple to crack, if not CPU consuming. Just combine https://github.com/mejdoubi/rainbow-table and their algorithm together. It would probably take me a few hours to put together, but for someone who is very familiar with cryptography, it would be minimal work.

I'm willing to sweeten the deal.

What amount of money would make you actually try to crack it?

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#102

Post by skrebbel »

europeanguy wrote: post #86
ortusdux wrote: post #2

"Do you think this cannot possibly be secure? Great, prove it. This secret contains the recovery key for a Bitcoin wallet. Crack it and take my money!" Love it.

What happened to the "don't roll your own crypto" that HN loves?

this doesn't, it uses the browser's builtin Web Cryptography API.

if using a crypto algorithm also counts as "rolling your own crypto" then what's left? just don't encrypt anything, ever, because HN says we shouldn't roll our own?

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#103

Post by admax88qqq »

createdapril24 wrote: post #87

This has some desirable security properties, but I would like to see more analysis on the security side (not just: is secure or is not secure). Passwords: - Easy to memorize. Pro: Does not rely on a device, can be recovered if devices stolen. - Easy to phish. Con: Attacker can use a look-a-like page, click-jacking, and pixel extraction (frame stealing) attacks to get password & secret. - Easy to brute force. Con: Rel…

> Con: Eventually the secrets will become exposed due to advances in crypt-analysis

You can claim this con for literally any crypto. And I'm not actually sure it's a reasonable assumption.

Block ciphers seem to be pretty unbreakable so far. Even good ol Triple-DES is secure in practice barring some caveats (don't encrypt more than a certain amount of data)

I'd wager if I gave you a real world message encrypted with AES with a strong key it won't be broken in our lifetimes.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#104

Post by withinboredom »

tingletech wrote: post #63
mprime1 wrote: post #30

Earlier quoted context omitted.

Interesting, thanks for saying something. I'm also not a web dev, but I think I can manage to clear out the password once the secret is decrypted successfully.

or use ? But then one can't read the password as one types.

Change it to text on focus, password on blur. It will still be in the history though… clearing it on submit makes the most sense.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#105

Post by mprime1 »

d4a wrote: post #67

I made something similar a few years back when I was learning web dev. It's not nearly as polished, but I'd love to pick apart your code and see what design decisions we did similarly/differently https://9p4.github.io/hackna/ The big difference is that your project is self-contained in an HTML file, which I think is a much better design

Cool! Added a link to your project

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#106

Post by isitthough42 »

vorpalhex wrote: post #56
ortusdux wrote: post #2

"Do you think this cannot possibly be secure? Great, prove it. This secret contains the recovery key for a Bitcoin wallet. Crack it and take my money!" Love it.

This is a smart use of crypto too. The verifiable and public parts of crypto here are a benefit and not a con.

If someone tells you:

    This secret image contains a Bitcoin wallet recovery key
    If you can crack the secret, the funds are yours!

    You can check the status of the wallet here: 
    https://www.blockchain.com/explorer/addresses/btc/1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa
Now here's the secret:

    0002146273a3774b3828effff3382000someGarbageSecretThatsActuallyIs{https://youtu.be/eBGIQ7ZuuiU}EnctyptedUsingARandom4096BitStringAsPassword
Which "verifiable and public" part helped?

- Anyone can point to a random link on blockchain.com

- the encrypted secret can contain anything

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#107

Post by createdapril24 »

admax88qqq wrote: post #103
createdapril24 wrote: post #87

This has some desirable security properties, but I would like to see more analysis on the security side (not just: is secure or is not secure). Passwords: - Easy to memorize. Pro: Does not rely on a device, can be recovered if devices stolen. - Easy to phish. Con: Attacker can use a look-a-like page, click-jacking, and pixel extraction (frame stealing) attacks to get password & secret. - Easy to brute force. Con: Rel…

> Con: Eventually the secrets will become exposed due to advances in crypt-analysis You can claim this con for literally any crypto. And I'm not actually sure it's a reasonable assumption. Block ciphers seem to be pretty unbreakable so far. Even good ol Triple-DES is secure in practice barring some caveats (don't encrypt more than a certain amount of data) I'd wager if I gave you a real world message encrypted with A…

That's a good point, I wasn't very specific about this (trying to keep it concise). To be specific here, the con is that there isn't what the industry calls Cryptographic Agility. https://en.wikipedia.org/wiki/Cryptographic_agility.

It is not true this con applies to all cryptography (e.g. look at TLS). It has more to do with how cryptography is configured, parameters are negotiated and keys are managed, than with point-in-time choices about algorithms. The con here is that unlike other deployments of cryptography, this one doesn't have parameter negotiation and key management - and therefore doesn't have cryptographic agility.

Re: "I'd wager that... AES..." is a also a good point. Modern cryptography has shown to be robust for decades and past their deprecation point. However, as you said, it IS a wager. There have been catastrophic failures of cryptographic primitives in the past. The con of this system is you will need to make a wager and tie yourself to the fate - you can't mitigate the risk if the catastrophic event comes or appears to be coming to pass.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#108

Post by tomjen3 »

clarge1120 wrote: post #52

Cyphers, the algorithms used to encrypt the secret file, become obsolete over time. We still need to solve for obsolescence. You can encrypt a file today using a cypher that will eventually be removed from all browsers, desktops, and phones.

The code uses AES. Likely that will remain for longer than most secrets are relevant.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#109

Post by tharkun__ »

mprime1 wrote: post #18
gregwebs wrote: post #14

This is password protected, so then an attacker must crack the password. The author exchanges the password over a phone call, which requires the password to be relatively weak, meaning the password is probably crackable. Exchanging the password via a second channel that the other user can copy and paste a more difficult password from to decyrpt the document might be more secure. The password may be more exposed, but…

This is not meant as a solution. It's a demo of a self-contained, self-extracting, portable encrypted file. That said, the password strength and the strength of the side-channel to transmit it depend on your use case. If we were friends for example, I may not need to send you a password at all. I could just add some secret questions we both know in the hint. Or, at the opposite side of the spectrum, I could send you…

Challenge: make it possible to use something like Diffie Hellman[0] to exchange a key securely even over an unsecure channel but where they resulting key is actually the password to type in and "reads" like https://xkcd.com/936/ i.e. something my grandma could type in. Without reducing the key space too much to be insecure ;)

[0] https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exc...

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#110

Post by throwaway0x7E6 »

createdapril24 wrote: post #87

This has some desirable security properties, but I would like to see more analysis on the security side (not just: is secure or is not secure). Passwords: - Easy to memorize. Pro: Does not rely on a device, can be recovered if devices stolen. - Easy to phish. Con: Attacker can use a look-a-like page, click-jacking, and pixel extraction (frame stealing) attacks to get password & secret. - Easy to brute force. Con: Rel…

> Con: Any issue (there have been many) in WebCrypto implementation at time of encryption can not be fixed by browser upgrade (because of secret caching).

has there ever been an issue that made WebCrypto produce invalid ciphertexts/hashes/PBKDF output?

Post reply on HN