171–180 of 385 posts
If anyone is actually going to use this for their top secrets, I can find two things to be aware of. * When you decrypt then close the tab and open the tab again via the recently closed tab, the password is still there. * Browser extensions could read the contents of the webpage. So if anyone is going to use this, they should do it in a "clean" incognito browser without any extensions.
if it could be 'tweaked' with the following suggestions - even better
- Plausible deniability built in (with one or two passwords)
- if you enter the wrong password you do not get an error message on the unencryption, but just garbage out
Earlier quoted context omitted.
Agility does nothing to stop the "ciphertext from the past is broken due to crypto improvements". It's just a means to shorten response time to crypto breaks for _new_ traffic. This project is plenty agile, upgrading the primitive is very easy as it's not a communication protocol but a data at rest protocol. > this one doesn't have parameter negotiation and key management You're thinking in terms of live communicatio…
I really do hear what you're saying and think you're making a great point. The part that I think applies is that this is a "data at rest protocol". Communication protocols are assumed (but maybe shouldn't be - a la PRISM disclosures?) ephemeral. As an attacker, I need to have been in the middle for that specific instance of the communication, and save it for decades, to attack it. Crypto agility shortens the window f…
It's similar to criticizing an alcoholic drink by saying "this drink will cause liver damage" as opposed to saying "this drink, like all alcoholic drinks, will cause liver damage"
Without that caveat people will see that criticism as evidence that other alcoholic drinks do not cause liver damage. The absence of words can convey the wrong impression.
*Edited for better clarity.
The main problem with this is that someone uses it outside of its intended use cases, which even cultured people are missing. Jokes aside, great hack!
Definitely intended for more technical audiences, lots of sharp edges.
Earlier quoted context omitted.
this doesn't, it uses the browser's builtin Web Cryptography API. if using a crypto algorithm also counts as "rolling your own crypto" then what's left? just don't encrypt anything, ever, because HN says we shouldn't roll our own?
Yes, using a crypto algorithm also counts as rolling your own crypto. You're putting together crypto libs that others wrote. Most crypto vulnerabilities come from glueing together solid crypto implementations. The glueing has to be solid too. Just "using" a crypto algorithm sounds like a recipe for a vulnerability. I'm not a crypto expert, I'm just telling you what I've been reading on HN for the past few years.
Some secrets don’t belong in your password manager. Things like backup private keys, 2FS recovery keys, wallet keys, safe combinations, treasure maps, etc.
Can anyone enlighten me on Some secrets don’t belong in your password manager. Things like backup private keys, 2FS recovery keys, wallet keys, safe combinations, treasure maps, etc. I am a 1password user and am aware that I am trusting a 3rd party with most of my life basically (minus the 2FA, my phone), but that's the way I decided for convenience. But why would I keep passwords in there but not PKs, wallet keys et…
If anyone is actually going to use this for their top secrets, I can find two things to be aware of. * When you decrypt then close the tab and open the tab again via the recently closed tab, the password is still there. * Browser extensions could read the contents of the webpage. So if anyone is going to use this, they should do it in a "clean" incognito browser without any extensions.
GPG or vim -x might be much better choices for secrets that need to be decrypted many years from now.
Earlier quoted context omitted.
but you are not guaranteed that the decrypted key is valid.
I hate that I’m saying this because I believe all of cryptocurrency to be a pyramid scheme, but… this is the perfect use case for a smart contract on ethereum… (Now I gotta go wash my hands after typing this.)
Cool project! This stuff is all possible thanks to the SubtleCrypto API ( https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypt... ), which became widespread in browsers in the last ~5 years. It's so great we don't have to use weird libraries (some with pretty gnarly side channel leakage) to do cryptography anymore. It wouldn't be that crazy for the browser to do the encryption part for me, right? Like, what i…