Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Portable Secret – How I store my secrets and communicate privately

mprimi.github.io

Post reply on HN
Print view View original

181–190 of 385 posts

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#181

Post by forgotpw2726 »

mprime1 wrote: post #157
forgotpw2726 wrote: post #96

I've been thinking about something similar, it really should be much easier to send encrypted messages. I'm not sure if this is a problem, but one thing that is unclear to me is how/if this protects against an adversary that can modify the html file. If the adversary can modify the HTML file in transit they can just add some code that sends the password to the adversary's server when the real recipient opens the file…

Phishing is indeed the most glaring vulnerability of this. While it's very real in theory, I am not concerned in practice. If I am the target of a sophisticated attacker, there are easier and more effective ways to pwn me. A few other comments reference the same, e.g.: https://news.ycombinator.com/item?id=34085245

Fair enough, I guess in many ways I agree that at least for now it is not a real world problem. But if this would become popular it wouldn't be that hard to make a proxy that silently adds some code to the page if you fetch it over the internet.

Maybe it would be good to document this a bit more clearly that this mainly protects against weak adversaries. On the website you make some comparisons to GPG etc, which is a very different level of protection from my understanding, and may give a false sense of security.

I think I would prefer an approach where each person has their own html file, and then they can copy-paste the message into a text box and then decrypt it. Then you could also use public-key cryptography etc, and store a (encrypted) private-key in the html file itself. Like a light-weight GPG client in a single static html page. I guess the main feature that I don't see how to add is how to store and keep track of the public keys for your friends in a nice way.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#182

Post by afiori »

TacticalCoder wrote: post #166

> Send encrypted messages/images/files over insecure channels (email, messaging, …) I don't understand. Sure you sent these over an insecure channel and they end up... Being opened from a website, in a browser which downloaded JavaScript (JavaScript which may or may not be the same you downloaded yesterday when you used that same site btw)? And we all know that browsers running unverifiable JavaScript from some Websi…

The javascript is embedded in the HTML

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#183

Post by NKosmatos »

Wow, that's a neat idea and a very good execution. If only it didn't had to "...Some Javascript that calls into the browser’s Web Cryptography APIs" and had all the code inside the HTML that would be great. Completely self-sufficient and offline, without dependency to the browser(s).

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#184

Post by def_true_false »

TacticalCoder wrote: post #166

> Send encrypted messages/images/files over insecure channels (email, messaging, …) I don't understand. Sure you sent these over an insecure channel and they end up... Being opened from a website, in a browser which downloaded JavaScript (JavaScript which may or may not be the same you downloaded yesterday when you used that same site btw)? And we all know that browsers running unverifiable JavaScript from some Websi…

There is no magic in JS that makes something insecure simply by using JS. Unverifiable? If it's not minified you could literally just right click and read it before typing in your secret.

Similarly, there is no magic dust in a live CD that makes you immune to security issues when running it.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#186

Post by TedDoesntTalk »

bryanlarsen wrote: post #158
TedDoesntTalk wrote: post #121

Earlier quoted context omitted.

If you want to avoid wordlist vulnerabilities, try this: Choose a lyric from a favorite song. Concatenate the first letter of each word in the lyric. Example: “Rock the Casbah Sharif don't like it” Becomes: rtcsdli Add capitalization or numbers/special characters according to your own pref. For example, maybe your decide to alternate lower and upper case and always end with a bang: rTcSdLi! Although you have to use t…

That is security by obscurity. If somebody knows your method, they can scrape the lyrics for all popular songs, narrow your password down to a few million possible passwords and just try them all.

> to a few million possible passwords

The combinations are easily in the trillions, likely much much more. Read the algorithm.

An algorithm for password generation is not security by obscurity.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#187

Post by ricardobeat »

TedDoesntTalk wrote: post #115
aporetics wrote: post #78

Earlier quoted context omitted.

This used to be called munging

It’s called minification in the JavaScript ecosystem.

Minification may, or may not, involve munging, for example shortening `const foobar = 1;` into `var f = 1;`. This is not always a safe operation, and in some cases you want to disable munging when minifying your code so that you have meaningful component / function names in your stack traces even without sourcemaps.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#188

Post by mszcz »

neilk wrote: post #156

This is an ingenious idea, one that becomes obvious only in retrospect. To me this feels like a merger of the ideas in projects like magic-wormhole, Wormhole.app, and the (defunct) Mozilla Send. But then it adds a kind of sharchive twist using the browser as a runtime. The original paper I saw called it Password Authenticated Key Exchange. https://www.cs.columbia.edu/~smb/papers/neke.pdf But I think the general form…

Didn't older versions of 1Password allow export to HTML page that contained all the passwords and did decryption by JS embedded in the page itself upon entering the master password? IIRC.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#190

Post by hamburglar »

distcs wrote: post #178
httpz wrote: post #131

If anyone is actually going to use this for their top secrets, I can find two things to be aware of. * When you decrypt then close the tab and open the tab again via the recently closed tab, the password is still there. * Browser extensions could read the contents of the webpage. So if anyone is going to use this, they should do it in a "clean" incognito browser without any extensions.

For me the biggest problem with a setup like this is complete loss of access to my secrets. The crypto functions supported by browsers may change in future. A cipher algorithm used to encrypt my secrets may get deprecated and removed by the browser in future. Then I will be left with a bunch of HTML files with data that the browsers cannot decrypt anymore. GPG or vim -x might be much better choices for secrets that n…

A neat feature of this would be to have the source of the html include instructions for decrypting the data outside the browser using command line tools for just this scenario.
Post reply on HN