Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Portable Secret – How I store my secrets and communicate privately

mprimi.github.io

Post reply on HN
Print view View original

201–210 of 385 posts

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#201

Post by RektBoy »

ithrow wrote: post #192
distcs wrote: post #178

Earlier quoted context omitted.

For me the biggest problem with a setup like this is complete loss of access to my secrets. The crypto functions supported by browsers may change in future. A cipher algorithm used to encrypt my secrets may get deprecated and removed by the browser in future. Then I will be left with a bunch of HTML files with data that the browsers cannot decrypt anymore. GPG or vim -x might be much better choices for secrets that n…

Just download an older version of the browser?

Ok so in similar manner. Please download Microsoft Silverlight now, only from official MS source. No other source is allowed. Go.

Funny thing, here in EU country, there are government apps which stills require MS Silverlight. Nice right?

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#202

Post by mprime1 »

_tk_ wrote: post #146

I'm a security professional and this looks like a great tool for OP's use case, especially with strong passwords and great password hints. I think your secrets are well stored - unless your mother stores the password to these files insecurely, a problem that is not new to this solution. This also applies to most if not all challenges mentioned by other posters. Take phishing for example, at the moment all methods to…

Thank you for the insightful comments.

Not looking for users TBH. :-)

re: bug in the vendor implementation of cryptography. Doesn't this apply to everything you encrypt?

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#203

Post by mprime1 »

pwg wrote: post #168
mprime1 wrote: post #116

Earlier quoted context omitted.

Thank you for the comment and thoughts. Agree with most, disagree with some (easy to brute-force?), but I wanted to comment on this in particular: > Easy to phish. Con: Attacker can use a look-a-like page, click-jacking, and pixel extraction (frame stealing) attacks to get password & secret This to me is the most glaring "vulnerability". i.e. I use this to exchange letters with my friend Bob. Now someone impersonates…

The GP comment about "easy to brute force" must be read in context with the remainder of the comment about "easy to brute force": "Relies on human adherence to password best practices to maintain sufficient entropy. Learning from industry that this does not work in widespread adoption" The GP's statement can be boiled down to: "users will choose poor passwords" (as in Password1!) because it has been shown time and ag…

Right, agree with all of that. I would have characterized as "user can shoot themselves on the foot (i.e. by choosing weak password)", rather than "easy to bruteforce"

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#205

Post by ccorcos »

I created something similar to this [1] a few years ago. Before the proliferation of web crypto apis, I just used a WASM’d libsodium. It adds some page weight but whatever…

My use-case was for traveling, it seems like a good idea to have a backup photo of my passport and credit card in case I loose everything. Sure I could put it on Dropbox, but do I really want to log in to my entire Dropbox on someone else’s machine?

Ironically, it has yet to be useful. Just a fun project inspired by the realization that you can base64 just about anything in an HTML document.

1: https://github.com/ccorcos/encrypted-html-vault

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#207

Post by layer8 »

distcs wrote: post #178
httpz wrote: post #131

If anyone is actually going to use this for their top secrets, I can find two things to be aware of. * When you decrypt then close the tab and open the tab again via the recently closed tab, the password is still there. * Browser extensions could read the contents of the webpage. So if anyone is going to use this, they should do it in a "clean" incognito browser without any extensions.

For me the biggest problem with a setup like this is complete loss of access to my secrets. The crypto functions supported by browsers may change in future. A cipher algorithm used to encrypt my secrets may get deprecated and removed by the browser in future. Then I will be left with a bunch of HTML files with data that the browsers cannot decrypt anymore. GPG or vim -x might be much better choices for secrets that n…

The algorithms are well-documented and not difficult to implement (for the purpose of decrypting). The only real risk I would see is for a post-apocalyptic future when that knowledge has somehow become lost or inaccessible. And that’s assuming that any of the secrets would still be relevant then.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#208

Post by mprime1 »

ynniv wrote: post #139

Using browser crypto to create a document is the right thing to do, but you might want a JavaScript decryption library to improve portability and lifespan. I would check that it’s capable of decrypting the payload when you’re making a document. (Possibly https://github.com/travist/jsencrypt ) The obvious weakness is your hosted document creator: it’s essentially impossible to defend an HTML document against a malicio…

> might want a JavaScript decryption library to improve portability and lifespan

How does a library improve portability and lifespan? I'm only using NIST-recommended encryption algorithms provided by W3C Crypto APIs.

> The obvious weakness is your hosted document creator: it’s essentially impossible to defend an HTML document against a malicious domain. We can look at your GitHub repo, but there’s no guarantee that’s the exact code that’s running.

I agree. As clearly stated in various places, this is a demo. Take the idea and fork/re-implement it for yourself.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#209

Post by simlevesque »

layer8 wrote: post #204

> I keep a copy of my passport encrypted on the internet. What use is the picture of your passport? It would be easy to fake.

It saves a bit of time for your embassy if you need a new passport urgently in another country.

> Safeguard Your Documents! Make two copies of all your travel documents in case of emergency. Leave one copy with a trusted friend or relative at home and carry the other separately from your original documents. To help prevent theft, do not carry your passport in your back pocket, and keep it separate from your money.

https://travel.state.gov/content/travel/en/international-tra...

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#210

Post by pyinstallwoes »

RektBoy wrote: post #201
ithrow wrote: post #192

Earlier quoted context omitted.

Just download an older version of the browser?

Ok so in similar manner. Please download Microsoft Silverlight now, only from official MS source. No other source is allowed. Go. Funny thing, here in EU country, there are government apps which stills require MS Silverlight. Nice right?

To be fair that is not a browser. That's a plugin.
Post reply on HN