Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Portable Secret – How I store my secrets and communicate privately

mprimi.github.io

Post reply on HN
Print view View original

211–220 of 385 posts

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#211

Post by pmontra »

distcs wrote: post #178
httpz wrote: post #131

If anyone is actually going to use this for their top secrets, I can find two things to be aware of. * When you decrypt then close the tab and open the tab again via the recently closed tab, the password is still there. * Browser extensions could read the contents of the webpage. So if anyone is going to use this, they should do it in a "clean" incognito browser without any extensions.

For me the biggest problem with a setup like this is complete loss of access to my secrets. The crypto functions supported by browsers may change in future. A cipher algorithm used to encrypt my secrets may get deprecated and removed by the browser in future. Then I will be left with a bunch of HTML files with data that the browsers cannot decrypt anymore. GPG or vim -x might be much better choices for secrets that n…

You encrypt them again with the newer algorithm?

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#212

Post by nashashmi »

stickfigure wrote: post #155
nashashmi wrote: post #125

Earlier quoted context omitted.

He also ended up leaving the company after it was learned he was guilty of a previous felony for identity fraud.

Do you have a reference for this? The internet doesn't seem to know anything about it. I suspect it is false.

https://www.phoenixnewtimes.com/news/lifelock-former-exec-an...

Apparently it was the other cofounder. I confused the two.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#213

Post by layer8 »

miketery wrote: post #171
httpz wrote: post #131

If anyone is actually going to use this for their top secrets, I can find two things to be aware of. * When you decrypt then close the tab and open the tab again via the recently closed tab, the password is still there. * Browser extensions could read the contents of the webpage. So if anyone is going to use this, they should do it in a "clean" incognito browser without any extensions.

Aside q - can extensions access local storage for a specific domain?

They can when you visit that domain, and they can make you visit the domain, so I guess yes.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#214

Post by mprime1 »

TacticalCoder wrote: post #166

> Send encrypted messages/images/files over insecure channels (email, messaging, …) I don't understand. Sure you sent these over an insecure channel and they end up... Being opened from a website, in a browser which downloaded JavaScript (JavaScript which may or may not be the same you downloaded yesterday when you used that same site btw)? And we all know that browsers running unverifiable JavaScript from some Websi…

A 'portable secret' is a self-contained HTML file. You can open and decrypt it without an internet connection. This is I think one misunderstanding.

The second one is that you can open the file in an editor and verify what it does before trying to decrypt.

Any modern browser also has protections that prevent a random HTML file from acting like a virus (stealing and uploading files).

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#215

Post by mprime1 »

TacticalCoder wrote: post #166

> Send encrypted messages/images/files over insecure channels (email, messaging, …) I don't understand. Sure you sent these over an insecure channel and they end up... Being opened from a website, in a browser which downloaded JavaScript (JavaScript which may or may not be the same you downloaded yesterday when you used that same site btw)? And we all know that browsers running unverifiable JavaScript from some Websi…

"Do you think this cannot possibly be secure? Great, prove it. This secret contains the recovery key for a Bitcoin wallet. Crack it and take my money!". I'm sorry but that's not how security works.

That's not how security works, but that's how a bounty works. If you can do ___, then you get ___. That's it.

If it's any consolation, I sent this project to (security professional) colleagues in the past to get their take on it. This is also not how security works, but to me is better than nothing.

Remember this is not a product. I don't care if you use it. I'm just sharing my hack for carrying secrets around without needing a special device or key.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#216

Post by SpeedilyDamage »

mprime1 wrote: post #54
SpeedilyDamage wrote: post #32

Why not use any of a bunch of other services? Surely you can't think your threat model allows for this but not 1pass?

It's not a service. It's a simple hack and I use it for 3-4 use cases for which no service exists. Among other things: - It works offline - My mom can use it - It works on any device (even a borrowed one or a newly formatted one) - It can save me if *all* my devices get stolen - It can save me if I'm stranded in a foreign country without any document or trusted devices, - Etc.

I get that, but why not use a service, instead of this manual process?

1pass literally can solve every single one of these problems.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#217

Post by [deleted] »

leokennis wrote: post #197
xvinci wrote: post #176

Can anyone enlighten me on Some secrets don’t belong in your password manager. Things like backup private keys, 2FS recovery keys, wallet keys, safe combinations, treasure maps, etc. I am a 1password user and am aware that I am trusting a 3rd party with most of my life basically (minus the 2FA, my phone), but that's the way I decided for convenience. But why would I keep passwords in there but not PKs, wallet keys et…

Honestly that statement sounds like BS to me. Also, this person is trusting his life to a third party as well: the browser vendors’ cryptography implementation. I think for an average person, the biggest factor is not the strength of the security. You’re already better than 99% of people if you use different passwords per site and store them behind a password. No hacker will spend weeks cracking your passwords if he…

[deleted]

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#218

Post by layer8 »

ksbrooksjr wrote: post #194

It looks like the plaintext is being padded so that its length is a multiple of the block size [1]. I can't find any resources that say you need to pad a message before encrypting it with AES-GCM though. The official examples from MDN [2][3] don't pad the message before encrypting. The source code links to a wikipedia article that states that padding isn't necessary for counter mode, which the code is using (GCM is G…

GCM doesn’t require padding (the calculation implicitly pads internally), unless you want to hide the length of the plaintext, as the resulting ciphertext will have the same length.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#219

Post by mprime1 »

leokennis wrote: post #197
xvinci wrote: post #176

Can anyone enlighten me on Some secrets don’t belong in your password manager. Things like backup private keys, 2FS recovery keys, wallet keys, safe combinations, treasure maps, etc. I am a 1password user and am aware that I am trusting a 3rd party with most of my life basically (minus the 2FA, my phone), but that's the way I decided for convenience. But why would I keep passwords in there but not PKs, wallet keys et…

Honestly that statement sounds like BS to me. Also, this person is trusting his life to a third party as well: the browser vendors’ cryptography implementation. I think for an average person, the biggest factor is not the strength of the security. You’re already better than 99% of people if you use different passwords per site and store them behind a password. No hacker will spend weeks cracking your passwords if he…

Author here.

I do use a password manager.

PortableSecret is a complement, not a replacement.

e.g. where do you store the recovery key for your password manager?

I also use this to store tax documents and other mildly secret documents which definitely don't belong in a password manager that copies to who-knows-where-and-in-how-many-copies.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#220

Post by motohagiography »

The value in this may be in tokenizing data for privacy in web applications. An example would be medical test results, where you are the lab and to meet privacy requirements, you don't want to show them to every party involved in processing and billing, but the blob has to be stored and transmitted to the patient and their physician.

The secret/key management part is just an OOB secret, and provided it's in the form of a long passphrase, it should be sufficient, and doesn't rely on patients and regular people doing key management or maintaining keypairs. You just send them the passphrase in the physical mail or some other channel. If they lose it, you just generate another token blob with a new passphrase, etc.

That use case may be declining as privacy rules have been gutted lately, but WebCrypto could facilitate some interesting new protocols for a variety of cases.

Post reply on HN