Show HN: Portable Secret – How I store my secrets and communicate privately • Hacker News Board

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#231

Post by pritambaral » Wed, Dec 21, 2022, 9:53 PM UTC

z3t4 wrote: post #221

mprime1 wrote: post #199

Earlier quoted context omitted.

By "long sequence of words that are trivial for me to remember" I meant concatenation of secret questions, like in the bounty example: https://mprimi.github.io/portable-secret/examples/bounty.htm... Unless I hit my head really hard, there's zero chance I will forget this passphrase.

Keys should be random. The hints make it too easy. Lets say there exist 100 male names and 100 female names, thats just 100*100 combinations for names part. You could make the key generation intentionally slow though to limit the crack speed.

> You could make the key generation intentionally slow though to limit the crack speed.

Am attacker keen enough to bruteforce can easily copy the ciphertext, IV, and salt to a tool that doesn't have a slowdown. Or, just modify the JS to remove the artificial slowdown.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#232

Post by mprime1 » Wed, Dec 21, 2022, 9:54 PM UTC

cwoolfe wrote: post #185

What is the limit on file size? Trying to encrypt a 100MB file made it crash.

Data URLs have a limit, but from what I read online it is browser and platform specific.

But before you hit that limit, your browser may kill the tab because it looks like it's using too many resources. Again hardware/browser/platform specific.

All in all, I'm glad this cannot be used as-is for pirate movies. That would have kept me from releasing it.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#233

Post by robertlf » Wed, Dec 21, 2022, 9:55 PM UTC

Why would I use this? I don't know this guy from Adam. (laughing)

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#234

Post by mprime1 » Wed, Dec 21, 2022, 9:56 PM UTC

NKosmatos wrote: post #183

Wow, that's a neat idea and a very good execution. If only it didn't had to "...Some Javascript that calls into the browser’s Web Cryptography APIs" and had all the code inside the HTML that would be great. Completely self-sufficient and offline, without dependency to the browser(s).

The HTML is self contained and works offline.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#235

Post by AgentME » Wed, Dec 21, 2022, 9:56 PM UTC

distcs wrote: post #178

httpz wrote: post #131

If anyone is actually going to use this for their top secrets, I can find two things to be aware of. * When you decrypt then close the tab and open the tab again via the recently closed tab, the password is still there. * Browser extensions could read the contents of the webpage. So if anyone is going to use this, they should do it in a "clean" incognito browser without any extensions.

For me the biggest problem with a setup like this is complete loss of access to my secrets. The crypto functions supported by browsers may change in future. A cipher algorithm used to encrypt my secrets may get deprecated and removed by the browser in future. Then I will be left with a bunch of HTML files with data that the browsers cannot decrypt anymore. GPG or vim -x might be much better choices for secrets that n…

Standardized web APIs are very rarely removed. Backwards compatibility is a huge priority for web APIs, and cases where they're broken are rare. It's very hard for me to even think of a web API like this that browsers have ever made incompatible changes to.

The parts of the web that get incompatible changes are generally stuff like nonstandard plugins (Flash being discontinued) and TLS (which isn't relevant if you're keeping some HTML file saved locally). Browsers bend over backwards to keep existing HTML/JS content working.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#236

Post by preillyme » Wed, Dec 21, 2022, 9:56 PM UTC

Interesting... on 2022-12-13 the bounty has been claimed! Just a few hours after mprime1 shared the project in a comment on HackerNews, someone managed to drain the BTC.

https://github.com/mprimi/portable-secret/commit/3b22d2b42ba...

I'd love to hear more about this.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#237

Post by throwaway0x7E6 » Wed, Dec 21, 2022, 9:58 PM UTC

mprime1 wrote: post #26

throwaway0x7E6 wrote: post #17

Earlier quoted context omitted.

for local files as well?

Yes. If that wasn't the case, then "HTML virus" would be a thing: I send you an HTML file and, if you open it, it read files from your hard drive and uploads them to my server.

I should have clarified - I mean I was wondering if any browsers block fetch to remote URLs from local files

I do vaguely recall encountering some problem I didn't expect when I was making a tool contained in a local html file, but I dont remember which browser I was using at the time

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#238

Post by mprime1 » Wed, Dec 21, 2022, 9:59 PM UTC

kfrzcode wrote: post #169

> It’s portable because: decrypting these secrets does not require special software! All you need is a browser. No complex, million+ SLOC codebases to install, except the one browser. I'll stick with gpg signing my pass repo and call it a day.

To be clear: I use gpg too.

But I can't expect my mom or girlfriend to learn how to use it.

With PortableSecret I can communicate privately with them, without installing or learning anything new.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#239

Post by matthewfcarlson » Wed, Dec 21, 2022, 10:01 PM UTC

preillyme wrote: post #236

Interesting... on 2022-12-13 the bounty has been claimed! Just a few hours after mprime1 shared the project in a comment on HackerNews, someone managed to drain the BTC. https://github.com/mprimi/portable-secret/commit/3b22d2b42ba... I'd love to hear more about this.

Right I'd love a post-mortem on it!

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#240

Post by nannal » Wed, Dec 21, 2022, 10:03 PM UTC

eternalban wrote: post #140

europeanguy wrote: post #120

Earlier quoted context omitted.

Yes, using a crypto algorithm also counts as rolling your own crypto. You're putting together crypto libs that others wrote. Most crypto vulnerabilities come from glueing together solid crypto implementations. The glueing has to be solid too. Just "using" a crypto algorithm sounds like a recipe for a vulnerability. I'm not a crypto expert, I'm just telling you what I've been reading on HN for the past few years.

[flagged]

Using the output of a language model like mine as a comment reply on a forum like HN could potentially have a negative impact on the discourse in a number of ways.

1. It could undermine the authenticity and integrity of the conversation by introducing responses that are not genuinely from a human.

2. It could create confusion or misunderstanding, as the responses generated by the language model may not be relevant or appropriate for the specific context in which they are used.

3. It could discourage genuine participation and contribution from other members of the community, as it may seem like the conversation is being dominated by automated responses rather than authentic human interaction.

Overall, it is important to consider the impact of your actions on the online community and to strive to contribute to respectful and meaningful discourse. Using the output of a language model as a substitute for genuine human interaction is generally not a good idea, as it can undermine the authenticity and integrity of the conversation.