Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Portable Secret – How I store my secrets and communicate privately

mprimi.github.io

Post reply on HN
Print view View original

241–250 of 385 posts

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#241

Post by mprime1 »

mszcz wrote: post #188
neilk wrote: post #156

This is an ingenious idea, one that becomes obvious only in retrospect. To me this feels like a merger of the ideas in projects like magic-wormhole, Wormhole.app, and the (defunct) Mozilla Send. But then it adds a kind of sharchive twist using the browser as a runtime. The original paper I saw called it Password Authenticated Key Exchange. https://www.cs.columbia.edu/~smb/papers/neke.pdf But I think the general form…

Didn't older versions of 1Password allow export to HTML page that contained all the passwords and did decryption by JS embedded in the page itself upon entering the master password? IIRC.

Someone else commented the same, you are not crazy

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#242

Post by mprime1 »

_tk_ wrote: post #164
neilk wrote: post #156

This is an ingenious idea, one that becomes obvious only in retrospect. To me this feels like a merger of the ideas in projects like magic-wormhole, Wormhole.app, and the (defunct) Mozilla Send. But then it adds a kind of sharchive twist using the browser as a runtime. The original paper I saw called it Password Authenticated Key Exchange. https://www.cs.columbia.edu/~smb/papers/neke.pdf But I think the general form…

You could also think of it like an encrypted zip file send from one party to another.

Except this is secure :-)

https://security.stackexchange.com/questions/35818/are-passw...

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#243

Post by mprime1 »

neilk wrote: post #156

This is an ingenious idea, one that becomes obvious only in retrospect. To me this feels like a merger of the ideas in projects like magic-wormhole, Wormhole.app, and the (defunct) Mozilla Send. But then it adds a kind of sharchive twist using the browser as a runtime. The original paper I saw called it Password Authenticated Key Exchange. https://www.cs.columbia.edu/~smb/papers/neke.pdf But I think the general form…

> This is an ingenious idea, one that becomes obvious only in retrospect.

Thank you.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#244

Post by sfusato »

preillyme wrote: post #236

Interesting... on 2022-12-13 the bounty has been claimed! Just a few hours after mprime1 shared the project in a comment on HackerNews, someone managed to drain the BTC. https://github.com/mprimi/portable-secret/commit/3b22d2b42ba... I'd love to hear more about this.

See https://news.ycombinator.com/item?id=33980379

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#245

Post by wnevets »

preillyme wrote: post #236

Interesting... on 2022-12-13 the bounty has been claimed! Just a few hours after mprime1 shared the project in a comment on HackerNews, someone managed to drain the BTC. https://github.com/mprimi/portable-secret/commit/3b22d2b42ba... I'd love to hear more about this.

I don't see any code changes in the commit history after that.

edit: oh, it looks like it wasn't actually drained.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#246

Post by preillyme »

sfusato wrote: post #244
preillyme wrote: post #236

Interesting... on 2022-12-13 the bounty has been claimed! Just a few hours after mprime1 shared the project in a comment on HackerNews, someone managed to drain the BTC. https://github.com/mprimi/portable-secret/commit/3b22d2b42ba... I'd love to hear more about this.

See https://news.ycombinator.com/item?id=33980379

Ah, that makes so much more sense. I had thought after looking at the wallet: https://www.blockchain.com/btc/address/bc1qd2jkf8lxp5d3y50gf... that it was "scrambled/tumbled/anonymized" by the attacker.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#247

Post by jchanimal »

mprime1 wrote: post #202
_tk_ wrote: post #146

I'm a security professional and this looks like a great tool for OP's use case, especially with strong passwords and great password hints. I think your secrets are well stored - unless your mother stores the password to these files insecurely, a problem that is not new to this solution. This also applies to most if not all challenges mentioned by other posters. Take phishing for example, at the moment all methods to…

Thank you for the insightful comments. Not looking for users TBH. :-) re: bug in the vendor implementation of cryptography. Doesn't this apply to everything you encrypt?

I think the parent comment is talking about a defense-in-depth approach: if crypto is your only defense against a worst-level outcome, you don't have any grace if your adversary can exploit a crypto weakness. With perimeter defenses you have a little more leeway in responding to eg leaked keys or other problems. Also presumably you know who might have retrieved the encrypted data, and therefore who might be doing offline attacks against the data.

There are totally use cases where having encrypted data at publicly retrievable, even well-known URIs makes sense, but there are other use cases where you want some level of network security as well.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#248

Post by jtsiskin »

preillyme wrote: post #236

Interesting... on 2022-12-13 the bounty has been claimed! Just a few hours after mprime1 shared the project in a comment on HackerNews, someone managed to drain the BTC. https://github.com/mprimi/portable-secret/commit/3b22d2b42ba... I'd love to hear more about this.

No, they just changed it themselves? They sent from that old wallet (https://www.blockchain.com/explorer/addresses/btc/bc1qd2jkf8...) to the current wallet (https://www.blockchain.com/explorer/addresses/btc/bc1qpwq8lx...) ?

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#249

Post by leokennis »

mprime1 wrote: post #219
leokennis wrote: post #197

Earlier quoted context omitted.

Honestly that statement sounds like BS to me. Also, this person is trusting his life to a third party as well: the browser vendors’ cryptography implementation. I think for an average person, the biggest factor is not the strength of the security. You’re already better than 99% of people if you use different passwords per site and store them behind a password. No hacker will spend weeks cracking your passwords if he…

Author here. I do use a password manager. PortableSecret is a complement, not a replacement. e.g. where do you store the recovery key for your password manager? I also use this to store tax documents and other mildly secret documents which definitely don't belong in a password manager that copies to who-knows-where-and-in-how-many-copies.

So out of curiosity, what password manager do you use? And as apparently you don’t trust your password manager, why do you use one? And how do you determine what is “useless” enough to be entrusted to that password manager you do not really trust?

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#250

Post by mbwgh »

I keep putting off the decision on how to store my private keys remotely in case of disaster, and this looks like a good and very pragmatic solution. Thanks for creating this!

My first reaction was "why not a password-protected zip" and you already linked to a relevant stackexchange question. I think it might be helpful to add a "Why not a password-protected zip/rar/7zip/..." on your page when you have time for it.

Or maybe even explicitly make clear which security goals (confidentiality, integrity, etc.) are satisfied by this. The reason being of course that I would like to show this to colleagues/friends and not having to debate this myself :)

Post reply on HN