Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Portable Secret – How I store my secrets and communicate privately

mprimi.github.io

Post reply on HN
Print view View original

271–280 of 385 posts

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#271

Post by cakoose »

ortusdux wrote: post #2

"Do you think this cannot possibly be secure? Great, prove it. This secret contains the recovery key for a Bitcoin wallet. Crack it and take my money!" Love it.

Offering a bounty like this has value, but probably only for finding shallow bugs.

Thoroughly evaluating security/cryptography takes deep expertise and a lot of time. You're not going to elicit that without more money, impact/fame, or technical excellence.

- Money: The original bounty was $400. An expert can probably earn $400 an hour just to investigate something, without needing to completely break it.

- Impact/fame: Barely anyone uses this project. There are tons of other tools and services that are more widely used.

- Technical excellence: There's no evidence of anything clever or interesting.

For example, researchers around the world spend tons of effort analyzing the algorithms in the various NIST cryptography competitions. There's significant impact/fame and clear evidence of technical excellence. But if some rando offers a $10k bounty for their encryption algorithm, it's not going to get the required level of scrutiny.

Plus, the bounty is just for the encryption mechanism. With security, it's usually the other moving parts that cause issues, especially in how they interact with human behavior. Phishing works without needing to break TLS, DKIM/SPF, browser sandboxing, etc.

(I read an article ~5-10 years ago by a security/crypto researcher that said basically this, but sadly I can't find it anymore.)

I still think it's great when people build things like this and when they offer any kind of bounty. I just worry that the presence of an unclaimed bounty might mislead people into overestimating the level of security.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#272

Post by maqp »

mprime1 wrote: post #144
sesm wrote: post #137

So, a self-extracting password-protected archive made portable via web browser APIs?

Yes, that's one way to put it. p.s. don't use password protected archives: https://security.stackexchange.com/questions/35818/are-passw...

How about you explain the problem with password protected archives and explain how you solved it, instead of linking to something and seeing if it sticks.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#274

Post by j1elo »

The limitation of just 1 file is technical or just for simplicity? I can think of the use case of ID photos where the same single html file contains both sides of the ID, or multiple parts of a more complex document, etc... Having to input the password repeatedly over a multitude of related html files would get cumbersome pretty soon.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#275

Post by calebm »

Shameless plug: http://hypervault.github.io. Hypervault is a single HTML file (with no external dependencies) which allows you to encrypt files, and it outputs a single html file (with no external dependencies) with a copy of the hypervault decryption software packaged together with your encrypted data. To unlock a hyper vault, all that is needed is the encryption password (entered at creation time).

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#276

Post by dgl »

distcs wrote: post #178
httpz wrote: post #131

If anyone is actually going to use this for their top secrets, I can find two things to be aware of. * When you decrypt then close the tab and open the tab again via the recently closed tab, the password is still there. * Browser extensions could read the contents of the webpage. So if anyone is going to use this, they should do it in a "clean" incognito browser without any extensions.

For me the biggest problem with a setup like this is complete loss of access to my secrets. The crypto functions supported by browsers may change in future. A cipher algorithm used to encrypt my secrets may get deprecated and removed by the browser in future. Then I will be left with a bunch of HTML files with data that the browsers cannot decrypt anymore. GPG or vim -x might be much better choices for secrets that n…

GPG for sure, be very careful with "vim -x" as that's the only implementation of that encryption scheme, not supported in neovim anymore (and I've found security issues in it: https://dgl.cx/2014/10/vim-blowfish, "blowfish2" is just ok, but it's frankly still there to not break people's workflow, I would think very carefully before using it).

Annoyingly this technique uses AES-GCM (which is good!) but OpenSSL's command line tool can't cope with it: https://github.com/openssl/openssl/issues/12220

It would be nice to have a command line tool to extract these files too, then you know the implementation is correct. (Blowing my own trumpet but my very old project https://paste.sh does this.)

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#277

Post by whartung »

j1elo wrote: post #274

The limitation of just 1 file is technical or just for simplicity? I can think of the use case of ID photos where the same single html file contains both sides of the ID, or multiple parts of a more complex document, etc... Having to input the password repeatedly over a multitude of related html files would get cumbersome pretty soon.

You can embed the images into an html page as data urls, then save the HTML file.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#278

Post by ninkendo »

ivalm wrote: post #179
ninkendo wrote: post #100

Earlier quoted context omitted.

I hate that I’m saying this because I believe all of cryptocurrency to be a pyramid scheme, but… this is the perfect use case for a smart contract on ethereum… (Now I gotta go wash my hands after typing this.)

why would a smart contract help though? there needs to be proof that the encrypted key is valid, this would require zero knowledge proof but I'm not sure how you can do it for this use case.

He could post a secret in the decrypted text on the page that, once submitted to the chain, fulfills the contract and transfers the ETH. I know very little about smart contracts but I thought this is what they’re good at… “if a value is posted with a sha512 hash that matches x, the contract is fulfilled”, and put the value on the page, encrypted, and ask hackers to decrypt it.

It doesn’t necessarily prove that the encrypted key is valid, but it proves that the author put some money up on the chain at least. It could always be that the decrypted text doesn’t provide the key that fulfills the contract, but ultimately that isn’t a solvable problem. You can’t prove a claim about some encrypted text without someone having the ability to decrypt it.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#279

Post by solarkraft »

distcs wrote: post #178
httpz wrote: post #131

If anyone is actually going to use this for their top secrets, I can find two things to be aware of. * When you decrypt then close the tab and open the tab again via the recently closed tab, the password is still there. * Browser extensions could read the contents of the webpage. So if anyone is going to use this, they should do it in a "clean" incognito browser without any extensions.

For me the biggest problem with a setup like this is complete loss of access to my secrets. The crypto functions supported by browsers may change in future. A cipher algorithm used to encrypt my secrets may get deprecated and removed by the browser in future. Then I will be left with a bunch of HTML files with data that the browsers cannot decrypt anymore. GPG or vim -x might be much better choices for secrets that n…

The web is probably among the best platforms you can bet on. Browsers are super slow to deprecate/remove APIs and it'll be pretty easy to install a browser from today in 20 years.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#280

Post by mprime1 »

maqp wrote: post #269
divyekapoor wrote: post #254

Earlier quoted context omitted.

Hate to be that guy that ruins your security researcher dreams. Your Argon2 memory hard function is useful against mass surveillance and belongs in mass market products. Let's leave it there. Despite your protests, for an average joe who just wants to stash a secret somewhere and not have it in plaintext, this is absolutely ok.

There is no reason not to use Argon2 in place of weaker alternative, especially when there's no UX overhead. The threat model "for an average Joe who just wants to stash a secret somewhere and not have it in plaintext" should probably be written in red, font size 48. But take a look what the author is actually saying it can be used for, i.e. to "securely store passwords". The currently available tools like KeepassXC…

Author here.

Thank you for mentioning Argon2, I didn't know about it. https://en.wikipedia.org/wiki/Argon2

> There is no reason not to use Argon2

In this case, the reason for not using Argon2 is that it's not available: https://www.w3.org/TR/WebCryptoAPI/

> Well if this product isn't for mass-market

This is a demo for self-contained HTML encrypted secrets. Do with it what you want. Definitely not a product in the current format.

Post reply on HN