Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Portable Secret – How I store my secrets and communicate privately

mprimi.github.io

Post reply on HN
Print view View original

291–300 of 385 posts

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#291

Post by wildzzz »

_tk_ wrote: post #146

I'm a security professional and this looks like a great tool for OP's use case, especially with strong passwords and great password hints. I think your secrets are well stored - unless your mother stores the password to these files insecurely, a problem that is not new to this solution. This also applies to most if not all challenges mentioned by other posters. Take phishing for example, at the moment all methods to…

We use a very similar system at work when placing files on removable media. Normally, any files you move from a work PC to a flashdrive are encrypted and cannot be decrypted unless the drive is put into another work PC running the same security software. However there's a feature of the software that still lets you move files to off-network PCs that works just like this. Your files are encrypted like usual but you can use your own password and there's now an html file included that contains all of the necessary crypto libraries. You open the html file on the other PC, type in the password, and it decrypts it for you and can re-encrypt it if you'd like.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#292

Post by maqp »

mprime1 wrote: post #280
maqp wrote: post #269

Earlier quoted context omitted.

There is no reason not to use Argon2 in place of weaker alternative, especially when there's no UX overhead. The threat model "for an average Joe who just wants to stash a secret somewhere and not have it in plaintext" should probably be written in red, font size 48. But take a look what the author is actually saying it can be used for, i.e. to "securely store passwords". The currently available tools like KeepassXC…

Author here. Thank you for mentioning Argon2, I didn't know about it. https://en.wikipedia.org/wiki/Argon2 > There is no reason not to use Argon2 In this case, the reason for not using Argon2 is that it's not available: https://www.w3.org/TR/WebCryptoAPI/ > Well if this product isn't for mass-market This is a demo for self-contained HTML encrypted secrets. Do with it what you want. Definitely not a product in the cur…

In this case, the reason for not using Argon2 is that it's not available

Then it would naturally follow you wouldn't want to implement password-dependent security systems in JS.

I can respect the HTML file that stores an encrypted note. I just struggle in finding the use case given how files are supposed to be shared using secure platforms, and how client-side encrypted cloud and FDE take care of user's personal file confidentiality.

Perhaps you can just send a self-extracting piece and perhaps it's safe enough to deliver the password over the phone, but generally when your adversary sits in the backbone of the internet (i.e. when your default email isn't secure to begin with), you're in a world of problems. Even IF you're avoiding incidental collection, defaulting to any opportunistic E2EE like iMessage, or to any E2EE protocol that isn't authenticated is better UX-wise.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#293

Post by SgtBastard »

maqp wrote: post #264
createdapril24 wrote: post #87

This has some desirable security properties, but I would like to see more analysis on the security side (not just: is secure or is not secure). Passwords: - Easy to memorize. Pro: Does not rely on a device, can be recovered if devices stolen. - Easy to phish. Con: Attacker can use a look-a-like page, click-jacking, and pixel extraction (frame stealing) attacks to get password & secret. - Easy to brute force. Con: Rel…

>Uses current state of art algos. Pro: Resistant to access by known methods. AES-GCM is fine sure, but the password hashing function PBKDF2-HMAC-SHA1, i.e. what turns the user's weak password into the AES-key, is the opposite of state-of-the-art in this case.

Argon2-HMAC-SHA512 more like it? Or something else?

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#294

Post by TedDoesntTalk »

bryanlarsen wrote: post #285
TedDoesntTalk wrote: post #186

Earlier quoted context omitted.

> to a few million possible passwords The combinations are easily in the trillions, likely much much more. Read the algorithm. An algorithm for password generation is not security by obscurity.

10s of thousands of popular songs, dozens of lines per song. > Although you have to use the same capitalization rules for all passwords if you have any hope of remembering them. So no additional combinations from that. Your algorithm is simple and common enough that it's possible that an attacker can figure it out from a single leaked password. With one leaked password they've compromised all of your passwords to any…

You wrote Pooh songs. Not me. There are millions of songs with lyrics. Billions of lines of lyrics. Trillions of combinations that include upper and lower case. Good luck.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#295

Post by DDSDev »

This is a really cool project!

One thought that I have: would there be an issue sending this file in an unsecure context where MITM is a possibility? Alice sends Bob her HTML file over an unsecured medium, and Jane intercepts this traffic, and gives Bob a modified HTML file that will report the password back to Jane. Jane can set it up so that the browser still displays the local file as it's source, but has an HTTP request in the background phone home back to Jane's server.

My scenario only works if Bob doesn't inspect the page source before entering their password, or if the modifications are sufficiently obfuscated.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#296

Post by chlorion »

distcs wrote: post #178
httpz wrote: post #131

If anyone is actually going to use this for their top secrets, I can find two things to be aware of. * When you decrypt then close the tab and open the tab again via the recently closed tab, the password is still there. * Browser extensions could read the contents of the webpage. So if anyone is going to use this, they should do it in a "clean" incognito browser without any extensions.

For me the biggest problem with a setup like this is complete loss of access to my secrets. The crypto functions supported by browsers may change in future. A cipher algorithm used to encrypt my secrets may get deprecated and removed by the browser in future. Then I will be left with a bunch of HTML files with data that the browsers cannot decrypt anymore. GPG or vim -x might be much better choices for secrets that n…

Make sure to read this before using vim for anything crypto related!

https://github.com/vim/vim/issues/638

To sum things up, the Vim maintainers are totally ignorant on the topic of cryptography, but what's worse is that they are highly stubborn and refuse to accept their ignorance while ignoring valid criticism from people who do know. This combination of traits does not mix well with cryptography, where doing things correctly is extremely difficult but also extremely important.

I am not totally sure whether this specific issue has been fixed since I last checked this out, but at the time Vim's encryption was totally broken and should not have been used at all.

I am not too familiar with Vim overall, but Emacs file encryption uses GPG to do all of the important stuff, and just provides a nice interface to that. I imagine Vim has something similar available at least as a third party extension. Letting something like GPG or Age handle the important stuff is a much better way of handling this!

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#297

Post by mprime1 »

calebm wrote: post #275

Shameless plug: http://hypervault.github.io . Hypervault is a single HTML file (with no external dependencies) which allows you to encrypt files, and it outputs a single html file (with no external dependencies) with a copy of the hypervault decryption software packaged together with your encrypted data. To unlock a hyper vault, all that is needed is the encryption password (entered at creation time).

Very cool, and better UX!

Added you to the project README.

(I got a bunch of compliments for this project today, I hope you are enjoying seeing them too given we had the same idea)

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#299

Post by mprime1 »

thinkloop wrote: post #290

> Some secrets don’t belong in your password manager. Things like backup private keys, 2FS recovery keys, wallet keys, safe combinations, treasure maps, etc. Why don't wallet keys, safe combinations and treasure maps belong in a password manager?

I use a password manager for online credentials I regularly need to login across devices.

There's other secrets I'd rather never upload to the cloud, with all the risks that entails. I have various other methods to store and backup those secrets. This tool is part of that toolkit.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#300

Post by dmak »

_tk_ wrote: post #146

I'm a security professional and this looks like a great tool for OP's use case, especially with strong passwords and great password hints. I think your secrets are well stored - unless your mother stores the password to these files insecurely, a problem that is not new to this solution. This also applies to most if not all challenges mentioned by other posters. Take phishing for example, at the moment all methods to…

If someone did actually find a vulnerability, I would assume they are pretty good at what they do, but wouldn't they just wait for adoption and let this bounty inflate higher before draining it?
Post reply on HN