Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Portable Secret – How I store my secrets and communicate privately

mprimi.github.io

Post reply on HN
Print view View original

311–320 of 385 posts

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#311

Post by timwis »

rogers18445 wrote: post #303
DDSDev wrote: post #295

This is a really cool project! One thought that I have: would there be an issue sending this file in an unsecure context where MITM is a possibility? Alice sends Bob her HTML file over an unsecured medium, and Jane intercepts this traffic, and gives Bob a modified HTML file that will report the password back to Jane. Jane can set it up so that the browser still displays the local file as it's source, but has an HTTP…

Yes. This is essentially a binary with the browser acting as the OS. And if it's hosted on a server it's a binary which may change at any moment. There isn't even a mechanism by which to freeze its hash and alert you if it changes - a browser would have to provide that functionality. To be fair, the exact same problem afflicts something like Protonmail, so calling it a toy may be too harsh.

Maybe it could put a checksum in the url?

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#312

Post by burnished »

bobleeswagger wrote: post #252
mprime1 wrote: post #133

Earlier quoted context omitted.

I'd be happy to see the wallet emptied. This is what the bounty is for. I just hope whoever cracks it lets me know how they did it and how hard it was. This is what a bounty is, no?

$400 is nothing, put your life savings into this system if you trust it so much. It's a cute marketing gimmick, that's about it.

[flagged]

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#314

Post by esjeon »

Hmm, am I missing something here? Because I have been getting HTML files exactly like this for billing from my credit card company, for years and years. It's encrypted, and, when opened, accepts a simple password for decryption. No plugins or whatsoever, just pure HTML+Javascript.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#315

Post by plugin-baby »

DDSDev wrote: post #295

This is a really cool project! One thought that I have: would there be an issue sending this file in an unsecure context where MITM is a possibility? Alice sends Bob her HTML file over an unsecured medium, and Jane intercepts this traffic, and gives Bob a modified HTML file that will report the password back to Jane. Jane can set it up so that the browser still displays the local file as it's source, but has an HTTP…

> Jane intercepts this traffic, and gives Bob a modified HTML file

I’d expect better from Jane. This is the kind of shit Mallory would pull.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#316

Post by kortilla »

mprime1 wrote: post #116
createdapril24 wrote: post #87

This has some desirable security properties, but I would like to see more analysis on the security side (not just: is secure or is not secure). Passwords: - Easy to memorize. Pro: Does not rely on a device, can be recovered if devices stolen. - Easy to phish. Con: Attacker can use a look-a-like page, click-jacking, and pixel extraction (frame stealing) attacks to get password & secret. - Easy to brute force. Con: Rel…

Thank you for the comment and thoughts. Agree with most, disagree with some (easy to brute-force?), but I wanted to comment on this in particular: > Easy to phish. Con: Attacker can use a look-a-like page, click-jacking, and pixel extraction (frame stealing) attacks to get password & secret This to me is the most glaring "vulnerability". i.e. I use this to exchange letters with my friend Bob. Now someone impersonates…

> The thing is... this won't happen. If I'm dealing with an attacker so sophisticated to pull this off, it's likely they have 1000 other vectors that are more effective and dangerous.

Don’t delude yourself. These phishing pages with mirrored login portals happen to podunk organizations all of the time.

If someone manages to get a link to your page and is interesting in the contents, duping it and sending a phishing link to the suspected password holder is a trivial spear phishing attack (with an annoyingly high success rate).

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#317

Post by kortilla »

mprime1 wrote: post #203
pwg wrote: post #168

Earlier quoted context omitted.

The GP comment about "easy to brute force" must be read in context with the remainder of the comment about "easy to brute force": "Relies on human adherence to password best practices to maintain sufficient entropy. Learning from industry that this does not work in widespread adoption" The GP's statement can be boiled down to: "users will choose poor passwords" (as in Password1!) because it has been shown time and ag…

Right, agree with all of that. I would have characterized as "user can shoot themselves on the foot (i.e. by choosing weak password)", rather than "easy to bruteforce"

But users choosing a weak password on a standard rate limited service login is significantly different to choosing a poor password in something that the attacker has unlimited, low latency and undetectable attempts against.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#318

Post by ivalm »

ninkendo wrote: post #278
ivalm wrote: post #179

Earlier quoted context omitted.

why would a smart contract help though? there needs to be proof that the encrypted key is valid, this would require zero knowledge proof but I'm not sure how you can do it for this use case.

He could post a secret in the decrypted text on the page that, once submitted to the chain, fulfills the contract and transfers the ETH. I know very little about smart contracts but I thought this is what they’re good at… “if a value is posted with a sha512 hash that matches x, the contract is fulfilled”, and put the value on the page, encrypted, and ask hackers to decrypt it. It doesn’t necessarily prove that the en…

But then you don’t need to have a smart contract, simply posting public key of the wallet is enough (to verify the content of the wallet). The contract at most provides an escrow, but even that isn’t really the case since presumably the originator has the key to pull the money (since he knows the secret key).

Proving that an encrypted text has the private key is possible for some encryption schemes through zero knowledge proofs, but I guess not in this case in particular.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#319

Post by createdapril24 »

kortilla wrote: post #317
mprime1 wrote: post #203

Earlier quoted context omitted.

Right, agree with all of that. I would have characterized as "user can shoot themselves on the foot (i.e. by choosing weak password)", rather than "easy to bruteforce"

But users choosing a weak password on a standard rate limited service login is significantly different to choosing a poor password in something that the attacker has unlimited, low latency and undetectable attempts against.

I agree with the point about unlimited and undetectable. I think there's nuance to low latency.

Here the latency the attacker is limited by the amount of parallelism they can bring to bear on e.g. PBKDF. Ultimately this is an economic consideration about the cost to protect a secret vs cost to crack it.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#320

Post by MichaelMoser123 »

i have my vim extension for the purpose of keeping some private notes: https://github.com/MoserMichael/vimcrypt2

You don't have to re-enter the key during each save, the plugin keeps the key during the vim session in an encrypted form (encrypted with a temp key).

The vim extension is using openssl for aes encryption (using aes-256-ecb - so if a part of the file gets damaged then you won't loose the whole file)

(oh, vim -x seems to be doing something similar, they use blowfish as the default. I am not hashing the text in order to verify its authenticity, probably should add that to my vim extension)

Post reply on HN