Hopefully not oversharing. Perfect for communications with my therapist. Thank you!
Show HN: Portable Secret – How I store my secrets and communicate privately
321–330 of 385 posts
Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#322Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#323I'm a security professional and this looks like a great tool for OP's use case, especially with strong passwords and great password hints. I think your secrets are well stored - unless your mother stores the password to these files insecurely, a problem that is not new to this solution. This also applies to most if not all challenges mentioned by other posters. Take phishing for example, at the moment all methods to…
> Someone adversarial to me could bribe a number of people to get answers to 10 different password hints. OP's hints are probably more generous than they need to be. (Indeed, knowing that password is name + flower + name + two-word-thing, plus the fact that there is no limit to the speed you could brute-force this, means that someone could probably make a custom dictionary and break this in a couple days.) But you ca…
I have things like this in my head too and I wonder if I’ll forget when I get elderly.
Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#324Earlier quoted context omitted.
I can't for the life of me understand why people haven't just switched to Neovim. Sure fine vim might be what's on your server but for your actual personal development work it's, to me, better in every way.
My main hesitation is that I like being able to drop my vimrc anywhere and have an (almost) identical editor experience, rather than having to maintain one config for vim and one for neovim. Been meaning to try neovim out though!
You can source your .vimrc from neovim if you’re interested. I’ve been separating plugins based on the environment they depend on as well.
Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#325This is a really cool project! One thought that I have: would there be an issue sending this file in an unsecure context where MITM is a possibility? Alice sends Bob her HTML file over an unsecured medium, and Jane intercepts this traffic, and gives Bob a modified HTML file that will report the password back to Jane. Jane can set it up so that the browser still displays the local file as it's source, but has an HTTP…
[deleted]
Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#326About 10 years ago when I was working with American Express for a Payment Gateway project, all the internal bank too vendor communications were these encrypted emails with a self-contained HTML file that has the content encrypted inside of them, similar like Portable Secret. Sadly I don't recall the proprietary vendor's name or the name of the technology. Pretty sure I've received similar self-embedded HTML from Chase as well.
Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#327Earlier quoted context omitted.
> Someone adversarial to me could bribe a number of people to get answers to 10 different password hints. OP's hints are probably more generous than they need to be. (Indeed, knowing that password is name + flower + name + two-word-thing, plus the fact that there is no limit to the speed you could brute-force this, means that someone could probably make a custom dictionary and break this in a couple days.) But you ca…
I have things like this in my head too and I wonder if I’ll forget when I get elderly.
or bonked on the head. it's a scary thought.
Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#328About 10 years ago when I was working with American Express for a Payment Gateway project, all the internal bank too vendor communications were these encrypted emails with a self-contained HTML file that has the content encrypted inside of them, similar like Portable Secret. Sadly I don't recall the proprietary vendor's name or the name of the technology. Pretty sure I've received similar self-embedded HTML from Chas…
IKR? I've been receiving such emails for a long time (and still receiving one every month), and this is not a new idea to me. I really wonder what's inherently different here, because I couldn't find one yet it's being hyped up. The use of crypto API is just an implementation detail that might negatively impact the longevity of a document.
Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#329About 10 years ago when I was working with American Express for a Payment Gateway project, all the internal bank too vendor communications were these encrypted emails with a self-contained HTML file that has the content encrypted inside of them, similar like Portable Secret. Sadly I don't recall the proprietary vendor's name or the name of the technology. Pretty sure I've received similar self-embedded HTML from Chas…
IKR? I've been receiving such emails for a long time (and still receiving one every month), and this is not a new idea to me. I really wonder what's inherently different here, because I couldn't find one yet it's being hyped up. The use of crypto API is just an implementation detail that might negatively impact the longevity of a document.
They still do this. It sucks.
Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#330Cool project! This stuff is all possible thanks to the SubtleCrypto API ( https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypt... ), which became widespread in browsers in the last ~5 years. It's so great we don't have to use weird libraries (some with pretty gnarly side channel leakage) to do cryptography anymore. It wouldn't be that crazy for the browser to do the encryption part for me, right? Like, what i…
What level of confidence is there that all this API will work exactly as it works now after 30 years? I am concerned that they might at the very least deprecate and remove the ciphers used to encrypt my data in portable secret. Worse what if they remove support for the API? Then I am going to have HTML files with data I cannot decrypt anymore, right?
I don't know about 30 years but AES-256-GCM has implementations in multiple programming languages, e.g. it can be decrypted dependency free in Node.js >= 10. If browsers were to drop support (unlikely imo), there should be multiple options for decryption provided one has access to a runtime supporting AES-256-GCM decrypt. An older WASM'd version of PHP or python may even work.
I have no use for this myself but wrote a quick Node.js script which accepts an html file created by this tool and prints messages to stdout or saves a file to decrypted.ext: https://gist.github.com/andrewmackrodt/e6a5a2ea7b22d74102ba7... - it's dependency free (no npm install dependencies) and tested with Node.js 10 and above.
e.g. "docker run --rm -it -v "$PWD:/app" -w /app node:10-alpine portable-secret-decrypt.js example-image.html"
When used with the Bart's drivers license it will create the decrypted file as decrypted.jpeg to the cwd.