You could apply the same trick to also make a self-decompressing file, basically you could have self decompressing and decrypting archives, all stored in html.
Pretty cool trick
Show HN: Portable Secret – How I store my secrets and communicate privately
331–340 of 385 posts
Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#332Nice project!
It reminds me of tiddlywiki which also has browser encryption: https://tiddlywiki.com/static/Encryption.html .
Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#333Earlier quoted context omitted.
I doubt that would work. You can’t decrypt things encrypted 20 years ago on modern API’s because those algorithms are known to be insecure. You’d have to probably rewrite it from scratch or install an old version of the browser. So it’s probably best to keep a windows version of the browser since that’s currently the only OS that can run software from 20 years ago, so hopefully they’ll still be able to do that 20 yea…
The cryptography is insecure. The code often is secure – it's just doing an insecure thing. In this example, the encrypted data is (perhaps) insecure, because the cryptography algorithm has known exploits. Consider a magic unpickable door lock that automatically unlocks itself at midnight. The lock has no security vulnerabilities (it's doing exactly what it's supposed to, and there's no way to subvert it), but your h…
I’m not sure if anything you said makes any sense in the context of my comment, are you sure you’re replying to me?
Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#334Earlier quoted context omitted.
>Uses current state of art algos. Pro: Resistant to access by known methods. AES-GCM is fine sure, but the password hashing function PBKDF2-HMAC-SHA1, i.e. what turns the user's weak password into the AES-key, is the opposite of state-of-the-art in this case.
Argon2-HMAC-SHA512 more like it? Or something else?
Argon2 is built on top of BLAKE2 but the hash function isn't what's making it so effective, it's memory hardness, i.e. it fills the RAM when deriving a key from password, which makes massively parallel attacks impractical because GPUs / ASICs don't have petabytes of RAM just lying around.
Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#335This is a really cool project! One thought that I have: would there be an issue sending this file in an unsecure context where MITM is a possibility? Alice sends Bob her HTML file over an unsecured medium, and Jane intercepts this traffic, and gives Bob a modified HTML file that will report the password back to Jane. Jane can set it up so that the browser still displays the local file as it's source, but has an HTTP…
> Jane intercepts this traffic, and gives Bob a modified HTML file I’d expect better from Jane. This is the kind of shit Mallory would pull.
Or Eve. But Jane, I would have never thought.
Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#336This is a really cool project! One thought that I have: would there be an issue sending this file in an unsecure context where MITM is a possibility? Alice sends Bob her HTML file over an unsecured medium, and Jane intercepts this traffic, and gives Bob a modified HTML file that will report the password back to Jane. Jane can set it up so that the browser still displays the local file as it's source, but has an HTTP…
100% agree. This is why I’m always a bit dubious of in-browser decryption. At any moment a little extra snippet of JS can be added to stealthily leak my secrets. There’s no great mechanism to ensure the JS I’m running is always the same JS I ran before. Compare this to a desktop app where I always know I’m running the exact same binary I ran last time. (And if I’m not then I’m probably already pwned anyway) For this…
This isn't a 100% solution but you can pin external JavaScript includes in HTML using subresource integrity (https://developer.mozilla.org/en-US/docs/Web/Security/Subres...).
This doesn't help if someone can mess with the HTML though.
Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#337This is a really cool project! One thought that I have: would there be an issue sending this file in an unsecure context where MITM is a possibility? Alice sends Bob her HTML file over an unsecured medium, and Jane intercepts this traffic, and gives Bob a modified HTML file that will report the password back to Jane. Jane can set it up so that the browser still displays the local file as it's source, but has an HTTP…
One counter-measure to this is to run the decryption without internet connection. This is easy enough to explain to a hypothetical non technical mother.
Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#338Cool project. Here is a feature suggestion: One additional feature you can add is a recovery key. You could use a time-limited master recovery key and encrypt the file's data key and store it within the HTML file as an encrypted header. It of course increases the attack surface because an attacker can then just focus on the recovery key. But it would help in the scenarios where the passphrase for the datakey is forgo…
What does “time limited” mean here?
Time-limited i.e., you rotate master key after a fixed time, say 1 month/1 year etc., depending on the use case.
During that period the content can be recovered by using the masterkey to unwrap the data key and decipher the content. Beyond that period, if you don't remember the master key, you cannot decrypt the content.
The time-period is only a shortcut. So, for personal use, as the OP intended, resetting the masterkey each year would still offer some protection against forgetting the passphrase for the data encryption.
Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#339Great idea. Wanted to point out that a relatively easy solution to the phishing attack brought up several times in the discussion (where an adversary intercepts the file and creates a fake one that exfiltrates the key) is to temporarily disconnect from the internet when decrypting, and to do so in an incognito window and close it right after. So short for a 0-day browser hack, you'd be safe.
Perhaps you can add this as optional instructions to the decryption page.
Re: Show HN: Portable Secret – How I store my secrets and communicate privately
#3401password used to do this with a thing called 1password anywhere, which was turned down in 2016. https://1password.community/discussion/63045/moving-beyond-1... If stores all the passwords in encrypted js files, which the 1password.html would read in and allow for totally offline password access.
This is pretty cool:
> Before we jump in, I wanted to share some history with you. Back in 2009 when we first built 1PasswordAnywhere, it wasn’t possible to use it with Dropbox. We couldn’t use Dropbox at the time because each file request needed to include a revision number and 1PasswordAnywhere had no way to know which revision numbers to use.
> Roustem and I explained this problem to the Dropbox Founder Arash, and he was kind enough to add a workaround to allow us to load files directly. This was state of the art technology in 2009.