Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Portable Secret – How I store my secrets and communicate privately

mprimi.github.io

Post reply on HN
Print view View original

351–360 of 385 posts

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#351

Post by wizzwizz4 »

withinboredom wrote: post #333
wizzwizz4 wrote: post #165

Earlier quoted context omitted.

The cryptography is insecure. The code often is secure – it's just doing an insecure thing. In this example, the encrypted data is (perhaps) insecure, because the cryptography algorithm has known exploits. Consider a magic unpickable door lock that automatically unlocks itself at midnight. The lock has no security vulnerabilities (it's doing exactly what it's supposed to, and there's no way to subvert it), but your h…

I’m not sure if anything you said makes any sense in the context of my comment, are you sure you’re replying to me?

I assumed you meant something slightly different to what you wrote, because you wrote:

> You can’t decrypt things encrypted 20 years ago on modern API’s because those algorithms are known to be insecure.

Python's standard library, C's standard library, and Win32's CryptoAPI all beg to differ. The specific algorithms used by Crypto.subtle (Rijndael, Rivest–Shamir–Adleman) are over 20 years old, already, so even that's a counterexample.

> So it’s probably best to keep a windows version of the browser since that’s currently the only OS that can run software from 20 years ago, so hopefully they’ll still be able to do that 20 years from now.

Most operating systems can run software from 20 years ago. I'm currently running a 35-year-old piece of software on the latest version of an OS that isn't Windows. (I'm not aware of modern Windows being able to do that, actually; not since NTVDM got removed.)

Does this address your comment better?

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#352

Post by nashashmi »

SamBam wrote: post #287
_tk_ wrote: post #146

I'm a security professional and this looks like a great tool for OP's use case, especially with strong passwords and great password hints. I think your secrets are well stored - unless your mother stores the password to these files insecurely, a problem that is not new to this solution. This also applies to most if not all challenges mentioned by other posters. Take phishing for example, at the moment all methods to…

> Someone adversarial to me could bribe a number of people to get answers to 10 different password hints. OP's hints are probably more generous than they need to be. (Indeed, knowing that password is name + flower + name + two-word-thing, plus the fact that there is no limit to the speed you could brute-force this, means that someone could probably make a custom dictionary and break this in a couple days.) But you ca…

Do you trust Evernote? I think the employee are able to read private notes

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#353

Post by withinboredom »

wizzwizz4 wrote: post #351
withinboredom wrote: post #333

Earlier quoted context omitted.

I’m not sure if anything you said makes any sense in the context of my comment, are you sure you’re replying to me?

I assumed you meant something slightly different to what you wrote, because you wrote: > You can’t decrypt things encrypted 20 years ago on modern API’s because those algorithms are known to be insecure. Python's standard library, C's standard library, and Win32's CryptoAPI all beg to differ. The specific algorithms used by Crypto.subtle (Rijndael, Rivest–Shamir–Adleman) are over 20 years old, already, so even that's…

> Does this address your comment better?

Much! I'd say that there is always a counter-example. However, even RSA was generally recommended as "insecure" because people can't bother to do any research into the correct values of the parameters. The algorithm itself is secure, but most libraries didn't have sane/secure defaults until like 10ish years ago.

That was the point I was trying to make, you're making a bet that what we know today will still be true 20 years from now. The algorithms you mentioned are symmetric, IIRC, and basically any symmetric algorithm is secure as long as you have a one-time-pad or don't know any of the cleartext. That is, until someone finds a flaw with it.

I remember working on my first 'ciphersaber[1]' when it was discovered it was insecure.

> Most operating systems can run software from 20 years ago.

I was mostly referring to main-stream OS's. Linux and OSX, for example, cannot run software compiled 20 years ago (I'd love to be proven wrong, but my experience hasn't been so great!). On my modern Windows 11 PC, I can still run my first game engine demo, written and compiled in 1998 (I've since lost the source code). Or via WINE on my Linux PC, probably.

I'm sure there are niche cases out there, but the vast majority of people don't have access to those systems and OS's, while anyone can (currently) run a basic version of Windows for free.

[1]: http://ciphersaber.gurus.org/

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#354

Post by ibdf »

calebm wrote: post #275

Shameless plug: http://hypervault.github.io . Hypervault is a single HTML file (with no external dependencies) which allows you to encrypt files, and it outputs a single html file (with no external dependencies) with a copy of the hypervault decryption software packaged together with your encrypted data. To unlock a hyper vault, all that is needed is the encryption password (entered at creation time).

Unsolicited feedback: the contrast is killing me. It doesn't take much html/css to make a web page a bit more user friendly. See screenshot -> https://drive.google.com/file/d/1qNaBhoH2FsGlScvFmeXk9aZXouo...

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#355

Post by SamBam »

nashashmi wrote: post #352
SamBam wrote: post #287

Earlier quoted context omitted.

> Someone adversarial to me could bribe a number of people to get answers to 10 different password hints. OP's hints are probably more generous than they need to be. (Indeed, knowing that password is name + flower + name + two-word-thing, plus the fact that there is no limit to the speed you could brute-force this, means that someone could probably make a custom dictionary and break this in a couple days.) But you ca…

Do you trust Evernote? I think the employee are able to read private notes

That's why my hints are opaque and exclude the long, mutable master password.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#356

Post by LMMojo »

nashashmi wrote: post #352
SamBam wrote: post #287

Earlier quoted context omitted.

> Someone adversarial to me could bribe a number of people to get answers to 10 different password hints. OP's hints are probably more generous than they need to be. (Indeed, knowing that password is name + flower + name + two-word-thing, plus the fact that there is no limit to the speed you could brute-force this, means that someone could probably make a custom dictionary and break this in a couple days.) But you ca…

Do you trust Evernote? I think the employee are able to read private notes

Yes, they can. Evernote, the company, really pushes their "everything is encrypted" mantra, but you have to really push them to get them to admit that it's only encrypted in transit. On their server storage, the data is encrypted using their key, so if someone stole a drive or a disk image they wouldn't be able to read it, but any number of people at Evernote would have full access to anyone's data.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#357

Post by dariusj18 »

pertique wrote: post #150
dariusj18 wrote: post #74

Earlier quoted context omitted.

Yeah, plus they even give hints to the password complexity, so unless that is a red herring, this should be pretty simple to crack, if not CPU consuming. Just combine https://github.com/mejdoubi/rainbow-table and their algorithm together. It would probably take me a few hours to put together, but for someone who is very familiar with cryptography, it would be minimal work.

I think the author of that repo misunderstands what a rainbow table is. I only quickly skimmed the code, but it doesn't seem to do anything related to rainbow tables. On top of that, a rainbow table (if that is what you're looking to use) would not help here. The password is both very long and salted.

The repo was just a quick example of how one would use a rainbow table to crack the password. Yes, the fact that it only generates a simple rainbow table means that it isn't the holy grail to the exercise, but the idea of a rainbow table is that someones out there have already been running and generating a rainbow table for many years.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#358

Post by hamburglar »

mprime1 wrote: post #198
hamburglar wrote: post #190

Earlier quoted context omitted.

A neat feature of this would be to have the source of the html include instructions for decrypting the data outside the browser using command line tools for just this scenario.

Looking at the HTML/JS code does tell you how to implement decryption in a different language. That's because it only uses NIST recommended encryption, which is baked in or available in most languages.

Yes, but making it really easy by giving the exact openssl (or whatever) commands would be super useful if you needed to do it.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#359

Post by thrashh »

ynniv wrote: post #230
mprime1 wrote: post #208

Earlier quoted context omitted.

> might want a JavaScript decryption library to improve portability and lifespan How does a library improve portability and lifespan? I'm only using NIST-recommended encryption algorithms provided by W3C Crypto APIs. > The obvious weakness is your hosted document creator: it’s essentially impossible to defend an HTML document against a malicious domain. We can look at your GitHub repo, but there’s no guarantee that’s…

Sorry, I should have started off by saying that this is a great idea! I’m a big fan of encryption and those old, offline things we used to call “files”. > How does a library improve portability and lifespan? I'm only using NIST-recommended encryption algorithms provided by W3C Crypto APIs. I’ve been writing software long enough to have been around the block a few times, and the web ecosystem hasn’t been pretty. Thing…

I strongly doubt a crypto API will be taken away. It’s the bread and butter of any language that ships with one. There are very few implementations and their APIs are largely identical too

Web SQL? Now you could survey a room and ask if they think web JavaScript should have a native SQL library and probably half will say ehhh… a native SQL library where there are a thousand ways to implement it was doomed from the start

That said, algorithms may be deprecated and removed. I’ve seen that happen in crypto libraries.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#360

Post by flavius29663 »

z3t4 wrote: post #221
mprime1 wrote: post #199

Earlier quoted context omitted.

By "long sequence of words that are trivial for me to remember" I meant concatenation of secret questions, like in the bounty example: https://mprimi.github.io/portable-secret/examples/bounty.htm... Unless I hit my head really hard, there's zero chance I will forget this passphrase.

Keys should be random. The hints make it too easy. Lets say there exist 100 male names and 100 female names, thats just 100*100 combinations for names part. You could make the key generation intentionally slow though to limit the crack speed.

This is an old problem: how to slow down the hashing. https://en.wikipedia.org/wiki/Bcrypt
Post reply on HN