Can someone explain a bit more how “remember me” works? If symmetric encryption requires a “key” to decrypt - one might expect that you will need to store that key to auto-decrypt. But here it claims that the key is stored salted and hashed. But to auto-decrypt - you need to reverse that salt and hash because you need that key back. How would that work?
Password protect a static HTML page
171–180 of 294 posts
Re: Password protect a static HTML page
#172Earlier quoted context omitted.
Right but all that's happening here is stretching. So the difference only matters in the middle. Regardless of the strategy bad guys will guess "1234" or "sesame" (too easy) and they won't guess a random 128-bit key I just generated with my hexadecimal dice (impossible). This weakness only means it's easier than expected to guess your password is "suckitelon" or "GoCowboys1978" or whatever We put a lot of effort into…
Your 128 key is difficult for users to enter manually.
[deleted]
Re: Password protect a static HTML page
#173Earlier quoted context omitted.
That's exactly what I said. It doesn't matter if I wrote the HTML by hand or I had a perl, or bash, or compiled c program make it. It's just an HTML file.
Lol no. If you HTML is generated, it's by definition not static anymore. Otherwise, all of the React server side rendering is static HTML.
This is the most bizarre argument. Of course you can use build tools to generate static web pages.
The issue is whether they are being generated dynamically by a server. This project isn't. You run a build-tool once and then can post the .html page anywhere. It's static.
Re: Password protect a static HTML page
#174Can someone explain a bit more how “remember me” works? If symmetric encryption requires a “key” to decrypt - one might expect that you will need to store that key to auto-decrypt. But here it claims that the key is stored salted and hashed. But to auto-decrypt - you need to reverse that salt and hash because you need that key back. How would that work?
The passphrase+salt get hashed. This hashed-passphrase is what decrypts the file.
You can store the hashed-passphrase in local storage. This means you can auto-decrypt again. You don't need the original passphrase.
If bad guys get your computer, they can read the file. However, they cannot trivially work out what your original passphrase was, so it protects you a little if you reused your passphrase elsewhere.
Re: Password protect a static HTML page
#175My recent solution to this problem -- for an entire static site -- was to use HTTP Basic authentication with CloudFlare Pages: https://github.com/garrison/cloudflare-pages-shared-password
Re: Password protect a static HTML page
#176I just finished building a similar tool: https://utiliti.dev/private-note/
Currently it’s just for plaintext, but might allow for more complex things like the website.
The password is stored in the url after the # so it’s never sent to the server.
I was going to post this project after I build some more utilities.
Re: Password protect a static HTML page
#177I just finished building a similar tool: https://utiliti.dev/private-note/ Currently it’s just for plaintext, but might allow for more complex things like the website. The password is stored in the url after the # so it’s never sent to the server. I was going to post this project after I build some more utilities.
Is the note supposed to self-destruct even when it's attempted to be opened with incorrect data in the URL hash? (so it hasn't actually been read yet)
Re: Password protect a static HTML page
#178The use case for a document like this is a little different from .htaccess. This is something you can share, email, host, etc and have some security in transit and at rest. Yes, .htaccess password protects on the web server, but that is one specific use case and requires a lot of machinery and specific environment. JavaScript is everywhere. And this is a static HTML document in the sense that there is no server side…
Why not use a password protected word document if those are your use-cases?
Similar use case. I would not use this for anything important. If you just want to shuffle data around with something similar just use something like KeePassX, lets you attach files. Much more configurable with regards to KDF parameters and such.
Re: Password protect a static HTML page
#179I just finished building a similar tool: https://utiliti.dev/private-note/ Currently it’s just for plaintext, but might allow for more complex things like the website. The password is stored in the url after the # so it’s never sent to the server. I was going to post this project after I build some more utilities.
It will leak all over browser's history, though.
Re: Password protect a static HTML page
#180Gad! I have spent all morning trying to --- password protect a static html page. How in the hell does HN have a story about the exact topic I've been struggling with appear just a dozen or so hours after I started working on it. Wow. I was _extremely_ happy to see this posted. However when I click the link I am taken to the library I had initially tried and had to reject. Without getting into the crypto side of thing…
[deleted]