Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password protect a static HTML page

github.com

Post reply on HN
Print view View original

191–200 of 294 posts

Re: Password protect a static HTML page

#191

Post by bawolff »

dakiol wrote: post #138
VoidWhisperer wrote: post #82

The downside to this method is that since the resulting cryptographic hash and salt have to be in the resulting file, so there is nothing stopping someone from pulling the hash/salt out and bruteforcing it locally (as opposed to being able to ratelimit login attempts on a server) if they are so inclined and have the required resources.. which may not be that much in the way of resources as the tool uses 1000 iteratio…

Is it a downside if the password is a 100 characters-long string?

Depends which characters they are.

But in practise nobody uses 100 character long strings. Security is the intersection of real users with systems, not imaginary ones.

Re: Password protect a static HTML page

#192

Post by zem »

eduction wrote: post #134

Take one shot if you thought this was going to be about .htaccess and a second if you’re confused why it wasn’t.

i did think it was going to be, but it seems to be talking about password protecting things like github pages, where you don't control either the server or the filesystem, and therefore have no way to add the .htaccess file.

Re: Password protect a static HTML page

#193

Post by dav1app »

I have a similar project called Sasha.html.

https://github.com/dav1app/sasha.html

The idea is to export any file as an HTML file with the data as an encrypted string hard coded within the HTML. This way, no specific software is required to decrypt the file, just open it on the browser, type the password and download or view your file.

I built this to have a easy way to send encrypted files to any device and open it without having to install external tools.

Re: Password protect a static HTML page

#194

Post by devman0 »

dragontamer wrote: post #100
tptacek wrote: post #90

Earlier quoted context omitted.

You keep saying "the Galois Field" as if that was a thing. It's GCM. The components of GCM are CTR mode and the GMAC authentication code, which is based on GHASH. If you're afraid of Galois fields, you don't get to use AES at all! Nobody should be implementing any of these primitives themselves, very much including CBC, which, as you saw downthread, left both you and the author of this project with an insecure crypto…

> You keep saying "the Galois Field" as if that was a thing You're kidding, right? You've never looked at how GCM-mode works? The entire set of math is inside of the GF(2^128) field. That's why its called a Galois Counter Mode. I don't think anyone should be implementing their own GCM mode. Its very subtle and potentially full of traps. CBC on the other hand is pretty dumb and simple, and surprisingly secure and robu…

BEAST and POODLE were both high profile attacks against how SSL used CBC.

Re: Password protect a static HTML page

#197

Post by l33t233372 »

dragontamer wrote: post #98
password11 wrote: post #94

Earlier quoted context omitted.

> Or... you can have a more nuanced viewpoint The nuanced viewpoint is never implement your own cryptography. > Its so stupid simple I don't think that even a novice would make a critical error. Ask Microsoft about that one: https://learn.microsoft.com/en-us/security-updates/securityb...

That's a Padding Oracle vulnerability, not a CBC error.

The padding is a key part of using a block cipher in CBC mode.

I’m not sure why you’re ferociously defending the practice of implementing your own cryptography. It’s well known that this is a horrible idea for good reason.

Re: Password protect a static HTML page

#198

Post by quickthrower2 »

There is a difference between this kind of password and the password for a server.

With the OP system the attacker gets potentially way more attempts to access the page and gets to try in the future with whatever tech comes out. On the plus side it is E2E encrypted!

With a traditional server they can rate limit attempts on the password. But they probably don’t encrypt it using YOUR password (unless it is a password manager etc.) so an attacker could get the plaintext if there is a breach.

Re: Password protect a static HTML page

#199

Post by l33t233372 »

dragontamer wrote: post #80
tptacek wrote: post #76

Earlier quoted context omitted.

Nobody implements GCM themselves; they get it from a library. CBC, implemented the way you're describing, is almost always insecure.

And the library they use doesn't have GCM mode. So now what? https://cryptojs.gitbook.io/docs/ Because CBC mode is easier to implement, you'll find it in far more libraries. And honestly, if your underlying block-cipher is secure (that's the hard part: where your side-channels all exist), then CBC mode is really the easy part and can be safely implemented yourself. It really is that simple. ----------------- CBC does…

It’s unclear why you’re being so flippant about “adding on HMAC.”

The things you are describing are difficult and dangerous for developers to build.

Re: Password protect a static HTML page

#200

Post by dragontamer »

devman0 wrote: post #194
dragontamer wrote: post #100

Earlier quoted context omitted.

> You keep saying "the Galois Field" as if that was a thing You're kidding, right? You've never looked at how GCM-mode works? The entire set of math is inside of the GF(2^128) field. That's why its called a Galois Counter Mode. I don't think anyone should be implementing their own GCM mode. Its very subtle and potentially full of traps. CBC on the other hand is pretty dumb and simple, and surprisingly secure and robu…

BEAST and POODLE were both high profile attacks against how SSL used CBC.

But neither were attacks on CBC itself. That is to say: to "fix" BEAST or POODLE, you don't change a lick of CBC code at all.
Post reply on HN