Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password protect a static HTML page

github.com

Post reply on HN
Print view View original

281–290 of 294 posts

Re: Password protect a static HTML page

#281

Post by superkuh »

moondev wrote: post #219
superkuh wrote: post #127

Earlier quoted context omitted.

A static site generator can be used to create an .html file that's dependent on the user to execute a javscript web application to show the content. That makes that generated page dynamic. It doesn't change the nature of the static site generator.

What if the user uses curl to view the page. Is it now static?

That depends entirely on the page. Does it require javascript execution so that the contents are there? Then it's not. If you can open the file and read the text and see the URLs, yes. But if the page was generated by a script without it ever being a file on the webserver's disk, no.

Re: Password protect a static HTML page

#282

Post by tucif »

I do see this useful in cases where you might want to keep something private from the server-side and are not too concerned about server-side tampering.

Then could use basic auth to protect access from outside and a tool like this to protect access from inside.

Re: Password protect a static HTML page

#283

Post by flippinburgers »

deaddodo wrote: post #209
garrison wrote: post #175

My recent solution to this problem -- for an entire static site -- was to use HTTP Basic authentication with CloudFlare Pages: https://github.com/garrison/cloudflare-pages-shared-password

I was digging through the comments for someone to point this out. I’m honestly curious why people are using these overly complex options when a solution has been built into the HTTP standard for decades (and, in fact, is heavily abused for many APIs). And it’s superior in many ways, since the file is never delivered until authentication has been completed.

Person A doesn't know about basic auth - primarily because it isn't a hip way to solve the problem - so person A spends a bunch of time understanding, installing, and using something unnecessarily convoluted. When presented with evidence of a simpler solution, they balk because humans value things they have spent time on especially when it is their own solution, their own "discovery".

Re: Password protect a static HTML page

#284

Post by flippinburgers »

drowsspa wrote: post #110
superkuh wrote: post #17

Earlier quoted context omitted.

Exactly. I don't know where the confusion is, but I'm saying that it doesn't matter how the page is generated. It is sent to the website visitor as just HTML. When the user views it it is all there, just html. No changes. For example, I have a perl script that generates a set of .html files every night to show new additions to my library. They are static .html files on disk and never modified before the user views th…

Everyone is allowed to give their own meaning to words, but you can't expect to just change a widely agreed meaning to match it. "Static" means it is just a set of files. Not that the page is stationary. Do you think that a blink tag in a HTML page makes it non-static? A hover effect? An :after pseudoelement in CSS? If your perl script is saving the HTML to the disk, then yeah, your website is static. If it's generat…

Just a set of files? Awesome! I had no idea that unix itself was a static OS.

Re: Password protect a static HTML page

#285

Post by efreak »

DanielBMarkham wrote: post #114

Gad! I have spent all morning trying to --- password protect a static html page. How in the hell does HN have a story about the exact topic I've been struggling with appear just a dozen or so hours after I started working on it. Wow. I was _extremely_ happy to see this posted. However when I click the link I am taken to the library I had initially tried and had to reject. Without getting into the crypto side of thing…

Is there a reason you can't load it up as a pdf with pdf.js?

Re: Password protect a static HTML page

#286

Post by inssein »

qingdao99 wrote: post #177
inssein wrote: post #176

I just finished building a similar tool: https://utiliti.dev/private-note/ Currently it’s just for plaintext, but might allow for more complex things like the website. The password is stored in the url after the # so it’s never sent to the server. I was going to post this project after I build some more utilities.

Is the note supposed to self-destruct even when it's attempted to be opened with incorrect data in the URL hash? (so it hasn't actually been read yet)

Today it does, but might need to find a way around it.

Re: Password protect a static HTML page

#287

Post by inssein »

megous wrote: post #179
inssein wrote: post #176

I just finished building a similar tool: https://utiliti.dev/private-note/ Currently it’s just for plaintext, but might allow for more complex things like the website. The password is stored in the url after the # so it’s never sent to the server. I was going to post this project after I build some more utilities.

It will leak all over browser's history, though.

Is this a problem? It will only leak on the sender and receivers browser history.

Re: Password protect a static HTML page

#288

Post by VincentEvans »

SamBam wrote: post #174
VincentEvans wrote: post #171

Can someone explain a bit more how “remember me” works? If symmetric encryption requires a “key” to decrypt - one might expect that you will need to store that key to auto-decrypt. But here it claims that the key is stored salted and hashed. But to auto-decrypt - you need to reverse that salt and hash because you need that key back. How would that work?

The passphrase+salt get hashed. This hashed-passphrase is what decrypts the file. You can store the hashed-passphrase in local storage. This means you can auto-decrypt again. You don't need the original passphrase. If bad guys get your computer, they can read the file. However, they cannot trivially work out what your original passphrase was, so it protects you a little if you reused your passphrase elsewhere.

Thanks!

Re: Password protect a static HTML page

#289

Post by dividuum »

viraptor wrote: post #203
dividuum wrote: post #121

Earlier quoted context omitted.

I designed a similar tool with that threat model in mind: the resulting HTML/JS is as minimal as possible so it’s possible to inspect before entering the password. Of course assumes safe browser and client machine.. https://github.com/dividuum/html-vault

Kind of possible. With enough content, would you actually spot a "}; and some highly obfuscated code in the middle of the blob? (My guess is a no)

You're right. Probably not. But at least the chance exists as there isn't a multi-KB obfuscated JS dependency somewhere that would be a lot harder to handle.

Re: Password protect a static HTML page

#290

Post by efreak »

chii wrote: post #223
doodlesdev wrote: post #186

Earlier quoted context omitted.

But then it's not self contained and every time you want to access the archive you also need a program that can decrypt/encrypt that format. Using a self-contained HTML file means it's currently the most portable way to encrypt something and have it available anywhere you can get the file on. By the way, I don't advocate for this idea. But still, I find it a pretty ingenious way to store encrypted data portably. Esse…

> you also need a program that can decrypt/encrypt that format that's just a self-extracting archive, which is a very common idea and easily created as well (very popular with both shareware distribution). The problem is that you have to trust the extracting code to not install anything else malicious. The browser provides the perfect sandbox - you cannot install malware into the system via javascript in the browser,…

And you have to trust that running processes on dish aren't going to make a copy of it. Or that it won't end up stuck in the cache. This is (theoretically) only decrypted in memory (your browser may save a preview image of the tab, I believe Firefox mobile does this, not sure about desktop browsers)
Post reply on HN