Show HN: Laptop is the last place your secrets are still in plaintext
1–10 of 93 posts
Re: Show HN: Laptop is the last place your secrets are still in plaintext
#2Interesting idea! How do you achieve it? Some kind of file system driver that recognises the calling process?
Re: Show HN: Laptop is the last place your secrets are still in plaintext
#3The install procedure, for something that's supposed to be a security product:
curl -sL https://dl.jitpass.com/jitpass/jit/releases/latest/download/jitpass_darwin_arm64.tar.gz | tar -xz jit
sudo mv jit /usr/local/bin/
Re: Show HN: Laptop is the last place your secrets are still in plaintext
#4I am actually building the exact same thing- encrypted vaults for files or folders, encrypted with a biometric gated key in the Secure Enclave!
Re: Show HN: Laptop is the last place your secrets are still in plaintext
#5[deleted]
Re: Show HN: Laptop is the last place your secrets are still in plaintext
#6Interesting idea! How do you achieve it? Some kind of file system driver that recognises the calling process?
If only there was a Markdown file in the repo, that explains it. It could have a URL, say, https://github.com/jitpass/jit/blob/main/docs%2Fgetting-star...
Re: Show HN: Laptop is the last place your secrets are still in plaintext
#7The install procedure, for something that's supposed to be a security product: curl -sL https://dl.jitpass.com/jitpass/jit/releases/latest/download/jitpass_darwin_arm64.tar.gz | tar -xz jit sudo mv jit /usr/local/bin/ What could possibly go wrong?
What is wrong with it?
Re: Show HN: Laptop is the last place your secrets are still in plaintext
#8The install procedure, for something that's supposed to be a security product: curl -sL https://dl.jitpass.com/jitpass/jit/releases/latest/download/jitpass_darwin_arm64.tar.gz | tar -xz jit sudo mv jit /usr/local/bin/ What could possibly go wrong?
[deleted]
Re: Show HN: Laptop is the last place your secrets are still in plaintext
#9While this might be a useful tool for Mac users, it's all hackers here, so:
* Most people do not have passwords in plain text — an SSH key protected with a passphrase is not "plain text", for instance
* Most people have encrypted home or full disk encryption
* How can we trust your crypto implementation?
* If we are talking about in-memory plain-text during use, how does this tool protect against it?
* Containerisation is a big topic when running untrusted software for exactly (but not just) this reason
* While passwords/tokens might carry a big risk depending on what you do, I find that I worry more about my local data compared to my remote data — and virtualisation or containerisation helps with that.
Re: Show HN: Laptop is the last place your secrets are still in plaintext
#10The install procedure, for something that's supposed to be a security product: curl -sL https://dl.jitpass.com/jitpass/jit/releases/latest/download/jitpass_darwin_arm64.tar.gz | tar -xz jit sudo mv jit /usr/local/bin/ What could possibly go wrong?
What is wrong with it?
The pattern of piping an arbitrary script to your shell? This should be an ordinary app bundle to drop into /Applications, or be distributed as an installer.
The readme even says so itself:
> A bad curl | sh, a sketchy npm install, or one of the AI agents now running in your editor with your full permissions.
And then, two paragraphs down, it suggests to do just that to install…