Live data from Hacker News

Show HN: Password-Protect My File

passwordprotectmyfile.com

1–10 of 19 posts

Re: Show HN: Password-Protect My File

#6
post #3

How is this better than symmetric encryption with GnuPG?

The encrypted result of this tool contains all the code necessary to decrypt itself (in a web browser). I'm not too familiar with GnuPG, so I don't know if that's different.

Any browser?

Re: Show HN: Password-Protect My File

#7
As soon as my file is readable by javascript it could be sent anywhere by your code. I'm not saying you do, but it could. Therefore this adds an unnecessary risk. I would have to disconnect my machine from the network and clear all the browser storage before reconnecting to even begin to think this was safe.

Just to be clear: I'm not saying it's useless, just that if the file I was encrypting was so important that I needed to encrypt it, doing it in a sandbox that is directly connected to an untrusted third-party wouldn't be a very bright move.

Re: Show HN: Password-Protect My File

#8
If a user doesn't trust Dropbox, why would they trust passwordprotectmyfile.com?

I know it claims the file doesn't leave your computer, and that might be true right now, but in five minutes if I visit the page the code could have changed. And it would hardly be user-friendly to ask users to check the minified javascript before using it.

Re: Show HN: Password-Protect My File

#9
post #6
post #3

Earlier quoted context omitted.

The encrypted result of this tool contains all the code necessary to decrypt itself (in a web browser). I'm not too familiar with GnuPG, so I don't know if that's different.

Any browser?

Tested and working with recent Chrome, Firefox, Opera, Safari 6.1+, IE 10+. https://www.passwordprotectmyfile.com/faq.

It uses, among others, the Blob API so will not work on older browsers.

Re: Show HN: Password-Protect My File

#10
post #5

Should really highlight the fact that it could be self-hosted [0]. Typing a password and uploading a sensitive file is never a good idea. [0] https://github.com/louissobel/ppmf

At first sight it seems the encryption is done by client-side javascript, so you don't gain much by hosting it yourself.
Post reply on HN