Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: InstantCryptor – AES256 Encryption for Dropbox and Google Drive

instantcryptor.com

Post reply on HN
Print view View original

1–10 of 52 posts

Re: Show HN: InstantCryptor – AES256 Encryption for Dropbox and Google Drive

#5

Post by ReidZB »

wolf550e wrote: post #4

>> The password will be hashed with the SHA256 algorithm, the mode for encryption is 256 Bit Rijndael/AES SHA256 is not a KDF, AES-256 is not a block cipher mode. Where is the source code?

I really dislike when companies say it their product encrypts with "256-bit encryption" or "AES-256". Like you said, that is an incomplete description of an encryption scheme. The choice of block cipher mode can immediately make or break my opinion of a product, and when developers omit what mode they've chosen, I lean toward break.

Re: Show HN: InstantCryptor – AES256 Encryption for Dropbox and Google Drive

#6

Post by ReidZB »

licobo wrote: post #3

And we do not store or even transfer your Dropbox or Google password on our servers. It runs locally in your browser. Feel free to double check this in the source code ;)

Can you link to the source code? In the 2-3 minutes I've spent searching, I can't find it.

Re: Show HN: InstantCryptor – AES256 Encryption for Dropbox and Google Drive

#7

Post by steakejjs »

wolf550e wrote: post #4

>> The password will be hashed with the SHA256 algorithm, the mode for encryption is 256 Bit Rijndael/AES SHA256 is not a KDF, AES-256 is not a block cipher mode. Where is the source code?

Wolf is 100% correct. These details make it sound like this product is insecure. We definitely don't want ecb mode or a weak kdf like 1 round of sha256 with no salt.

BUT before anyone lambasts this guy, it's good the author posted so mistakes can be learned from the feedback, that way others get exposed to the issues, and less mistakes are made in the future. In my opinion, there is too much hate for people who make mistakes when writing code, when in reality that's how you learn. Few people learn all the theory first and THEN how to build it, it's often learn to build then the theory.

Re: Show HN: InstantCryptor – AES256 Encryption for Dropbox and Google Drive

#8

Post by moe »

licobo wrote: post #2

A small side project to encrypt files for Dropbox and Google Drive. Encryption happens locally in the browser via JavaScript. The key never leaves the local computer. Happy for any feedback or comments ;)

Happy for any feedback or comments

Don't put your crypto experiments online where they could harm someone who naively relies on them.

Re: Show HN: InstantCryptor – AES256 Encryption for Dropbox and Google Drive

#9

Post by moe »

steakejjs wrote: post #7
wolf550e wrote: post #4

>> The password will be hashed with the SHA256 algorithm, the mode for encryption is 256 Bit Rijndael/AES SHA256 is not a KDF, AES-256 is not a block cipher mode. Where is the source code?

Wolf is 100% correct. These details make it sound like this product is insecure. We definitely don't want ecb mode or a weak kdf like 1 round of sha256 with no salt. BUT before anyone lambasts this guy, it's good the author posted so mistakes can be learned from the feedback, that way others get exposed to the issues, and less mistakes are made in the future. In my opinion, there is too much hate for people who make…

This is true for every kind of software except security things.

It's really hard for a novice to find something that will actually protect them in between all the "convenient cloud solutions" that an intern cobbled together in their lunch break using some javascript they found on github.

Post reply on HN