Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: InstantCryptor – AES256 Encryption for Dropbox and Google Drive

instantcryptor.com

Post reply on HN
Print view View original

11–20 of 52 posts

Re: Show HN: InstantCryptor – AES256 Encryption for Dropbox and Google Drive

#11

Post by steakejjs »

moe wrote: post #9
steakejjs wrote: post #7

Earlier quoted context omitted.

Wolf is 100% correct. These details make it sound like this product is insecure. We definitely don't want ecb mode or a weak kdf like 1 round of sha256 with no salt. BUT before anyone lambasts this guy, it's good the author posted so mistakes can be learned from the feedback, that way others get exposed to the issues, and less mistakes are made in the future. In my opinion, there is too much hate for people who make…

This is true for every kind of software except security things. It's really hard for a novice to find something that will actually protect them in between all the "convenient cloud solutions" that an intern cobbled together in their lunch break using some javascript they found on github.

No it is even true for security things BUT the authors need to have no problem taking a dose of humble pie and labeling the project as completely insecure.

I don't see anything wrong with writing security software that is insecure as long as you don't pretend it is secure....

Re: Show HN: InstantCryptor – AES256 Encryption for Dropbox and Google Drive

#12

Post by sarciszewski »

moe wrote: post #8
licobo wrote: post #2

A small side project to encrypt files for Dropbox and Google Drive. Encryption happens locally in the browser via JavaScript. The key never leaves the local computer. Happy for any feedback or comments ;)

Happy for any feedback or comments Don't put your crypto experiments online where they could harm someone who naively relies on them.

Yeah, look what happened when someone leaked Ron Rivest's RC4 cipher. People still naively rely on it!

Re: Show HN: InstantCryptor – AES256 Encryption for Dropbox and Google Drive

#13

Post by wtbob »

licobo wrote: post #3

And we do not store or even transfer your Dropbox or Google password on our servers. It runs locally in your browser. Feel free to double check this in the source code ;)

That's the problem with in-browser crypto, though: you could change the source code at-will. You could even serve different versions of the source code to different people. You might even be compelled by your state to do so, even if you wished not to.

Better to deliver the end-user a piece of code he can examine once and trust going forward.

Re: Show HN: InstantCryptor – AES256 Encryption for Dropbox and Google Drive

#15

Post by higherpurpose »

ReidZB wrote: post #5
wolf550e wrote: post #4

>> The password will be hashed with the SHA256 algorithm, the mode for encryption is 256 Bit Rijndael/AES SHA256 is not a KDF, AES-256 is not a block cipher mode. Where is the source code?

I really dislike when companies say it their product encrypts with "256-bit encryption" or "AES-256". Like you said, that is an incomplete description of an encryption scheme. The choice of block cipher mode can immediately make or break my opinion of a product, and when developers omit what mode they've chosen, I lean toward break.

At least it's not "military-grade encryption".

Re: Show HN: InstantCryptor – AES256 Encryption for Dropbox and Google Drive

#16

Post by moe »

steakejjs wrote: post #11
moe wrote: post #9

Earlier quoted context omitted.

This is true for every kind of software except security things. It's really hard for a novice to find something that will actually protect them in between all the "convenient cloud solutions" that an intern cobbled together in their lunch break using some javascript they found on github.

No it is even true for security things BUT the authors need to have no problem taking a dose of humble pie and labeling the project as completely insecure. I don't see anything wrong with writing security software that is insecure as long as you don't pretend it is secure....

I don't see anything wrong with writing security software that is insecure as long as you don't pretend it is secure....

Except this one very much pretends to offer protection, apparently oblivious of the problems with their design.

They should point out very visibly that this is a tech-demo to promote a completely different product, and not an app that anyone should actually use.

Re: Show HN: InstantCryptor – AES256 Encryption for Dropbox and Google Drive

#17

Post by erglkjahlkh »

moe wrote: post #9
steakejjs wrote: post #7

Earlier quoted context omitted.

Wolf is 100% correct. These details make it sound like this product is insecure. We definitely don't want ecb mode or a weak kdf like 1 round of sha256 with no salt. BUT before anyone lambasts this guy, it's good the author posted so mistakes can be learned from the feedback, that way others get exposed to the issues, and less mistakes are made in the future. In my opinion, there is too much hate for people who make…

This is true for every kind of software except security things. It's really hard for a novice to find something that will actually protect them in between all the "convenient cloud solutions" that an intern cobbled together in their lunch break using some javascript they found on github.

I wish it were just interns... Example follows.

The Finnish security company F-Secure revealed a secure cloud service, called Younited (https://www.younited.com/). It did not catch on. The active user amounts stayed at near zero level so it was sold to a company called Synchronoss.

F-Secure initially hoped that their good reputation, and the fact that the servers are located in countries without draconian spying legislation would be enough. They seriously hoped to make a star product out of their secure cloud service.

Well, secure against whom? Simply installing the applications and completing registration process revealed instantly that the service is insecure. Yes, in compliance sense "everything is encrypted", but the keys are clearly held server side. The customer has absolutely no control over the key management and storage, meaning they are at F-Secure's mercy, and F-Secure can technically open everything for authorities.

Now the actually interesting part of the story: The problem isn't the implementation. The problem isn't that they marketed it as secure. The important alpha users on this product area are way too savvy, and stayed away. As per the standard innovation diffusion model, they did not drag other users in. Not marketing the service as secure would have yielded better results!

It's funny how even serious software security companies screw things up. Even when they are attempting for a strategic new product positioning, and even when at near clear blue sea situation.

Re: Show HN: InstantCryptor – AES256 Encryption for Dropbox and Google Drive

#18

Post by licobo »

We are using CBC as block cipher mode. I totally understand that open sourcing the complete code is the only way for you to review it and trust it completely. We decided to write a detailed report about the encryption and how we use it and will publish the report soon via Twitter.

Re: Show HN: InstantCryptor – AES256 Encryption for Dropbox and Google Drive

#19

Post by licobo »

licobo wrote: post #18

We are using CBC as block cipher mode. I totally understand that open sourcing the complete code is the only way for you to review it and trust it completely. We decided to write a detailed report about the encryption and how we use it and will publish the report soon via Twitter.

via @cloudrail

Re: Show HN: InstantCryptor – AES256 Encryption for Dropbox and Google Drive

#20

Post by diafygi »

licobo wrote: post #18

We are using CBC as block cipher mode. I totally understand that open sourcing the complete code is the only way for you to review it and trust it completely. We decided to write a detailed report about the encryption and how we use it and will publish the report soon via Twitter.

"We decided to write a detailed report about the encryption and how we use it and will publish the report soon via Twitter."

That doesn't sound like releasing the source code...

Post reply on HN