How long should the password be to make this safe from brute force attack?
Password protect a static HTML page, decrypted in-browser in JavaScript
11–20 of 48 posts
Re: Password protect a static HTML page, decrypted in-browser in JavaScript
#12Built the same thing, but with a slightly different focus: Have the result as small as possible, so assuming you can trust your browser you can audit the received HTML file prior to entering your password: https://github.com/dividuum/html-vault
Re: Password protect a static HTML page, decrypted in-browser in JavaScript
#13How long should the password be to make this safe from brute force attack?
The FAQ recommends a minimum of 16 chars. Obviously it depends on your threat model.
Re: Password protect a static HTML page, decrypted in-browser in JavaScript
#14Re: Password protect a static HTML page, decrypted in-browser in JavaScript
#15Another interesting project allows you to do a similar thing with Hugo. I'm a bit nervous to use these myself but seems useful for some limited, non-serious use cases.
Re: Password protect a static HTML page, decrypted in-browser in JavaScript
#16In the old days, we used .htaccess and htpasswd for that.
Re: Password protect a static HTML page, decrypted in-browser in JavaScript
#17I used this before and it was really decent, actually had it as a build step on some dev preview stuff. Only moved to basic auth because getting it to remember people through re-deploys was a faff so it became annoying when it wasn’t working (I’m aware it has a solution to this problem but it wasn’t really working for me easily)
Re: Password protect a static HTML page, decrypted in-browser in JavaScript
#18Similar (but also for a narrower use case with fewer features): https://github.com/sowbug/quaid
It wraps a JS implementation of only the decryption side of GPG symmetric encryption, so there's less opportunity for the tool itself to introduce security errors.
Re: Password protect a static HTML page, decrypted in-browser in JavaScript
#19Author here. I was wondering why I was seeing plenty of people from github on my meditation website so I checked HN, hi!
Happy to answer any question you might have, and feel free to offer feedback too.
(Last time this got posted to HN[1] was really productive in improving the project, thanks!)
Re: Password protect a static HTML page, decrypted in-browser in JavaScript
#20Author here. I was wondering why I was seeing plenty of people from github on my meditation website so I checked HN, hi! Happy to answer any question you might have, and feel free to offer feedback too. (Last time this got posted to HN[1] was really productive in improving the project, thanks!) [1] https://news.ycombinator.com/item?id=34849024
Well done on getting your project linked here again on HN.
> I was wondering why I was seeing plenty of people from github on my meditation website so I checked HN, hi!
I'm curious: how did you notice this? You happened to be viewing your website stats or your analytics tool was setup to notify you when you receive a surge of traffic :)?