Show HN: html-vault – create self-contained HTML for password protected content • Hacker News Board

Re: Show HN: html-vault – create self-contained HTML for password protected content

#21

Post by dividuum » Wed, Jan 15, 2020, 11:30 AM UTC

mc3 wrote: post #13

dividuum wrote: post #5

Earlier quoted context omitted.

That's very much by design. The idea is that even if the file is stolen, a good password should still protect against a lot of bruteforcing.

By design? Or running code in the browser is inefficient? (not your fault, that's the way it is) Keepass (Desktop app) for example doesn't take ages to open.

Yes: By design. This helps make brute forcing the password harder by forcing each attempt to take a while. The crypto implementation in the browser itself is pretty fast.

You can easily make it faster or instantaneous by lowering the number of PBKDF2 rounds in the html-vault script. The default of 20 million seems a bit excessive based on the feedback so far.

Re: Show HN: html-vault – create self-contained HTML for password protected content

#22

Post by maxlaumeister » Wed, Jan 15, 2020, 10:44 PM UTC

Tepix wrote: post #18

maxlaumeister wrote: post #15

Hey! I also made something similar to this (uses a password-derived key to create protected, self-contained HTML). https://www.maxlaumeister.com/pagecrypt/ Mine was originally in-browser, but thanks to some contributors (Zoltán Gálli and Nial Francis) it has Python and PowerShell CLIs now. I like your use of async to make sure the work stays off the main thread.

I like it! Works well. Do you see a way to reduce the required code?

I just glanced through it again, and it seems to me that aside from styling, every section of code fulfills an important purpose. But it could definitely benefit from being more broken out into components and library-like, so that the only code surfaced in index.html is the UI code.

Re: Show HN: html-vault – create self-contained HTML for password protected content

#23

Post by Tepix » Fri, Jan 17, 2020, 9:09 AM UTC

maxlaumeister wrote: post #22

Tepix wrote: post #18

Earlier quoted context omitted.

I like it! Works well. Do you see a way to reduce the required code?

I just glanced through it again, and it seems to me that aside from styling, every section of code fulfills an important purpose. But it could definitely benefit from being more broken out into components and library-like, so that the only code surfaced in index.html is the UI code.

Looks like your code predates the Web Crypto API, so switching over to that should get rid of more than half the code. Right?