Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Portable Secret – How I store my secrets and communicate privately

mprimi.github.io

Post reply on HN
Print view View original

281–290 of 385 posts

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#281

Post by mprime1 »

mbwgh wrote: post #250

I keep putting off the decision on how to store my private keys remotely in case of disaster, and this looks like a good and very pragmatic solution. Thanks for creating this! My first reaction was "why not a password-protected zip" and you already linked to a relevant stackexchange question. I think it might be helpful to add a "Why not a password-protected zip/rar/7zip/..." on your page when you have time for it. O…

> "Why not a password-protected zip/rar/7zip/..." on your page

Great suggestion!

> not having to debate this myself

eh eh.. good luck with that...

I think the problem is that it can be used "good" and can be used "bad". Some people focus/fixate on the ways you can shoot yourself in the foot with this. Other think of the good use cases it enables.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#282

Post by Sirened »

distcs wrote: post #180
blintz wrote: post #126

Cool project! This stuff is all possible thanks to the SubtleCrypto API ( https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypt... ), which became widespread in browsers in the last ~5 years. It's so great we don't have to use weird libraries (some with pretty gnarly side channel leakage) to do cryptography anymore. It wouldn't be that crazy for the browser to do the encryption part for me, right? Like, what i…

What level of confidence is there that all this API will work exactly as it works now after 30 years? I am concerned that they might at the very least deprecate and remove the ciphers used to encrypt my data in portable secret. Worse what if they remove support for the API? Then I am going to have HTML files with data I cannot decrypt anymore, right?

Most cryptographic algorithms worth their salt have a pseudo code implementation on Wikipedia too. Just save the article along with the encrypted payload, bam future proofed :)

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#284

Post by mprime1 »

matthewfcarlson wrote: post #239
preillyme wrote: post #236

Interesting... on 2022-12-13 the bounty has been claimed! Just a few hours after mprime1 shared the project in a comment on HackerNews, someone managed to drain the BTC. https://github.com/mprimi/portable-secret/commit/3b22d2b42ba... I'd love to hear more about this.

Right I'd love a post-mortem on it!

Postmortem:

- Bitcoin is hard

- Wallets come with sophisticated anonymization built-in

- Don't create the bounty wallet 20 minutes before posting on HN (if that snafu had happened today while this post was on the front page, I would have looked pretty stupid)

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#285

Post by bryanlarsen »

TedDoesntTalk wrote: post #186
bryanlarsen wrote: post #158

Earlier quoted context omitted.

That is security by obscurity. If somebody knows your method, they can scrape the lyrics for all popular songs, narrow your password down to a few million possible passwords and just try them all.

> to a few million possible passwords The combinations are easily in the trillions, likely much much more. Read the algorithm. An algorithm for password generation is not security by obscurity.

10s of thousands of popular songs, dozens of lines per song.

> Although you have to use the same capitalization rules for all passwords if you have any hope of remembering them.

So no additional combinations from that. Your algorithm is simple and common enough that it's possible that an attacker can figure it out from a single leaked password. With one leaked password they've compromised all of your passwords to anything they have the capability of trying a few million passwords on.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#286

Post by Archelaos »

distcs wrote: post #178
httpz wrote: post #131

If anyone is actually going to use this for their top secrets, I can find two things to be aware of. * When you decrypt then close the tab and open the tab again via the recently closed tab, the password is still there. * Browser extensions could read the contents of the webpage. So if anyone is going to use this, they should do it in a "clean" incognito browser without any extensions.

For me the biggest problem with a setup like this is complete loss of access to my secrets. The crypto functions supported by browsers may change in future. A cipher algorithm used to encrypt my secrets may get deprecated and removed by the browser in future. Then I will be left with a bunch of HTML files with data that the browsers cannot decrypt anymore. GPG or vim -x might be much better choices for secrets that n…

> The crypto functions supported by browsers may change in future.

Legacy versions of Firefox should be available in some archive, nevertheless. For additional security, you may use them on an air gapped system to decrypt our secretes. You need to trust the archive, though (as you need to trust the browser, now).

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#287

Post by SamBam »

_tk_ wrote: post #146

I'm a security professional and this looks like a great tool for OP's use case, especially with strong passwords and great password hints. I think your secrets are well stored - unless your mother stores the password to these files insecurely, a problem that is not new to this solution. This also applies to most if not all challenges mentioned by other posters. Take phishing for example, at the moment all methods to…

> Someone adversarial to me could bribe a number of people to get answers to 10 different password hints.

OP's hints are probably more generous than they need to be. (Indeed, knowing that password is name + flower + name + two-word-thing, plus the fact that there is no limit to the speed you could brute-force this, means that someone could probably make a custom dictionary and break this in a couple days.)

But you can easily have hints and make it harder. In Evernote I store a few passwords to things, and the hints are more opaque ("grey" refers to my old grey cat, for instance) but they're also all prepended with a 15-character master password that changes in subtle ways depending on the service they're used for. This isn't in the hint, it's just in my head.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#288

Post by blintz »

distcs wrote: post #180
blintz wrote: post #126

Cool project! This stuff is all possible thanks to the SubtleCrypto API ( https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypt... ), which became widespread in browsers in the last ~5 years. It's so great we don't have to use weird libraries (some with pretty gnarly side channel leakage) to do cryptography anymore. It wouldn't be that crazy for the browser to do the encryption part for me, right? Like, what i…

What level of confidence is there that all this API will work exactly as it works now after 30 years? I am concerned that they might at the very least deprecate and remove the ciphers used to encrypt my data in portable secret. Worse what if they remove support for the API? Then I am going to have HTML files with data I cannot decrypt anymore, right?

FWIW, symmetric encryption like AES-256 GCM is just astoundingly unlikely to be “broken” in the next ~20 years (or perhaps ever…)

There’s more of a case for public-key stuff changing, but this doesn’t rely on anything public key.

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#289

Post by mprime1 »

j1elo wrote: post #274

The limitation of just 1 file is technical or just for simplicity? I can think of the use case of ID photos where the same single html file contains both sides of the ID, or multiple parts of a more complex document, etc... Having to input the password repeatedly over a multitude of related html files would get cumbersome pretty soon.

Multiple pictures is doable, but adds some complexity to the generated code so decided to do without. Also, there's a trivial workaround (zip file with multiple pictures).

Re: Show HN: Portable Secret – How I store my secrets and communicate privately

#290

Post by thinkloop »

> Some secrets don’t belong in your password manager. Things like backup private keys, 2FS recovery keys, wallet keys, safe combinations, treasure maps, etc.

Why don't wallet keys, safe combinations and treasure maps belong in a password manager?

Post reply on HN