Password protect a static HTML page • Hacker News Board

Re: Password protect a static HTML page

#291

Post by efreak » Tue, Feb 21, 2023, 8:34 PM UTC

efreak wrote: post #290

chii wrote: post #223

Earlier quoted context omitted.

> you also need a program that can decrypt/encrypt that format that's just a self-extracting archive, which is a very common idea and easily created as well (very popular with both shareware distribution). The problem is that you have to trust the extracting code to not install anything else malicious. The browser provides the perfect sandbox - you cannot install malware into the system via javascript in the browser,…

And you have to trust that running processes on dish aren't going to make a copy of it. Or that it won't end up stuck in the cache. This is (theoretically) only decrypted in memory (your browser may save a preview image of the tab, I believe Firefox mobile does this, not sure about desktop browsers)

Also, your self-extracting archive isn't platform independent, and likely can't be used at all on mobile platforms (iOS, Android) that don't offer to trying anyway files ootb (and are probably the wrong architecture anyways)

Re: Password protect a static HTML page

#292

Post by efreak » Tue, Feb 21, 2023, 8:44 PM UTC

tptacek wrote: post #78

pdq wrote: post #24

Earlier quoted context omitted.

Client side decryption has the benefit that no machine or router in the middle can view or cache the decrypted page without the password.

You mean, unless they tamper with the Javascript to capture the password (or the derived key).

Valid if you actually host the file online. Local files are generally not allowed to make requests. Not sure if local storage methods are usable without http/s.

Re: Password protect a static HTML page

#293

Post by cubefox » Wed, Feb 22, 2023, 4:58 PM UTC

scarface74 wrote: post #60

cubefox wrote: post #10

Earlier quoted context omitted.

I would call any server side or client side code which alters the HTML non-static. A static HTML page is just an HTML file which is stored on the server and displayed as-is in the browser.

That’s not a generally accepted as the definition of a static page. https://docs.aws.amazon.com/AmazonS3/latest/userguide/Websit... > You can use Amazon S3 to host a static website. On a static website, individual webpages include static content. They might also contain client-side scripts. By contrast, a dynamic website relies on server-side processing, including server-side scripts, such as PHP, JSP, or ASP.NET. Am…

Naturally Amazon doesn't care about client site code, as they are not in the browser business. But JavaScript is in fact typically called "dynamic" content. Insofar it is not static.

Re: Password protect a static HTML page

#294

Post by Smar » Wed, Feb 22, 2023, 5:31 PM UTC

bloqs wrote: post #277

pluc wrote: post #58

Earlier quoted context omitted.

Leave it to full-stack devs to take care of cryptography

As a newer dev later in life, I love to learn about inter-disciplinary snobbery/riffing. I learned some of what I know from a full stack dev, who was convinced anyone who couldnt do everything "was shit" and "should be something easier like a web developer or IT guy" instead. I'm excited to learn that pure disciplines also look down on full stack devs

There is tons of different types of programming out there.