Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password protect a static HTML page, decrypted in-browser in JavaScript

github.com

Post reply on HN
Print view View original

31–40 of 48 posts

Re: Password protect a static HTML page, decrypted in-browser in JavaScript

#31

Post by jszymborski »

yoble wrote: post #26
jszymborski wrote: post #15

Another interesting project allows you to do a similar thing with Hugo. I'm a bit nervous to use these myself but seems useful for some limited, non-serious use cases. https://github.com/Izumiko/hugo-encrypt

Looks cool! And I like the effort you put in making your readme clear and covering many possible configs too, it feels very easy to read to me. Would you be okay with me listing your project in the Community and Alternatives[1] section of the StatiCrypt readme? [1] https://github.com/robinmoisson/staticrypt#community-and-alt...

I didn't make this :)

Re: Password protect a static HTML page, decrypted in-browser in JavaScript

#33

Post by yoble »

jszymborski wrote: post #31
yoble wrote: post #26

Earlier quoted context omitted.

Looks cool! And I like the effort you put in making your readme clear and covering many possible configs too, it feels very easy to read to me. Would you be okay with me listing your project in the Community and Alternatives[1] section of the StatiCrypt readme? [1] https://github.com/robinmoisson/staticrypt#community-and-alt...

I didn't make this :)

Then I'll go ahead and list it there. Thank you for sharing the project!

Re: Password protect a static HTML page, decrypted in-browser in JavaScript

#34

Post by ranger_danger »

yoble wrote: post #22
Rygian wrote: post #2

> returns a static HTML page showing a password prompt that you can now safely upload anywhere Anywhere that you trust, and where the page is hosted securely. For example, a malicious hosting service could alter the password prompt. Or the page as a whole could be put in a frame with a transparent overlay.

(author here) Yeah, or if it's on http someone could MITM and change the script, or if they are malicious extension on the browser the content can be stolen after decryption. That felt implicitly obvious to me, but I think you're right and it wouldn't hurt to put those assumptions in the FAQ. Thanks for the feedback! (If you, or someone else, see other attack vectors, feel free to comment with those)

a supply-chain attack where malicious JS is delivered to the user (even from your own server, as the author of the software, maybe you got hacked yourself for example) is another way

Re: Password protect a static HTML page, decrypted in-browser in JavaScript

#35

Post by whycombagator »

yoble wrote: post #28
whycombagator wrote: post #10

Similar project that supports files: https://github.com/mprimi/portable-secret

Oh cool that looks awesome thanks for sharing! Are you the maintainer? I saw that StatiCrypt is listed is the alternative section of your README, I'll do the same on StatiCrypt (and add a bunch of the one listed there that I didn't know about!) The "Alternatives" section of StatiCrypt has always felt a bit empty to me, I'm glad to discover all those great looking projects and beef it up a bit. :)

The maintainer is https://news.ycombinator.com/user?id=mprime1

Re: Password protect a static HTML page, decrypted in-browser in JavaScript

#36

Post by indigodaddy »

rafram wrote: post #8
Rygian wrote: post #2

> returns a static HTML page showing a password prompt that you can now safely upload anywhere Anywhere that you trust, and where the page is hosted securely. For example, a malicious hosting service could alter the password prompt. Or the page as a whole could be put in a frame with a transparent overlay.

Clickjacking has been a solved problem for over a decade. Set X-Frame-Options: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-...

or even better CSP options no?

Re: Password protect a static HTML page, decrypted in-browser in JavaScript

#37

Post by iAMkenough »

rafram wrote: post #8
Rygian wrote: post #2

> returns a static HTML page showing a password prompt that you can now safely upload anywhere Anywhere that you trust, and where the page is hosted securely. For example, a malicious hosting service could alter the password prompt. Or the page as a whole could be put in a frame with a transparent overlay.

Clickjacking has been a solved problem for over a decade. Set X-Frame-Options: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-...

How do I set this in a shared hosting environment like GoDaddy?

Re: Password protect a static HTML page, decrypted in-browser in JavaScript

#38

Post by sowbug »

yoble wrote: post #25
sowbug wrote: post #18

Similar (but also for a narrower use case with fewer features): https://github.com/sowbug/quaid It wraps a JS implementation of only the decryption side of GPG symmetric encryption, so there's less opportunity for the tool itself to introduce security errors.

That looks cool! Do you mind if I list in the Community and Alternatives[1] section of the StatiCrypt readme? [1] https://github.com/robinmoisson/staticrypt#community-and-alt...

Go right ahead. Thanks!

Re: Password protect a static HTML page, decrypted in-browser in JavaScript

#39

Post by rubendev »

iAMkenough wrote: post #37
rafram wrote: post #8

Earlier quoted context omitted.

Clickjacking has been a solved problem for over a decade. Set X-Frame-Options: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-...

How do I set this in a shared hosting environment like GoDaddy?

You can set a CSP in the HTML head section using a meta http-equiv tag. It has similar functionality to X-frame-options IIRC.

Re: Password protect a static HTML page, decrypted in-browser in JavaScript

#40

Post by mprime1 »

yoble wrote: post #28
whycombagator wrote: post #10

Similar project that supports files: https://github.com/mprimi/portable-secret

Oh cool that looks awesome thanks for sharing! Are you the maintainer? I saw that StatiCrypt is listed is the alternative section of your README, I'll do the same on StatiCrypt (and add a bunch of the one listed there that I didn't know about!) The "Alternatives" section of StatiCrypt has always felt a bit empty to me, I'm glad to discover all those great looking projects and beef it up a bit. :)

Thank you for the link GP!

I’m the ‘maintainer’ but I’m hands off and not planning on significant improvements.

Discussion on HN was also quite interesting and you may find some ideas: https://news.ycombinator.com/item?id=34083366

I also recently presented this at HOPE(.net) and was very well received by a technical crowd so congrats on independently inventing the same thing ;-)

Post reply on HN