Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password protect a static HTML page, decrypted in-browser in JavaScript

github.com

Post reply on HN
Print view View original

41–48 of 48 posts

Re: Password protect a static HTML page, decrypted in-browser in JavaScript

#41

Post by atVelocet »

yoble wrote: post #22
Rygian wrote: post #2

> returns a static HTML page showing a password prompt that you can now safely upload anywhere Anywhere that you trust, and where the page is hosted securely. For example, a malicious hosting service could alter the password prompt. Or the page as a whole could be put in a frame with a transparent overlay.

(author here) Yeah, or if it's on http someone could MITM and change the script, or if they are malicious extension on the browser the content can be stolen after decryption. That felt implicitly obvious to me, but I think you're right and it wouldn't hurt to put those assumptions in the FAQ. Thanks for the feedback! (If you, or someone else, see other attack vectors, feel free to comment with those)

Would it help to employ the ssl cert in the encryption/decryption process and use it as an IV or so?

Re: Password protect a static HTML page, decrypted in-browser in JavaScript

#42

Post by cute_boi »

rafram wrote: post #8
Rygian wrote: post #2

> returns a static HTML page showing a password prompt that you can now safely upload anywhere Anywhere that you trust, and where the page is hosted securely. For example, a malicious hosting service could alter the password prompt. Or the page as a whole could be put in a frame with a transparent overlay.

Clickjacking has been a solved problem for over a decade. Set X-Frame-Options: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-...

is it not by default? If no, then i would consider it as a bad design.

Re: Password protect a static HTML page, decrypted in-browser in JavaScript

#43

Post by lelandfe »

rubendev wrote: post #39
iAMkenough wrote: post #37

Earlier quoted context omitted.

How do I set this in a shared hosting environment like GoDaddy?

You can set a CSP in the HTML head section using a meta http-equiv tag. It has similar functionality to X-frame-options IIRC.

Alas, no. ‘frame-ancestors’ does not work in meta. There is no reliable way to prevent click jacking if you are just editing the HTML. That makes sense: in order for these meta directives to even be enacted the HTML will have already begun to download and be parsed.

The old school way is comparing the top level URL with JS and redirecting but there are ways to deal with that

Re: Password protect a static HTML page, decrypted in-browser in JavaScript

#44

Post by remram »

atVelocet wrote: post #41
yoble wrote: post #22

Earlier quoted context omitted.

(author here) Yeah, or if it's on http someone could MITM and change the script, or if they are malicious extension on the browser the content can be stolen after decryption. That felt implicitly obvious to me, but I think you're right and it wouldn't hurt to put those assumptions in the FAQ. Thanks for the feedback! (If you, or someone else, see other attack vectors, feel free to comment with those)

Would it help to employ the ssl cert in the encryption/decryption process and use it as an IV or so?

No. The attacker can mock that just as easily.

Re: Password protect a static HTML page, decrypted in-browser in JavaScript

#46

Post by dxxvi »

arcfour wrote: post #6
dxxvi wrote: post #3

This is what I'm looking for: a way to put something in public (I'm using Vercel) that "only" me can access (anybody who can decrypt it doesn't need the content that I encrypt).

So you're looking for an authentication and authorization system.

That's incorrect: I'm looking for a tool that takes a html page, encrypts the content, generates another html page which has some js to decrypt what was encrypted before and puts the decrypted content back in the body of the html page.
Post reply on HN