7 ms·

Really weird that nobody in the thread is pointing out that this is basically a website that says "give me your photos, specifically from protests, which have d

by comboy 6y ago

Really weird that nobody in the thread is pointing out that this is basically a website that says "give me your photos, specifically from protests, which have details that you want to keep private". It doesn't matter that it theoretically all happen in the browser. You can serve different versions to different IPs etc. Every heuristic in me would be screaming don't use that if I would have a need for such tool.

aith 6y ago
It's a simple static site with no server involved. Everything happens client side. You could turn off your internet while you're using it if you wanted to make sure no data is exposed.
- dzhiurgis 6y ago
  Would a service worker running in background be able to upload your sensitive data once you are back online?
- KingMachiavelli 6y ago
  True, but it's only safe if you do that. You have to either inspect the code every time you use the site or run it locally. Until subresource integrity [1] becomes widely used & the capability to 'pin' a given script to a specific version, web applications can not be used without at least trusting the owner of the domain. A better example is Protonmail, a secure email service. It has a nice web client and there is an 3rd party desktop/electron version of the same size called Electronmail. While both essentially run identical code, the electron version is more secure because even Protonmail insert a backdoor for a single or # of users. They would have to at least publish the backdoor in the vanilla code at which point, the maintainers of Electronmail will probably raise the alarm. [1] https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
  - rkagerer 6y ago
    Write a little piece of open-source client software to take a hash of the source code. Check the hash every time you use it. Spread the tool around to a community of people who review every time the hash changes and publish (separately) a history of attested hashes.
  - t-writescode 6y ago
    Or, you could download the repository, validate it once for yourself and then use it repeatedly. It is open source, after all.
- vagab0nd 6y ago
  For linux users you can "turn off" internet for a single program: https://news.ycombinator.com/item?id=21146655 https://news.ycombinator.com/item?id=21146655
  - rkeene2 6y ago
    I actually wrote an even better way to do this, since my build system drops network access after downloading SHA-256 validated source (to ensure that source can't go out and fetch more things during build): https://chiselapp.com/user/rkeene/repository/bash-drop-network-access/index https://chiselapp.com/user/rkeene/repository/bash-drop-netwo...
- heavyset_go 6y ago
  A bad actor could selectively serve a different version to those they want to target.
  - abathur 6y ago
    There's no way to obtain and execute source code that you didn't write and hand-compile for which this risk doesn't exist. (And it applies in its own sense to books, paintings, phone calls from mom, letters from an old mentor, DVDs, rental cars, ...)
    - heavyset_go 6y ago
      Download, verify keys and signatures. You could run a checksum or even read the code yourself depending on how paranoid you are. Otherwise, you're just hoping mycrimepics.net/dontsnitch wasn't subpoenaed between your last visit and now.
movedx 6y ago
If it's all served in the browser, then simply download the page and use it offline.
- jakeva 6y ago
  I just confirmed the downloaded page works offline
- Polylactic_acid 6y ago
  In this case thats probably fine. It does remind me of a time when a bitcoin keygen site was declared safe because it didn't make any network requests. Only to find out later that it had a malicious random number generator that generated predictable keys. In this case its possible that the site encodes the data back in to the image but that seems unlikely.
  - deleted 6y ago
    [deleted]
dmart 6y ago
It's a static site running on GitHub pages, over HTTPS, directly out of a linked repo so you can examine the source code. I literally could not imagine a more transparent way to serve this application. The only way an attack vector is possible here is if you think GitHub themselves would maliciously inject an altered version of the code in the repo, and even then you'd be able to see the code and network requests in your developer tools.
- CivBase 6y ago
  > I literally could not imagine a more transparent way to serve this application. Just distribute the code for local execution? Sure, it's less accessable for the target audience, but it is more transparent. But what else is new? Most users are willing to sacrifice privacy and security for convenience. That's how we got into this whole mess.
  - techntoke 6y ago
    People are free to use the source code and run it themselves.
  - morsch 6y ago
    > Just distribute the code for local execution? I mean, I get what you mean, but this is literally what's already happening. It's distributed via HTTP, and executed in your browser. You can save it (Ctrl-S, still a thing browsers do), and -- since it's distributed in source form -- easily inspect it, or reopen it later, in a different browser on a different computer. A zip file of the same thing is available on the repo (it's a zip of the repo). If you don't trust that it won't access the web, disable your internet while running it or some such, as with other code you don't trust. If you don't trust it to mess with your files, well, you're in luck because modern browsers are probably the best audited sandbox out there. I say I get what you mean, because most people won't do any of it. Instead of saving the page and running what they trust or have verified to be a safe snapshot of the page, they'll reopen the hosted version, trusting that it's still safe, even though the page may have been replaced with one that does upload their files.
  - 6y ago
vagab0nd 6y ago
Can you imagine yourself being convinced somehow that this is safe to use? I've had similar ideas before that I ended up not pursuing precisely because I knew I couldn't find a way to convince people like you. See also https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords.
- mulmen 6y ago
  haveibeenpwned is explicit about not entering passwords you use. If you want to check a password that you intend to use then download the database and check for yourself.
  - vagab0nd 6y ago
    I don't get it. If I check for a password I used before, presumably I want to keep using it if it's safe. Otherwise what's the point?
    - abathur 6y ago
      FWIW, I don't think the post you're responding to is correct? At least, I couldn't readily find a place where HIBP tells me not to fill in the form. And it bothers assuring me that it goes to great lengths not to make it obvious what password my client is checking. Your question is on target--one I've wondered myself--but I've come to the conclusion that it isn't for people who already have the sense not to put their passwords in random forms on the internet. I can only assume it has 2 main uses: 1. Poke (some) holes in the bubbles of people with dated password hygiene practices (and a poor sense of how good other humans are at helping attackers reduce the possibility space) by giving them a playground to make new passwords against for a while. For example, I decided to enter "silverfish3" in the form because I know more than one person who still uses <noun><number> passwords that are multiple characters shorter than this one. It's still turned up in the database 40 times. "dichotomy14" hasn't been pwned yet, but "dichotomy7" has already been pwned 5 times. You don't have to use a real password of your own to discover that your schema is well explored. 2. I can only hope HIBP password search has scared a few thousand of the kind of person naive enough to fill in the form with a real password straight.
closeparen 6y ago
Imagine how much scarier it would be if it wanted to run code natively on your machine, outside the browser sandbox.
- heavyset_go 6y ago
  I have a many sandbox and virtualization tools at my disposal that are both more comprehensive and flexible than a browser sandbox.
  - abathur 6y ago
    Are you packaging these sandbox and virtualization tools for normies to use from their smartphones? (Sorry for commenting on you twice in this thread--I promise I'm not trying to follow you around. I'm all about dissecting the quality of a system or toolchain! A false sense of security can be more dangerous than naïveté! Caution and skepticism are often our only protection! Trusting random websites is Not a Good Idea! But, security tools average people can't use are also meaningless here.)
deleted 6y ago
[deleted]
pwdisswordfish2 6y ago
Isn't this the same issue as with a website like HIBP, and other sites that appear after a data breach/leak? Users are disclosing to the website what they hope has not been discovered by someone else -- e.g., usernames and email addresses, or in this case photos, they hoped to keep private. Unfortunately, the website is "someone else".

by comboy 6y ago

aith 6y ago

It's a simple static site with no server involved. Everything happens client side. You could turn off your internet while you're using it if you wanted to make sure no data is exposed.

dzhiurgis 6y ago
Would a service worker running in background be able to upload your sensitive data once you are back online?
KingMachiavelli 6y ago
True, but it's only safe if you do that. You have to either inspect the code every time you use the site or run it locally. Until subresource integrity [1] becomes widely used & the capability to 'pin' a given script to a specific version, web applications can not be used without at least trusting the owner of the domain. A better example is Protonmail, a secure email service. It has a nice web client and there is an 3rd party desktop/electron version of the same size called Electronmail. While both essentially run identical code, the electron version is more secure because even Protonmail insert a backdoor for a single or # of users. They would have to at least publish the backdoor in the vanilla code at which point, the maintainers of Electronmail will probably raise the alarm. [1] https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
- rkagerer 6y ago
  Write a little piece of open-source client software to take a hash of the source code. Check the hash every time you use it. Spread the tool around to a community of people who review every time the hash changes and publish (separately) a history of attested hashes.
- t-writescode 6y ago
  Or, you could download the repository, validate it once for yourself and then use it repeatedly. It is open source, after all.
vagab0nd 6y ago
For linux users you can "turn off" internet for a single program: https://news.ycombinator.com/item?id=21146655 https://news.ycombinator.com/item?id=21146655
- rkeene2 6y ago
  I actually wrote an even better way to do this, since my build system drops network access after downloading SHA-256 validated source (to ensure that source can't go out and fetch more things during build): https://chiselapp.com/user/rkeene/repository/bash-drop-network-access/index https://chiselapp.com/user/rkeene/repository/bash-drop-netwo...
heavyset_go 6y ago
A bad actor could selectively serve a different version to those they want to target.
- abathur 6y ago
  There's no way to obtain and execute source code that you didn't write and hand-compile for which this risk doesn't exist. (And it applies in its own sense to books, paintings, phone calls from mom, letters from an old mentor, DVDs, rental cars, ...)
  - heavyset_go 6y ago
    Download, verify keys and signatures. You could run a checksum or even read the code yourself depending on how paranoid you are. Otherwise, you're just hoping mycrimepics.net/dontsnitch wasn't subpoenaed between your last visit and now.

movedx 6y ago

If it's all served in the browser, then simply download the page and use it offline.

jakeva 6y ago
I just confirmed the downloaded page works offline
Polylactic_acid 6y ago
In this case thats probably fine. It does remind me of a time when a bitcoin keygen site was declared safe because it didn't make any network requests. Only to find out later that it had a malicious random number generator that generated predictable keys. In this case its possible that the site encodes the data back in to the image but that seems unlikely.
- deleted 6y ago
  [deleted]

dmart 6y ago

It's a static site running on GitHub pages, over HTTPS, directly out of a linked repo so you can examine the source code. I literally could not imagine a more transparent way to serve this application. The only way an attack vector is possible here is if you think GitHub themselves would maliciously inject an altered version of the code in the repo, and even then you'd be able to see the code and network requests in your developer tools.

CivBase 6y ago
> I literally could not imagine a more transparent way to serve this application. Just distribute the code for local execution? Sure, it's less accessable for the target audience, but it is more transparent. But what else is new? Most users are willing to sacrifice privacy and security for convenience. That's how we got into this whole mess.
- techntoke 6y ago
  People are free to use the source code and run it themselves.
- morsch 6y ago
  > Just distribute the code for local execution? I mean, I get what you mean, but this is literally what's already happening. It's distributed via HTTP, and executed in your browser. You can save it (Ctrl-S, still a thing browsers do), and -- since it's distributed in source form -- easily inspect it, or reopen it later, in a different browser on a different computer. A zip file of the same thing is available on the repo (it's a zip of the repo). If you don't trust that it won't access the web, disable your internet while running it or some such, as with other code you don't trust. If you don't trust it to mess with your files, well, you're in luck because modern browsers are probably the best audited sandbox out there. I say I get what you mean, because most people won't do any of it. Instead of saving the page and running what they trust or have verified to be a safe snapshot of the page, they'll reopen the hosted version, trusting that it's still safe, even though the page may have been replaced with one that does upload their files.
- 6y ago

vagab0nd 6y ago

Can you imagine yourself being convinced somehow that this is safe to use? I've had similar ideas before that I ended up not pursuing precisely because I knew I couldn't find a way to convince people like you. See also https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords.

mulmen 6y ago
haveibeenpwned is explicit about not entering passwords you use. If you want to check a password that you intend to use then download the database and check for yourself.
- vagab0nd 6y ago
  I don't get it. If I check for a password I used before, presumably I want to keep using it if it's safe. Otherwise what's the point?
  - abathur 6y ago
    FWIW, I don't think the post you're responding to is correct? At least, I couldn't readily find a place where HIBP tells me not to fill in the form. And it bothers assuring me that it goes to great lengths not to make it obvious what password my client is checking. Your question is on target--one I've wondered myself--but I've come to the conclusion that it isn't for people who already have the sense not to put their passwords in random forms on the internet. I can only assume it has 2 main uses: 1. Poke (some) holes in the bubbles of people with dated password hygiene practices (and a poor sense of how good other humans are at helping attackers reduce the possibility space) by giving them a playground to make new passwords against for a while. For example, I decided to enter "silverfish3" in the form because I know more than one person who still uses <noun><number> passwords that are multiple characters shorter than this one. It's still turned up in the database 40 times. "dichotomy14" hasn't been pwned yet, but "dichotomy7" has already been pwned 5 times. You don't have to use a real password of your own to discover that your schema is well explored. 2. I can only hope HIBP password search has scared a few thousand of the kind of person naive enough to fill in the form with a real password straight.

closeparen 6y ago

Imagine how much scarier it would be if it wanted to run code natively on your machine, outside the browser sandbox.

heavyset_go 6y ago
I have a many sandbox and virtualization tools at my disposal that are both more comprehensive and flexible than a browser sandbox.
- abathur 6y ago
  Are you packaging these sandbox and virtualization tools for normies to use from their smartphones? (Sorry for commenting on you twice in this thread--I promise I'm not trying to follow you around. I'm all about dissecting the quality of a system or toolchain! A false sense of security can be more dangerous than naïveté! Caution and skepticism are often our only protection! Trusting random websites is Not a Good Idea! But, security tools average people can't use are also meaningless here.)

deleted 6y ago

[deleted]

pwdisswordfish2 6y ago

Isn't this the same issue as with a website like HIBP, and other sites that appear after a data breach/leak? Users are disclosing to the website what they hope has not been discovered by someone else -- e.g., usernames and email addresses, or in this case photos, they hoped to keep private. Unfortunately, the website is "someone else".