4 ms·
Show HN: ETSD – Transmit sensitive data encrypted across your organization
- spapas82 5y agoHello friends, this is a Django project that we are going to use to submit sensitive data across the departments of our (public sector) organization. It uses Openpgp.js to encrypt/decrypt all files locally to the users's browsers and tries to make the PGP experience as flawless as possible for non-techical people. I'm submitting it in case anybody finds it useful for his organization but also if somebody would like to take a peek and give me any security related feedback. Thank you!
- henryackerman 5y agoWhy did you opt for PGP? If I understand correctly, your system inherits the lack of PFS.
- spapas82 5y agoYes there's no PFS in ETSD. The data is encrypted with the recipient's public key as normally in PGP so if the private key is compromised then the malicious user can decrypt all messages that were encrypted with that key (if he also gets access to the server holding the ciphers of course). We wanted to use PGP because it's a well known and heavily tested solution. Also, the openpgp.js library is great and makes it really easy to encrypt/decrypt the messages to the client side without the need to really mess with security stuff. Finally, the users would want to have access to their old messages in the future so using ephemeral keys for each transmission wasn't really possible.
- upofadown 5y agoThis seems to be primarily for forwarding files. It is unlikely that the users would want to get rid of the files after transfer. Any attack intense enough to get access to the passphrase for the secret key (keylogger) will pretty much for sure give access to the files on the system involved at the time of attack (including insecurely deleted files) and any files that exist on the system going forward. The whole thing is generally more secure then many of these file transfer things due to the use of the passphrase. The idea of strongly protecting the secret key against local attacks is a PGPism that tends to be forgotten these days.
- spapas82 5y agoYes, this will be used in our organization to transfer various documents (mainly pdf/word files) that contain sensitive data (i.e medical conditions of colleagues).
- unixhero 5y agoHi, it would be useful if you can document the end user journey and the administrator user journey in the form of screenshots in your github repo. Cheers
- spapas82 5y agoThank you for the suggestion, I'll get to it ASAP.
- adontz 5y agoI am confused, is private key actually uploaded to server or just imported into client java script?
- spapas82 5y agoThe private key is not uploaded to the server, only the public key. It is loaded to the client javascript (localStorage) as you say. Also both the encryption and decryption are performed client side. The result is that if the server is compromised no data should be leaked.
- upofadown 5y agoThen that brings up the question; how is the private key backed up and does it need to be backed up? Or does the loss of the data on a system mean you start over for that system?
- spapas82 5y agoYes that's right. The backing up of the private key and its passphrase is done out of this application. So if an authority loses access to its private key then they need to generate a new key pair and start over. Of course they will lose access to all the files that are stored in the server and have been encrypted with that key's pair (unless they have already downloaded them and saved then in a different place).
- c22 5y agoIf the server is compromised what's to stop an attacker from replacing the end-user javascript with a malicious payload and quietly waiting for it to steal the keys?
- spapas82 5y agoYes you are right, nothing. However that is a different and much more difficult kind of attack than the common one where an attacker retrieves all the files stored on the server and goes away. Also I'm really not sure if such a determined attacker could be stopped somehow... Any suggestions?
- deleted 5y ago[deleted]