2 ms·
I have been working on this on and off for a couple of months and finally after seeing a similar idea submitted last week (http://news.ycombinator.com/item?id=3
by samwillis 15y ago
I have been working on this on and off for a couple of months and finally after seeing a similar idea submitted last week (http://news.ycombinator.com/item?id=3832269 http://news.ycombinator.com/item?id=3832269) I finished it over the weekend. It's a bit of an experiment with the idea that the server doesn't need or want to know what the content is that is being posted by the users, the page is encrypted and decrypted in the users browser using a key in the url's fragment identifier.
You can see an example document here: https://cryptpage.com/Cvni#GTP9LXTSI1LV5FKlkO8Dpd https://cryptpage.com/Cvni#GTP9LXTSI1LV5FKlkO8Dpd
The main difference with this to the one last week is that by building it around a Markdown editor it becomes a platform for publishing nicely formatted content on-line in a free and secure manner.
I am not sure who the market for it is yet and I built it mostly to scratch an itch and learn some new tools. I would love to hear what you think!
Some possible things on the to-do list for it:
- Using the HTML5 file system API and DataURL's to allow people to select an image on their computer to embed into the page. Although I am a little nervous about this and how it could be abused.
- Have an option of a wysiwyg editor for editing the pages.
- Allow optional commenting on pages in a way that is also encrypted.
- Allow people to attach small files again using the HTML5 file system API and DataURL's.
- pfraze 15y agoWell done. I kind of doubt you can monetize this app on its own (famous last words) but you can certainly gain cred for popularizing the technique.
- tptacek 15y agoThe URL fragment identifier seems like exactly the last place you'd want to stick a crypto key, in that it's displayed in the URL bar and in no way protected by the browser.
- clarkmoody 15y agoIt would be nice for a box to pop up if the key is not detected in the hash, asking for the decryption key (and password if that's set). That way, you enable two types of users: * The "I just don't want the server to have this stored in plaintext" type. * The "I'll send you the URL now and the key via some secure channel" type. Also, if you browse incognito, then there shouldn't be a browser history containing the keys.
- pwpwp 15y agoI don't know. The cryptographer Zooko Wilcox-O'Hearn keeps cryptographic capabilities in his browser bookmarks, too. http://www.mail-archive.com/cryptography@metzdowd.com/msg10786.html http://www.mail-archive.com/cryptography@metzdowd.com/msg107...
- tptacek 15y agoI have no idea what this appeal to authority is supposed to mean in this particular context. If Zooko is bookmarking crypto keys, he too is doing something dumb. The URL fragment identifier is what it is. It is not a security feature.
- tptacek 15y agoI think I might have taken that exchange too literally. :)