mprime1

14 ms·

121.
by mprime1 4y ago
I'm willing to sweeten the deal. What amount of money would make you actually try to crack it?
122.
by mprime1 4y ago
All words appear in some wordlist. This is the kind of password I use to protect my actual secrets. So if someone is able to crack it, I'd like to know. The bounty is for a 'realistic' use case.
123.
by mprime1 4y ago
Indeed, it's functionally similar to password-protected PDF or ZIP for some use cases . You should probably not treat password-protected zips as secure: https://security.stackexchange.com/questions/35818/are-
124.
by mprime1 4y ago
Definitely intended for more technical audiences, lots of sharp edges.
125.
by mprime1 4y ago
2 sides of obsolescence: - Too old, no software can decrypt it: not worried about this. These are NIST-standard algorithms, there built-in in most programming languages, they'll be around for a while - Too old, trivial to crack: this i
126.
by mprime1 4y ago
It's been a while and I don't remember the details. All I remember is that I was developing the secret 'creator' code using Brave (my default unsecured browser) and at some point I had to switch to Safari (which I normal
127.
by mprime1 4y ago
Exactly one of the reasons I came up with this. One way to see this is "like encrypted PDF, but for any kind of file".
128.
by mprime1 4y ago
It's not a service. It's a simple hack and I use it for 3-4 use cases for which no service exists. Among other things: - It works offline - My mom can use it - It works on any device (even a borrowed one or a newly formatted one)
129.
by mprime1 4y ago
$400 or $0? I don't think of it as PR/Ad. It's a bounty. If you put in time to find a flaw, you deserve at least that much (and I'll give you more if you help me fix it).
130.
by mprime1 4y ago
Because it seems too simple to be secure. (People are busy, attention is scarce, etc)
131.
by mprime1 4y ago
You are right, I'm conflating 2 issues. I'm pretty sure Brave was blocking window.crypto but can't remember if it was on a file or over plain HTTP
132.
by mprime1 4y ago
Gotcha. Thank you. IDK about including a full HTML into a QR code (how would you even open it? Wouldn't a reader get confused expecting a URL or plain string?) But... You can publish portable secrets on your website (just make sure the
133.
by mprime1 4y ago
And you can compose them from "pre shared" secrets. For example, the password hint for a secret I send to my sister: - The name of our neighbors cat - The name of your first boyfriend who scratched dad's car - Mom's nick
134.
by mprime1 4y ago
Interesting, thanks for saying something. I'm also not a web dev, but I think I can manage to clear out the password once the secret is decrypted successfully.
135.
by mprime1 4y ago
Yes. If that wasn't the case, then "HTML virus" would be a thing: I send you an HTML file and, if you open it, it read files from your hard drive and uploads them to my server.
136.
by mprime1 4y ago
This is not meant as a solution. It's a demo of a self-contained, self-extracting, portable encrypted file. That said, the password strength and the strength of the side-channel to transmit it depend on your use case. If we were friend
137.
by mprime1 4y ago
Sounds cool! All I wanted to show with this project is the concept of self-contained, self-extracting, super-portable secrets.
138.
by mprime1 4y ago
If it's any consolation, it's on the TODO list (not a web/JS developer if it wasn't clear from the crappy CSS)
139.
by mprime1 4y ago
Do you mind expanding? Specifically, what do you mean by de-golfed (I'm only vaguely aware of what 'kids' mean by code-golf these days, and I'm kinda lost on de-golfing). What would you like to fit into a QR code? A Port
140.
by mprime1 4y ago
Brave and Safari that I know of. i.e. if you run the creator with a simple HTTP server on localhost:8080 it'll block the fetch to localhost:8080/foo
141.
by mprime1 4y ago
The first few times I shared this with (security professional) colleagues and friends, they'd dismiss it right away "this can't possibly work", but it was because they _assumed_ it didn't work (too simple). Attachin
142.
Show HN: Portable Secret – How I store my secrets and communicate privately(mprimi.github.io)
1290 points by mprime1 4y ago|376 comments
143.
PortableSecret: Better privacy with the tools you already have(github.com)
3 points by mprime1 4y ago|1 comments
144.
by mprime1 4y ago
Hello HN, I'm sharing a little trick I use to store & carry important secrets, and communicate privately over non-secure channels.
145.
by mprime1 4y ago
https://web.archive.org/web/20221218223056/https://help.twit...
146.
by mprime1 4y ago
Update: funds were not stolen. PortableSecret wasn't cracked (yet)! What happened is: the wallet app I'm using automatically performs CoinJoin[1] when funds are received (In fact, this is their business model! They take 0.3% of th
147.
by mprime1 4y ago
Interesting! I suspected the attack vector was my poor use of BTC rather than someone cracking AES so quickly, I'll look into this. I created the wallet using a popular opensource wallet app, and just moved some funds there. Don't
148.
by mprime1 4y ago
Damn! Well, great! Whoever you are, well done! (I'd love to know how!)
149.
by mprime1 4y ago
Very low tech, but helps me communicate privately with friends and family over non-private channels (like email). Also use it to store critical password and keys, and have copies of my passport with me everywhere. https://github.
150.
by mprime1 4y ago
[Redacted] | Jr. Distributed Systems and Cloud | Full-time | REMOTE Looking for a junior developer passionate about Distributed Systems performance and reliability. This is the job for you if: - Your favorite topics include operating System

More ›