Hawkpost
Security and privacy
encrypted message sharing
SHOW HN2016
How HN took it
6 positive, 27 neutral or asking, 0 mixed, 10 critical, out of 43 comments about the project. Thread score -0.13.
Idea: 5 for, 3 againstPrivacy: 0 for, 4 againstExecution: 0 for, 1 againstDocs: 0 for, 1 againstDesign: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Useful for handling client data securely
From 2 comments
Hi, I'm one of the contributors of the project and we started this because of the need to deal with clients sending us information through insecure channels. We have been using…
dethos on HNThis is excellent and very helpful for my volunteer work.
Odenwaelder on HN
Fills a gap left by Keybase
From 1 comment
Looks great, this is something that is missing from Keybase (specifically, the email sending part).
rev112 on HN
Objections
Browser-delivered JavaScript must be trusted from the server
From 2 comments
js crypto's trust problem isn't solved yet. One has to trust hawkpost.co to not serve compromised client side js.
leni536 on HNHawkpost (the project introduced here) is also vulnerable to a coldboot attack - if the server that sends the page with the javascript is compromised, all bets are off.
Tepix on HN
Link sending is vulnerable to man-in-the-middle attacks
From 1 comment
The weakest link I can identify here is MITM attacks when you're sending the link. Imagine: ``` Alice generates a link. Sends the link to Bob over an unencrypted/unauthenticated…
dkopi on HN
Python and PostgreSQL are heavy for a small app
From 1 comment
Python and PostGreSQL. Not exactly a tiny footprint for a tiny application.
bartl on HN
Requests
Keybase integration
From 2 comments
It would be lovely to have keybase integration! I've just copy/pasted my GPG public key and fingeprrint from the keybase website into the hawkpost settings, and it works great!
j2kun on HNAgree. Currently keybase can be used as the key-sever url supplied by the user, but in the future making a real integration to take advantage of some cool keybase features would…
dethos on HN
Reverse direction: sending encrypted data to people without keys
From 2 comments
This is a great idea but I often have this problem the other way around. I regularly want to send encrypted data to companies that don't know how to decrypt it. The number of…
jsingleton on HNThats an use case that we also encounter often, we are still thinking about a solution (be it through Hawkpost or something else). The other way around is definitely an harder…
dethos on HN
Questions
How to prove the hosted code matches the public repo
From 2 comments
``` > or use the official server (that is running an exact copy of this repo) ``` Is there any project that attempts to prove claims like this? I don't know what that would look…
OJFord on HNWhat you are looking for is called "remote attestation". (In open source software the solution to this problem is "well, you could always just host your own instance" ;))
bugmen0t on HN
Alternatives named
Password-protected zip files
From 2 comments
Does a password-protected zip file work?
burkaman on HNThis is the most basic step, but even this is non-trivial. There are multiple ways of password protecting a zip, ZipCrypto is insecure and not all software supports AES-256.…
jsingleton on HN
Protonmail password-protected messages
From 1 comment
Protonmail has the ability to send a password-encrypted message to anyone. They just get a link and you have to give them the password through other means. All encryption is…
matt4077 on HN
Microsoft Azure Information Protection
From 1 comment
Microsoft solves this with RMS for Individuals: https://portal.aadrm.com/ (also called the RMS Sharing App, now getting rebranded to Azure Information Protection). The…
srpeck on HN
encrypt.to
From 1 comment
Similar project https://encrypt.to
diasp on HN