StatiCrypt
Security and privacy
page encryption
SHOW HN2017
How HN took it
9 positive, 30 neutral or asking, 3 mixed, 24 critical, out of 66 comments about the project. Thread score -0.19.
Privacy: 0 for, 12 againstExecution: 1 for, 8 againstIdea: 6 for, 2 againstDocs: 0 for, 1 againstDesign: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Simple and useful idea for a Show HN
From 1 comment
Simple and useful. The perfect "Show HN".
examancer on HN
Useful for static site generators and scripting
From 1 comment
Oooh, this is pretty cool. All that it needs is a cli utility so I can plug it in my scripts, and I can just tell my static site generator to encrypt specific pages while building.
StavrosK on HN
Objections
Client-side crypto is weak; needs key derivation like PBKDF2
From 2 comments
That's a fun toy.. and a great example of how easy it is to get crypto wrong. I'm just guessing here, but you are probably missing some key derivation like PBKDF2. Edit: For this…
jopsen on HNIn 2017, one ought to use browsers' native crypto API instead of doing crypto in js...
amenghra on HN
Loads external JS from CDNs without integrity checks
From 2 comments
Encrypted page includes javascript from 2 CDNs, one for jQuery and one for "crypto-js". The jQuery one has an integrity hash, but "crypto-js" does not. Granted, they both use…
fredsted on HNUsing a CDN is only a problem if it's compromised, which is unlikely to be a threat for most applications. You can avoid this entirely by using Subresource Integrity:…
acdha on HN
Generated page failed to decrypt in some browsers and with some inputs
From 3 comments
It does not seem to work for me on multiple machines. I just get an incomplete HTML file that ends abruptly after the "border-top" CSS line. There is no closing semicolon to the…
syphilis2 on HNStill not working.
mlok on HNFor some reason it doesn't work with password 123
romanovcode on HN
Requests
Embed the JavaScript library inline for offline use
From 1 comment
I like the idea of the page relying as little as possible on my code (you have a better chance to trust a well known public CDN on HTTPS than some minified code inlined from an…
yoble on HN
Add a CLI for build scripts
From 1 comment
Oooh, this is pretty cool. All that it needs is a cli utility so I can plug it in my scripts, and I can just tell my static site generator to encrypt specific pages while building.
StavrosK on HN
Document the KDF and block mode used
From 1 comment
From the source code I was unable to deduce what KDF and Block mode is used with it. Does anybody know what does it use? crypto-js seems to support multiple different KDFs and…
snakeanus on HN
Questions
How does it compare to HTTP basic auth?
From 1 comment
Interesting. What is the use case for this versus HTTP basic auth?
tspike on HN
How secure is it for sensitive content?
From 1 comment
This would be neat if you could build a wrapper of this around GitHub pages. Then you could finally use GitHub pages sites for private content! Also, as a non-security person,…
bluetidepro on HN
Alternatives named
HTTP basic authentication
From 2 comments
Back in the day we used to use Apache basic authentication for this, that was before single page apps. Not you do have jwt that is explicitly designed to handle things like…
shams93 on HNThere's basic authentication for protecting static web pages. It's no better or worse than any other password scheme.
Animats on HN
TiddlyWiki
From 1 comment
And no one mentions TiddlyWiki[0]... [0] http://tiddlywiki.com/
speps on HN
securepage by acme.com
From 1 comment
A feeling of saying "what is this familiar thing": http://www.acme.com/software/securepage/ (2010 or earlier, basically does similar trick, from the authors of thttpd, mini_httpd…
112233 on HN