Cryptob.in
Dev tools
snippet sharing
SHOW HN2017
How HN took it
2 positive, 2 neutral or asking, 0 mixed, 2 critical, out of 6 comments about the project. Thread score +0.13.
Privacy: 0 for, 2 againstDesign: 1 for, 0 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Maker responded quickly and graciously to security feedback
From 1 comment
I really appreciate how well you took the feedback and how quickly you acted on it. Refreshing to see such interactions online these days, make me think of times when the web…
goliatone on HN
Clean, simple and modern UX and layout
From 1 comment
Snyggt! I really like the UX and layout. Clean, simple and at the same time really fresh and modern. Would love to see any other projects you’ve made!
cpach on HN
Objections
Client-side encryption in a web page is unsafe because the server can serve malicious JS
From 1 comment
1. Nothing like this is ever safe; the server can surreptitiously feed you JS that will fatally compromise your encryption. 2. This one is even worse, because it loads scripts…
tptacek on HN
Uses unauthenticated CBC mode and CryptoJS, which are insecure
From 2 comments
1. Nothing like this is ever safe; the server can surreptitiously feed you JS that will fatally compromise your encryption. 2. This one is even worse, because it loads scripts…
tptacek on HNDon't bother. You won't gain any meaningful security, and you'll be using the same error-prone, outmoded constructions. Even if you had built this application in perfect,…
tptacek on HN
Loads scripts from CDNs and used Google Analytics, weakening encryption
From 1 comment
1. Nothing like this is ever safe; the server can surreptitiously feed you JS that will fatally compromise your encryption. 2. This one is even worse, because it loads scripts…
tptacek on HN
Compressing before encrypting creates side channels
From 1 comment
1. Nothing like this is ever safe; the server can surreptitiously feed you JS that will fatally compromise your encryption. 2. This one is even worse, because it loads scripts…
tptacek on HN
Requests
Use Web Crypto API instead of JS crypto library
From 1 comment
Wouldn't it make even more sense to use the Web Crypto API instead of any JS crypto library loaded from the server?
conorgil145 on HN
Ship as a browser extension instead of a web page
From 2 comments
1. Nothing like this is ever safe; the server can surreptitiously feed you JS that will fatally compromise your encryption. 2. This one is even worse, because it loads scripts…
tptacek on HNYep.
tptacek on HN
Enable HSTS
From 1 comment
I've implemented all points that @tptacek mentioned (except the web extension, that will be a future update), and will also activate HSTS when I feel comfortable with the server…
viktorelofsson on HN
Questions
Whether the suggested extension means a Chrome extension
From 1 comment
Also - regarding your second #1, are we talking about something like a Chrome extension?
viktorelofsson on HN
Alternatives named
Google Docs
From 1 comment
1. Nothing like this is ever safe; the server can surreptitiously feed you JS that will fatally compromise your encryption. 2. This one is even worse, because it loads scripts…
tptacek on HN