html-vault
Security and privacy
encrypted html pages
SHOW HN2020
55points
21comments
#1,013of 3,028 in 2020
Top 34%of 2020 by points
How HN took it
RoastedHalf or more of the comments are critical
0 positive, 1 neutral or asking, 1 mixed, 4 critical, out of 6 comments about the project. Thread score -0.36.
Performance: 0 for, 4 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Useful and works well
From 2 comments
Works, but takes a little while. Nice -useful
bmsleight_ on HNI like it! Works well. Do you see a way to reduce the required code?
Tepix on HN
Similar tools exist with the same idea
From 3 comments
Nice! I made something similar to this: https://github.com/camsjams/mr-roboto With a slight difference, it works 100% in the browser, you can use it here:…
camsjams on HNHey! I also made something similar to this (uses a password-derived key to create protected, self-contained HTML). https://www.maxlaumeister.com/pagecrypt/ Mine was originally…
maxlaumeister on HNSimilar: https://github.com/sowbug/quaid
sowbug on HN
Objections
Key derivation is too slow in the browser
From 4 comments
It took way too long on my laptop (i5-6200U). With a decent random password (say, 14 letters), the search space will be very large. If a determined attacker (with a couple of…
Tepix on HNThis might take a moment it said but I think I waited two minutes with no result in sight.
eitland on HNRecent release of Firefox, on a developer laptop. Edit: add more details.
eitland on HNBy design? Or running code in the browser is inefficient? (not your fault, that's the way it is) Keepass (Desktop app) for example doesn't take ages to open.
mc3 on HN
Requests
Make the number of PBKDF2 rounds configurable
From 2 comments
It took way too long on my laptop (i5-6200U). With a decent random password (say, 14 letters), the search space will be very large. If a determined attacker (with a couple of…
Tepix on HNYes: By design. This helps make brute forcing the password harder by forcing each attempt to take a while. The crypto implementation in the browser itself is pretty fast. You can…
dividuum on HN
Use the Web Crypto API to reduce code size
From 1 comment
Looks like your code predates the Web Crypto API, so switching over to that should get rid of more than half the code. Right?
Tepix on HN
Questions
Was scrypt.js performance measured against PBKDF2
From 1 comment
Nice. Did you measure the performance of scrypt.js? The PBKDF2 implementation in Python and both Chrome/Firefox are similar for me and the Python documentation states something…
dividuum on HN
Alternatives named
emojicrypt.com
From 1 comment
On the topic of toy web crypto projects, here's mine: https://emojicrypt.com/ It offers scrypt + aes-gcm, encoded into 256 emoji; all the crypto is in…
aurorabbit on HN
mr-roboto
From 1 comment
Nice! I made something similar to this: https://github.com/camsjams/mr-roboto With a slight difference, it works 100% in the browser, you can use it here:…
camsjams on HN
pagecrypt
From 1 comment
Hey! I also made something similar to this (uses a password-derived key to create protected, self-contained HTML). https://www.maxlaumeister.com/pagecrypt/ Mine was originally…
maxlaumeister on HN
quaid
From 1 comment
Similar: https://github.com/sowbug/quaid
sowbug on HN