Link-lock
Security and privacy
url encryption
SHOW HN2020
How HN took it
4 positive, 5 neutral or asking, 0 mixed, 6 critical, out of 15 comments about the project. Thread score -0.07.
Idea: 3 for, 1 againstPrivacy: 0 for, 4 againstExecution: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Useful and clever idea from a prolific maker
From 4 comments
This is so useful, thanks for making it!
mrkramer on HNI've never thought of something like this! it's awesome!
adelrosarioh on HNAmazing tool! And of course by the same person who did urlpages! Just this weekend I was exploring embedding a whole deterministic password gen into urlpages so I could have a…
627467 on HNCool idea! I love those small experiments.
h43z on HN
Objections
Hard-coded IV with AES-GCM is insecure if keys or IVs are reused
From 4 comments
I don't understand the "non-randomization of IVs" feature, since GCM is totally insecure if an IV is reused. Is this code deriving deterministic IVs from the plaintext or…
tptacek on HN>it seems hard-coding an IV and giving the user the ability to disable randomization may unnecessarily make unwitting users vulnerable Yes. There's not a great reason to disable…
sarakayakomzin on HNI haven't looked carefully at the design; in fact, I've only read enough of the code to see that there's a flag to disable IV randomization. I'm only here to say that GCM is…
tptacek on HNA hard-coded IV with AES-GCM is bad only if you're encrypting content with the same key. Since you're deriving keys via a password, that would mean that two Link-Lock URL's…
prophesi on HN
Static web host could serve malicious JS that steals the password
From 2 comments
At the risk of being annoyingly negative - as a webapp, this design does require you to trust the web server hosting it (it could just send you JS to steal your password!)…
XMPPwocky on HN> this design does require you to trust the web server hosting it (it could just send you JS to steal your password!) The author mentioned elsewhere in this thread that it's all…
applecrazy on HN
Gimmicky; encrypting small text would be more general
From 1 comment
While I like the idea, it does seem very gimmicky to me. The only real reason I see to use this, is ease of use, but then, why only encrypt URLs. Why not just make an easy tool…
fr2null on HN
Requests
Remove the option to disable IV randomization
From 2 comments
Interesting concept, thanks for sharing. It looks like the password is transformed to bytes by decoding base64, which is not a realistic assumption. You could use…
riquito on HN>it seems hard-coding an IV and giving the user the ability to disable randomization may unnecessarily make unwitting users vulnerable Yes. There's not a great reason to disable…
sarakayakomzin on HN
Use TextEncoder instead of base64 for password bytes
From 2 comments
Interesting concept, thanks for sharing. It looks like the password is transformed to bytes by decoding base64, which is not a realistic assumption. You could use…
riquito on HNOh, `b64.asciiToBinary` tripped me off, I thought it was about base64, but it encodes any string using utf-8, which is fine for what you use it but a bit confusing to the reader.…
riquito on HN
Use password fields for the decryption prompt
From 1 comment
Is there a reason the password boxes are regular input fields and not password fields?
jedimastert on HN
Support timed self-disappearing URLs
From 1 comment
Now if we can have some kind of a timed-self-disappearing URL to go with this? I had a rough idea outlined but this OP here effectively deals with any IDS/IPS trying to visit the…
egberts1 on HN
Questions
Why are IVs non-random by default
From 1 comment
I don't understand the "non-randomization of IVs" feature, since GCM is totally insecure if an IV is reused. Is this code deriving deterministic IVs from the plaintext or…
tptacek on HN
Why password inputs are not password fields
From 1 comment
Is there a reason the password boxes are regular input fields and not password fields?
jedimastert on HN
Alternatives named
Hashify and Shortly earlier URL-page tools
From 1 comment
> the URL Pages tool I made last summer, which stores an entire web page in its own URL 9 years ago (hashify): https://news.ycombinator.com/item?id=2464213…
pmachinery on HN
One-time URL designs
From 1 comment
Now if we can have some kind of a timed-self-disappearing URL to go with this? I had a rough idea outlined but this OP here effectively deals with any IDS/IPS trying to visit the…
egberts1 on HN