Portable Secret
Security and privacy
encryption tool
SHOW HN2022
How HN took it
32 positive, 82 neutral or asking, 11 mixed, 49 critical, out of 174 comments about the project. Thread score -0.04.
Privacy: 5 for, 26 againstIdea: 15 for, 13 againstDesign: 7 for, 3 againstExecution: 3 for, 4 againstPerformance: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Clever idea that is obvious in retrospect
From 1 comment
> This is an ingenious idea, one that becomes obvious only in retrospect. Thank you.
mprime1 on HN
Bounty challenge makes the security claim testable
From 1 comment
"Do you think this cannot possibly be secure? Great, prove it. This secret contains the recovery key for a Bitcoin wallet. Crack it and take my money!" Love it.
ortusdux on HN
Objections
Password-protected files are weak; a bounty password may be crackable
From 2 comments
This is password protected, so then an attacker must crack the password. The author exchanges the password over a phone call, which requires the password to be relatively weak,…
gregwebs on HNYes, that's one way to put it. p.s. don't use password protected archives: https://security.stackexchange.com/questions/35818/are-password-protected-zip-files-secure
mprime1 on HN
Phishing via lookalike pages or browser extensions could steal secrets
From 2 comments
If anyone is actually going to use this for their top secrets, I can find two things to be aware of. * When you decrypt then close the tab and open the tab again via the recently…
httpz on HNThank you for the comment and thoughts. Agree with most, disagree with some (easy to brute-force?), but I wanted to comment on this in particular: > Easy to phish. Con: Attacker…
mprime1 on HN
Browser may keep decrypted password in recently closed tabs
From 1 comment
If anyone is actually going to use this for their top secrets, I can find two things to be aware of. * When you decrypt then close the tab and open the tab again via the recently…
httpz on HN
Requests
Use a key derivation function like Argon2 instead of a plain hash
From 2 comments
Fair point, I'd switch to Argon2, but it is not part of the W3C Cryptography APIs so I'd need to bring in a library or hand-roll and implementation.
mprime1 on HNAuthor here. Thank you for mentioning Argon2, I didn't know about it. https://en.wikipedia.org/wiki/Argon2 > There is no reason not to use Argon2 In this case, the reason for not…
mprime1 on HN
Use a library for portability and lifespan
From 2 comments
> might want a JavaScript decryption library to improve portability and lifespan How does a library improve portability and lifespan? I'm only using NIST-recommended encryption…
mprime1 on HNAlgorithms are standards recommended by institutes like NIST, so probably not going to change anytime soon. To your point, the W3C Crypto library APIs might change, and break my…
mprime1 on HN
Questions
Whether browsers block window.crypto on local files
From 1 comment
neat tool. I would encrypt the payload type and extension tho >Some browsers disable window.crypto on local files and non-TLS servers which ones do that?
throwaway0x7E6 on HN
Alternatives named
Password-protected zip or PDF files
From 2 comments
Indeed, it's functionally similar to password-protected PDF or ZIP for some use cases. You should probably not treat password-protected zips as secure:…
mprime1 on HNI keep putting off the decision on how to store my private keys remotely in case of disaster, and this looks like a good and very pragmatic solution. Thanks for creating this! My…
mbwgh on HN
GPG
From 1 comment
To be clear: I use gpg too. But I can't expect my mom or girlfriend to learn how to use it. With PortableSecret I can communicate privately with them, without installing or…
mprime1 on HN
Clipperz password vault
From 1 comment
Thank you for the pointer https://clipperz.com
mprime1 on HN