CryptPage
Web and SaaS
encrypted publishing
SHOW HN2012
16points
25comments
#1,044of 1,677 in 2012
Top 63%of 2012 by points
How HN took it
MixedNo clear lean
1 positive, 7 neutral or asking, 1 mixed, 6 critical, out of 15 comments about the project. Thread score -0.16.
Privacy: 0 for, 5 againstIdea: 0 for, 1 againstDocs: 1 for, 0 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Nice implementation and well done
From 2 comments
Saw the same idea submitted on HN last week. Nice implementation. Note – you have a misspelling > TIP: You can link to other _CpyptPage_ documents and as the URL is encrypted…
switz on HNWell done. I kind of doubt you can monetize this app on its own (famous last words) but you can certainly gain cred for popularizing the technique.
pfraze on HN
Objections
Security depends on server not serving malicious JavaScript
From 2 comments
This has some basic crypto issues, but that doesn't matter much because like the related "server proof" web crypto apps, all the security of this system depends on the server not…
tptacek on HNjust write the Mozilla and Chrome extensions to expose a C implementation of PGP/GPG to Javascript? Would that really help? The same hypothetical malicious server admin could…
CodeMage on HN
URL fragment is a poor place for keys
From 2 comments
The URL fragment identifier seems like exactly the last place you'd want to stick a crypto key, in that it's displayed in the URL bar and in no way protected by the browser.
tptacek on HNI have no idea what this appeal to authority is supposed to mean in this particular context. If Zooko is bookmarking crypto keys, he too is doing something dumb. The URL fragment…
tptacek on HN
Requests
Prompt for decryption key when missing from hash
From 1 comment
It would be nice for a box to pop up if the key is not detected in the hash, asking for the decryption key (and password if that's set). That way, you enable two types of users:…
clarkmoody on HN
Questions
Where the AES CTR implementation came from
From 1 comment
Random question: where did this particularly implementation of CTR mode come from?
tptacek on HN
Whether the fragment leaks via referrer
From 1 comment
When the URL is linked, wouldn't the fragment be sent as a referrer when loading page resources?
Zikes on HN
Alternatives named
OpenPGP.js
From 1 comment
http://openpgpjs.org/ is an interesting and related project to keep an eye on. Obviously, if it is delivered from a server and run in a client, you can't trust it. I can imagine…
grepular on HN
HushMail
From 1 comment
This is how HushMail works for email. Except they can be (and have been) compelled to send backdoored code to individual end-users in order to access their users keys and hand…
grepular on HN