Hacker News Reader

Comment by quickthrower2 | Hacker News Reader

One possible attack is someone changing either the encrypt or decrypt source code, either via Github (if they get access to the OP account) to log keystrokes.

Or if someone has hosted it themselves then hack that hosting provider.

Or they could do something like this: https://www.theverge.com/2018/4/24/17275982/myetherwallet-ha...

Phishing is another potential one. Browser extensions, or supply chain attack on packages they use.

View on HN

I agree phishing is the most scary vulnerability for this.

In practice, when exchanging emails with my mom, I'm not concerned about it.

A sophisticated attacker has many easier ways to get into my stuff than creating a fake PortableSecret.

(more detail in a different comment: https://news.ycombinator.com/item?id=34084887)

If you get 100,000 people using your site to exchange secrets, the bounty got a lot bigger. For phishing you and your mum might be immune, but one of the 100,000 might get phished. For taking over the account (which is now more juicy, could be some bitcoins there) then everyone would be vulnerable who doesn't check the source code each time they load the page.

In order to have 100'000 potential victims, you need to have an attacker that knows 100'000 users using this and details of how what they do with it in order to convincingly phish them.

That would be a very sophisticated attacker. So back to my original point.

Beside. The README states pretty clearly this is 'demo' tech. Learn the trick and use it on your own. Depending on my GitHub tool for your critical secrets is not a good idea.

Reply on news.ycombinator.com