Hacker News Reader

I agree phishing is the most scary vulnerability for this.

In practice, when exchanging emails with my mom, I'm not concerned about it.

A sophisticated attacker has many easier ways to get into my stuff than creating a fake PortableSecret.

(more detail in a different comment: https://news.ycombinator.com/item?id=34084887)

If you get 100,000 people using your site to exchange secrets, the bounty got a lot bigger. For phishing you and your mum might be immune, but one of the 100,000 might get phished. For taking over the account (which is now more juicy, could be some bitcoins there) then everyone would be vulnerable who doesn't check the source code each time they load the page.

In order to have 100'000 potential victims, you need to have an attacker that knows 100'000 users using this and details of how what they do with it in order to convincingly phish them.

That would be a very sophisticated attacker. So back to my original point.

Beside. The README states pretty clearly this is 'demo' tech. Learn the trick and use it on your own. Depending on my GitHub tool for your critical secrets is not a good idea.

Reply on news.ycombinator.com