mprime1

Currently reading the Mongoliad book series (Neal Stephenson, Greg Bear and star cast of other contemporary sci-fi writers). Recommended if this kind of history is interesting to you.

> Alley Cat

Thank you for bringing this back into my main memory. Spent so many hours playing this and completely forgot about it.

Quick search turned up a couple of sites where you can play this emulated online!

I feel like you are talking about ‘MQ’ in general term, but you’re describing a pretty specific one. One that is not very flexible and requires you to bend your system around it to make it work.

Not all MQs are the same. Some offer a plethora of options to fit your need (ack policy, replay policy, max outstanding, etc) Give NATS a look: https://nats.io/

Not GP but heres what I think they meant.

In the old days you could look at at raw non-rendered HTML and it would be so simple that you can render it in your head.

With the advent of more sophisticated web frameworks like the one mentioned, that’s no longer the case. The site consists of MBs of scripts and templates that take a gigawatt to render.

This is also pure HTML+JS without dependencies.

Interesting! Never thought of adding important contact info to my emergency stash, but in retrospect it is a great idea.

Linked your project.

> Problem: Send the decryption pasword

I can choose a password such as 'The name of uncle Robert's favorite movie' (i.e. something that it's easy for her, but hard for everyone else).

OR

I can call her, and say: 'Just sent you a password-protected file. The password is 'Foobar'

OR

I can include the password in the email itself (doesn't protect from an attacker but protects from mail provider snooping/indexing emails).

It doesn't make my communications NSA proof. It adds a little bit of privacy. For the specific use-case, it's more than enough.

Thank you for saying so. I've been noodling with the idea of trying to submit a HOPE talk.

YES! Better privacy for daily life. This is exactly what I had in mind.

Thank you for sharing!

I started with CBC (without MAC) and upgraded with GCM since it was a more convenient way to provide integrity without adding the MAC step manually.

I should really make sure IV/Salt are regenerated automatically after use. (there is a small print warning in the creator about reuse)

I asked myself in the past 'how secure are password-protected zip files?', and the answers I found online all seem to agree on 'not very secure'.

Rather than trying to explain why, I provided a reasonably reputable source with a good summary. Read it if you are curious. Or don't. No need to be bite.

Time is a finicky concept with computers.

Could your time-based scheme be defeated by changing the system clock on the attacker computer?

I use multiple ones, they're kinda compartmentalized. One for web logins, one for critical operational secrets, one for 'cold storage'. Plus variants of PortableSecret for various other odds and end use cases like emergency recovery USB drives.

I trust everything I use to some degree. Otherwise I wouldn't use it in the first place. But the world is not black and white.

Just because I trust something enough to store secret X in it, doesn't mean I should automatically use it to store secret Y.

In order to have 100'000 potential victims, you need to have an attacker that knows 100'000 users using this and details of how what they do with it in order to convincingly phish them.

That would be a very sophisticated attacker. So back to my original point.

Beside. The README states pretty clearly this is 'demo' tech. Learn the trick and use it on your own. Depending on my GitHub tool for your critical secrets is not a good idea.

FWIW, I (author) agree wholeheartedly with everything you say.

I'm just sharing a little hack I came up with. I hope some people add it to their toolchain (not my specific implementation, the idea in general).

And offering a bounty seemed like a fun things to do, which may also catch some shallow bugs, reward the hunter, and shame me publicly :-)

Algorithms are standards recommended by institutes like NIST, so probably not going to change anytime soon.

To your point, the W3C Crypto library APIs might change, and break my secrets. Unlikely but possible.

I don't know that bringing in a library makes this better: it could use features/constructs of the language that get deprecated and break.

There's other factors to consider (convenience, amount of review a given implementation has gotten, etc).

Overall, agree to disagree. Using a library has slightly different tradeoffs and I can see why you are recommending it. But I stick by my choice to depend on browser APIs.

Fair point, I'd switch to Argon2, but it is not part of the W3C Cryptography APIs so I'd need to bring in a library or hand-roll and implementation.

I use a password manager for online credentials I regularly need to login across devices.

There's other secrets I'd rather never upload to the cloud, with all the risks that entails. I have various other methods to store and backup those secrets. This tool is part of that toolkit.

I'm jealous of how in 5 minutes you made it look 10X better. X-)

Very cool, and better UX!

Added you to the project README.

(I got a bunch of compliments for this project today, I hope you are enjoying seeing them too given we had the same idea)

Multiple pictures is doable, but adds some complexity to the generated code so decided to do without. Also, there's a trivial workaround (zip file with multiple pictures).

Postmortem:

- Bitcoin is hard

- Wallets come with sophisticated anonymization built-in

- Don't create the bounty wallet 20 minutes before posting on HN (if that snafu had happened today while this post was on the front page, I would have looked pretty stupid)

> "Why not a password-protected zip/rar/7zip/..." on your page

Great suggestion!

> not having to debate this myself

eh eh.. good luck with that...

I think the problem is that it can be used "good" and can be used "bad". Some people focus/fixate on the ways you can shoot yourself in the foot with this. Other think of the good use cases it enables.

Author here.

Thank you for mentioning Argon2, I didn't know about it. https://en.wikipedia.org/wiki/Argon2

> There is no reason not to use Argon2

In this case, the reason for not using Argon2 is that it's not available: https://www.w3.org/TR/WebCryptoAPI/

> Well if this product isn't for mass-market

This is a demo for self-contained HTML encrypted secrets. Do with it what you want. Definitely not a product in the current format.

> This is an ingenious idea, one that becomes obvious only in retrospect.

Thank you.

Except this is secure :-)

https://security.stackexchange.com/questions/35818/are-passw...

Someone else commented the same, you are not crazy

To be clear: I use gpg too.

But I can't expect my mom or girlfriend to learn how to use it.

With PortableSecret I can communicate privately with them, without installing or learning anything new.

The HTML is self contained and works offline.

Data URLs have a limit, but from what I read online it is browser and platform specific.

But before you hit that limit, your browser may kill the tab because it looks like it's using too many resources. Again hardware/browser/platform specific.

All in all, I'm glad this cannot be used as-is for pirate movies. That would have kept me from releasing it.