mprime1

Indeed, it's functionally similar to password-protected PDF or ZIP for some use cases.

You should probably not treat password-protected zips as secure: https://security.stackexchange.com/questions/35818/are-passw...

Definitely intended for more technical audiences, lots of sharp edges.

2 sides of obsolescence:

- Too old, no software can decrypt it: not worried about this. These are NIST-standard algorithms, there built-in in most programming languages, they'll be around for a while

- Too old, trivial to crack: this is a bit more concerning to me. It's possible that some entities around the world can already crack this encryption in minutes/hours days

Regarding the second, I'm already working on an Elliptic Curve version of this.

It's been a while and I don't remember the details.

All I remember is that I was developing the secret 'creator' code using Brave (my default unsecured browser) and at some point I had to switch to Safari (which I normally save for trusted websites only).

It's possible it was a red herring, and I switched browser but the problem was something else I did at the same time.

Exactly one of the reasons I came up with this.

One way to see this is "like encrypted PDF, but for any kind of file".

It's not a service.

It's a simple hack and I use it for 3-4 use cases for which no service exists.

Among other things:

- It works offline

- My mom can use it

- It works on any device (even a borrowed one or a newly formatted one)

- It can save me if *all* my devices get stolen

- It can save me if I'm stranded in a foreign country without any document or trusted devices,

- Etc.

$400 or $0?

I don't think of it as PR/Ad. It's a bounty. If you put in time to find a flaw, you deserve at least that much (and I'll give you more if you help me fix it).

Because it seems too simple to be secure.

(People are busy, attention is scarce, etc)

You are right, I'm conflating 2 issues.

I'm pretty sure Brave was blocking window.crypto but can't remember if it was on a file or over plain HTTP

Gotcha. Thank you.

IDK about including a full HTML into a QR code (how would you even open it? Wouldn't a reader get confused expecting a URL or plain string?)

But...

You can publish portable secrets on your website (just make sure they aren't advertised/linked/crawled) and then create a QR code of the (secret-by-obscurity) URL.

And you can compose them from "pre shared" secrets.

For example, the password hint for a secret I send to my sister:

- The name of our neighbors cat

- The name of your first boyfriend who scratched dad's car

- Mom's nickname for aunt Ilda

Concatenate those three with a dot. And voila, a pretty secure password without need of a side channel.

(just made this up, I don't have a sister...)

Interesting, thanks for saying something.

I'm also not a web dev, but I think I can manage to clear out the password once the secret is decrypted successfully.

Yes.

If that wasn't the case, then "HTML virus" would be a thing: I send you an HTML file and, if you open it, it read files from your hard drive and uploads them to my server.

This is not meant as a solution. It's a demo of a self-contained, self-extracting, portable encrypted file.

That said, the password strength and the strength of the side-channel to transmit it depend on your use case.

If we were friends for example, I may not need to send you a password at all. I could just add some secret questions we both know in the hint.

Or, at the opposite side of the spectrum, I could send you a secret as email attachment and *include the password in the email itself*. This adds zero security in certain scenarios, but for example it keeps Google bots out of your private correspondence. Which is all I want sometimes.

Sounds cool!

All I wanted to show with this project is the concept of self-contained, self-extracting, super-portable secrets.

If it's any consolation, it's on the TODO list (not a web/JS developer if it wasn't clear from the crappy CSS)

Do you mind expanding?

Specifically, what do you mean by de-golfed (I'm only vaguely aware of what 'kids' mean by code-golf these days, and I'm kinda lost on de-golfing).

What would you like to fit into a QR code? A PortableSecret (e.g. html file)?

Brave and Safari that I know of.

i.e. if you run the creator with a simple HTTP server on localhost:8080 it'll block the fetch to localhost:8080/foo

The first few times I shared this with (security professional) colleagues and friends, they'd dismiss it right away "this can't possibly work", but it was because they _assumed_ it didn't work (too simple).

Attaching a challenge made a big difference, they'd spend 5 minutes trying to crack it and, in the process, realize it is actually sound (despite the simplicity).

Hello HN, I'm sharing a little trick I use to store & carry important secrets, and communicate privately over non-secure channels.

Update: funds were not stolen. PortableSecret wasn't cracked (yet)!

What happened is: the wallet app I'm using automatically performs CoinJoin[1] when funds are received (In fact, this is their business model! They take 0.3% of the amount to automatically anonymize all inbound coin).

CoinJoin is a protocol that breaks up the sum received in tiny pieces and scatters them across a large number of "sub-wallets".

So my wallet still has the funds. Bt the 'receive' address I used looks drained, that's because it was only a temporary address to share with the sender. Funds were soon after scrambled/tumbled/anonymized.

This was an interesting experience. I spent all day thinking about what could have happened, researched and learned a bunch of stuff in the process.

[1] https://en.bitcoin.it/Privacy#CoinJoin

Interesting! I suspected the attack vector was my poor use of BTC rather than someone cracking AES so quickly, I'll look into this.

I created the wallet using a popular opensource wallet app, and just moved some funds there. Don't know more than that...

Thank you for the pointers!

Damn! Well, great!

Whoever you are, well done!

(I'd love to know how!)

Very low tech, but helps me communicate privately with friends and family over non-private channels (like email).

Also use it to store critical password and keys, and have copies of my passport with me everywhere.

https://github.com/mprimi/portable-secret

[Redacted] | Jr. Distributed Systems and Cloud | Full-time | REMOTE

Looking for a junior developer passionate about Distributed Systems performance and reliability.

This is the job for you if:

- Your favorite topics include operating Systems, Networks, Databases, Cloud Infrastructure

- You like to analyze and investigate systems performance at scale, and build tools

- You have some overlap with US Pacific time work hours

Bonus points if:

- Familiar with distributed systems literature (e.g., consensus protocols, consistency models, fault-tolerance, ...)

- You have experience working with AWS/Azure/GCP

You will be working with an experienced Distributed Systems engineer happy to invest time in your personal growth.

Genuine passion and interest in the field are more important than years of experience.

- Competitive compensation and full benefits

- The product is 100% open-source

- Customers include some different household names

--

Why is the company name [redacted]?

This post made HR/Legal nervous. I'm happy to share the company name privately.

To apply, send an email to marco@mpri.me

* Subject: "[HN/Job]: <your name>"

* Include a _short_ message with your reasons for applying

* Link to anything relevant (your homepage, GitHub profile, projects, ...)

+1 for Kagi

Googled ‘Python queue’ the other day and the official python docs for queue was on page 4 of results.

(Page 1-3 were filled with examples websites, so query intent was well understood)

I was looking for a comparison of default setting (script/tracking/privacy) for different browsers.

There's lots of crappy articles on the subject. And then I hit the motherlode.

The level of care in this page just blew me away.

Other pages are awesome too. e.g.: 'Operating Systems: Timeline and Family Tree' https://eylenburg.github.io/os_familytree.htm

Here’s why it’s interesting to me.

Forget about cryptocurrencies, we probably feel the same way about all that.

If you want to run a database to store whatever, the person/entity running the database has superpowers: they can alter the data, take down the whole thing, etc.

Blockchain is a database where no single person/entity has privileged access.

That’s it. As a distributed system person this is cool. Everyone else might shrug. I’m ok with that.

This is a new paradigm and opens new possibilities. Remains to be seen what we do with it.

You can certainly map floats to int ‘bin number’ which is the index into an array. No need for a map.

But the ‘naive’ histogram is an example of a map using float keys.