News for hackers. Stuff that matters.
Re:Show HN: Password-protect a static HTML page by sleepychu on Wednesday June 14, 2017 @01:02PM (#14554095)
In part it depends on the strength (and secure transmission of your passphrase (though if you have a good way of transmitting the passphrase this becomes less useful))

The encryption itself is solid (assuming it is implemented correctly and as described, I've not inspected the code) but as mentioned a short pass phrase combined with predictable plain text format would make this quite easy to brute force.

Re:Show HN: Password-protect a static HTML page by falcolas on Wednesday June 14, 2017 @02:05PM (#14554664)
The pass phrase also can't be changed, without reencryping the entire page. Once leaked, the contents are effectively publicly available.

Also, you can't revoke access (again, without site-wide re-encryption).

An interesting POC, but not something that is really practical for broader use.

Re:Show HN: Password-protect a static HTML page by sleepychu on Wednesday June 14, 2017 @02:34PM (#14554897)
I considered both these points when I was composing my answer but came to the conclusion that this is true for basically any encryption strategy, if I've transmitted contents signed with your public key then when your private key becomes known so does the contents.

Even when you manage to keep the key secret I can't revoke your access to the material or prevent you re-transmitting it to others.

Re:Show HN: Password-protect a static HTML page by falcolas on Wednesday June 14, 2017 @04:00PM (#14555624)
True, but if there's one shared key for each page, the chances of that key getting loose are higher. There are alsomethods of encrypting a message where you can specify multiple recipients (i.e. multiple keys), letting you remove one key without affecting the viewership of the page for people with the other keys.

It's a hard problem, and this is certainly a novel solution to that problem, but I still don't really see myself using it.

Re:Show HN: Password-protect a static HTML page by plaguuuuuu on Thursday June 15, 2017 @12:16AM (#14557913)
you could just do the encryption on the server side, in which case you just change the key and done.

/s