News for hackers. Stuff that matters.

A comment on Show HN: 100% offline Shamir's Secret Sharing GUI.

Re:Show HN: 100% offline Shamir's Secret Sharing GUI by analyte123 on Tuesday June 16, 2020 @04:30PM (#23543687)
Hate to be this guy, but things trying to be like this should implement a CSP with `connect-src 'none'` (and `form-action: 'none'` and `self` restrictions on everything else). Otherwise I can't be assured that the secrets won't be sent off without disconnecting my network interface.
[ Parent | on HN ]
Re:Show HN: 100% offline Shamir's Secret Sharing GUI by l1am0 on Tuesday June 16, 2020 @04:33PM (#23543714)
Love you being this guy as this is a very valid point! I am on the go right now, but will ad this in about 2 hours.
[ Parent | on HN ]
Re:Show HN: 100% offline Shamir's Secret Sharing GUI by l1am0 on Tuesday June 16, 2020 @06:33PM (#23545120)
The problem with connect-src 'none' is that is does not allow the webassembly to load than (as this is loaded via js)

`Content Security Policy: The page’s settings blocked the loading of a resource at http://localhost:8080/wasm/wasm.wasm (“connect-src”).`

For now I only added `default-src: 'self'; form-action 'none'` to the index.html

[ Parent | on HN ]
Re:Show HN: 100% offline Shamir's Secret Sharing GUI by zaroth on Tuesday June 16, 2020 @07:19PM (#23545539)
And according to HN that only took you 1 hour and 17 minutes (but I guess "2 hours ago" could be rounded down). Way to under-promise and over-deliver!
[ Parent | on HN ]
Re:Show HN: 100% offline Shamir's Secret Sharing GUI by ahazred8ta on Wednesday June 17, 2020 @01:04AM (#23548001)
https://bs.parity.io/#-BananaSplit-shamir uses different approaches to force offline use.
[ Parent | on HN ]
Re:Show HN: 100% offline Shamir's Secret Sharing GUI by jerry1979 on Wednesday June 17, 2020 @03:45AM (#23548894)
Why not just embed the wasm directly in the webpage?
[ Parent | on HN ]
Re:Show HN: 100% offline Shamir's Secret Sharing GUI by l1am0 on Wednesday June 17, 2020 @04:00AM (#23548969)
Funny I came up with the same idea about 10min ago :D It is now directly embedded via a data uri.

This allows to set `connect-src: 'data'`

[ Parent | on HN ]
Re:Show HN: 100% offline Shamir's Secret Sharing GUI by thinkloop on Tuesday June 16, 2020 @04:44PM (#23543859)
CSP = Content Security Policy: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

"To enable CSP, you need to configure your web server to return the Content-Security-Policy HTTP header (sometimes you will see mentions of the X-Content-Security-Policy header, but that's an older version and you don't need to specify it anymore).

Alternatively, the <meta> element can be used to configure a policy, for example: <meta http-equiv="Content-Security-Policy" content="default-src 'self'; img-src https://*; child-src 'none';">"

[ Parent | on HN ]
Re:Show HN: 100% offline Shamir's Secret Sharing GUI by dylz on Tuesday June 16, 2020 @05:17PM (#23544269)
You can't be assured that they will send that CSP header or meta tag with every request, either. If your threat model includes this, might as well save the page locally.
[ Parent | on HN ]
Re:Show HN: 100% offline Shamir's Secret Sharing GUI by blitmap on Wednesday June 17, 2020 @02:22AM (#23548376)
Are you saying JS could modify the CSP policy or meta tag after page load?

Suddenly I'm thinking it would be very cool to be able to right-click on a tab and say 'Take Tab Offline' Imagine if it was like a toggle on the tab itself like muting sound from a tab. It would instruct the browser to isolate the tab/process from the network? I'm not sure how Web Workers play into this.

[ Parent | on HN ]
Re:Show HN: 100% offline Shamir's Secret Sharing GUI by dylz on Wednesday June 17, 2020 @03:25AM (#23548767)
You have no guarantee that the server won't just "if (ip === companyName) { don't serve CSP + serve infiltrated JS }" in the future.
[ Parent | on HN ]
Re:Show HN: 100% offline Shamir's Secret Sharing GUI by blitmap on Wednesday June 17, 2020 @04:57PM (#23556658)
I mean you could absolutely inspect the source for the page, but these things could be modified at runtime by JS, right?

I'm talking about the meta tags. It would be neat to have a toggle on the tab for isolating the content of the page from the network.

[ Parent | on HN ]
Re:Show HN: 100% offline Shamir's Secret Sharing GUI by ijpsud on Friday June 19, 2020 @12:33PM (#23576052)
You'd have to restrict localstorage and stuff like that too, else they could save data and then send it when they regain network access.

If you have a use-case, or some ideas, there's Chrome bug page for "offline-only PWAs": https://bugs.chromium.org/p/chromium/issues/detail?id=995236

[ Parent | on HN ]
Re:Show HN: 100% offline Shamir's Secret Sharing GUI by zaroth on Tuesday June 16, 2020 @07:23PM (#23545569)
I think the point is that you go to the site, and save the HTML on your local machine, and then run it from there.

It would be amazing if there was a property you could add to the <html> tag to enforce that the browser would prevent any network access or disk writes.

As it stands I think after you save the files, you would have to look into each .js file downloaded as part of the bundle to check for outgoing network requests?

The code is tiny except for vue_debug.js which is 193KB.

[ Parent | on HN ]
Re:Show HN: 100% offline Shamir's Secret Sharing GUI by ahazred8ta on Wednesday June 17, 2020 @01:00AM (#23547980)
> save the HTML on your local machine, and then run it from there

Yes; there is another js Shamir utility that works like that; it requires you to download the html and refuses to run unless it detects that you are offline. :-)

https://bs.parity.io/#-BananaSplit-shamir

[ Parent | on HN ]
Re:Show HN: 100% offline Shamir's Secret Sharing GUI by ijpsud on Friday June 19, 2020 @12:30PM (#23576026)
> refuses to run unless it detects that you are offline

They could just display the "please disconnect" error for a while, then sneakily stop checking after some date, collecting data every time you forget to disconnect. You'd need to check the code, or never forget to disconnect - the latter is probably a mistake waiting to happen.

Chrome bug page for "offline-only PWAs" if you want to star it: https://bugs.chromium.org/p/chromium/issues/detail?id=995236

[ Parent | on HN ]
Re:Show HN: 100% offline Shamir's Secret Sharing GUI by ijpsud on Friday June 19, 2020 @12:36PM (#23576072)
Correct me if I'm wrong, but couldn't they just save your secret data to localStorage and then send it off when you load another page from the same origin (a page without those headers)? Or does the CSP of one page somehow apply to the whole origin? I'm not up to date on this stuff.
[ Parent | on HN ]
Re:Show HN: 100% offline Shamir's Secret Sharing GUI by andai on Tuesday June 16, 2020 @06:11PM (#23544919)
How do I verify whether or not this is the case? Do I need to check the headers in the network inspector? (My guess is there's no way to check on mobile?)
[ Parent | on HN ]