Re:Show HN: Ots – share a secret via one-time URL
by slavomirvojacek on Monday August 09, 2021 @01:15PM
(#28119506)
Hi, I am one of the co-creators of Sniptt.
We faced this ourselves countless times, and it is exactly why we created both OTS and Snip (https://github.com/sniptt-official/snip - like OTS but with the ability to persist secrets and also create shared vaults etc.).
Pleased to say that self-hosted options for both OTS and Snip are currently top of our roadmap.
Keep an eye on the repos for updates! :)
Re:Show HN: Ots – share a secret via one-time URL
by penagwin on Monday August 09, 2021 @02:42PM
(#28120607)
Myself and I'm sure many other's can't wait to try it once you have the self hosted version!
Re:Show HN: Ots – share a secret via one-time URL
by CSSer on Tuesday August 10, 2021 @02:28AM
(#28125687)
I built this for my company. It’s create-react-app with Redis. Redis works great in this instance because it has built-in functionality for timed expiration (no cron needed). I use Node’s crypto to cipher it in the browser with a randomly generated short passphrase, generate a random ID, insert the ciphered message into the DB with the aforementioned ID, and then use the ID and passphrase to build a URL (passphrase as fragment) that is given to the user to share.
Re:Show HN: Ots – share a secret via one-time URL
by pimlottc on Monday August 09, 2021 @02:02PM
(#28120093)
Onceler is one option based on Ruby, in-memory storage only:
Re:Show HN: Ots – share a secret via one-time URL
by swiley on Monday August 09, 2021 @02:10PM
(#28120176)
Both S/MIME (encrypted email) and OMEMO (signal style encrypted IM for XMPP with keys generated and verified client side) have been around for quite a while. That your organization doesn't have one of these is a complete failure of whoever is running IT.
Re:Show HN: Ots – share a secret via one-time URL
by Pirate-of-SV on Monday August 09, 2021 @12:55PM
(#28119262)
For the last couple of years my org has been self-hosting Yopass https://github.com/jhaals/yopass. We use it to share secrets (with one time URLs) with each other.
Re:Show HN: Ots – share a secret via one-time URL
by nickjj on Monday August 09, 2021 @02:06PM
(#28120124)
What about option 6?
Create a GPG key and encrypt / decrypt your messages.
It takes about 10 minutes once to set up your key and then it's easy to send and receive encrypted messages with no central server since you could send the encrypted text over whatever transport mechanism you prefer (gist, email, etc.).
Re:Show HN: Ots – share a secret via one-time URL
by slavomirvojacek on Monday August 09, 2021 @02:14PM
(#28120216)
We kinda did this with the snip cli (which is one of our other repos besides the ots cli). It's basically a wrapper around PGP with some additional features like vaults to facilitate sharing PGP encrypted secrets with a team. And... It takes less than 10 minutes to set up :P
1. Sam needs to send some sensitive credentials to Alex
2. Well, we know we shouldn't use slack or email
3. We should probably use a shared password manager, but that'd be a much larger conversation with the whole dev team
4. There are a ton of options if I search "share secrets securely," but I'd have to dig into a few to figure out if I trust A. that company and B. their security model
5. Fuck it, just share it on slack, delete the message later, and hope for the best. We'll figure out a better solution "next time."
I'd love something simple and self-hosted that I could throw onto heroku, or deploy as a ready-made container, that'd provide one-time-use urls like this. It'd be a great way to have slightly better secret delivery over insecure channels (like slack) in the early days of an eng team before we get around to setting up a unified system for secret sharing. And easy self-hosting means we don't have to solve the trust problem every time.