News for hackers. Stuff that matters.

A comment on Show HN: I store my critical secrets and document, and communicate privately. Parent comment

Re:Show HN: I store my critical secrets and document, and co... by varenc on Wednesday December 21, 2022 @09:07PM (#34088851)
100% agree. This is why I’m always a bit dubious of in-browser decryption. At any moment a little extra snippet of JS can be added to stealthily leak my secrets. There’s no great mechanism to ensure the JS I’m running is always the same JS I ran before. Compare this to a desktop app where I always know I’m running the exact same binary I ran last time. (And if I’m not then I’m probably already pwned anyway)

For this persons use case though, assuming they’re not a person of interest to any “threat actors”, I wouldn’t be too worried.

[ Parent | on HN ]
Re:Show HN: I store my critical secrets and document, and co... by Caligatio on Thursday December 22, 2022 @03:23AM (#34091072)
This isn't a 100% solution but you can pin external JavaScript includes in HTML using subresource integrity (https://developer.mozilla.org/en-US/docs/Web/Security/Subres...).

This doesn't help if someone can mess with the HTML though.

[ Parent | on HN ]
Re:Show HN: I store my critical secrets and document, and co... by pwdisswordfish9 on Thursday December 22, 2022 @07:08AM (#34092537)
It's important to be precise and clear-thinking when articulating problems, lest we identify the wrong one but believe it's the right one.

Your issue is not with the program being in-browser, but rather it being an online one that gets ~continually re-fetched and immediately trusted without verification.

[ Parent | on HN ]
Re:Show HN: I store my critical secrets and document, and co... by cdaringe on Thursday December 22, 2022 @03:45PM (#34098414)
It may be too much for moms, but maybe the html document includes the content, but a chrome extension does the work and presents the secret in the extension popup.

- attack surface area drastically reduced. only one MITM matters now, the extension installation - requires great extension UX, to help dads know where to click

less portable than just a document, but perhaps a nice middle ground

[ Parent | on HN ]
Re:Show HN: I store my critical secrets and document, and co... by xmcqdpt2 on Friday December 23, 2022 @07:45AM (#34105196)
> too much for moms

I assume you are referring to the OP's post there but I did a double take because I know some extremely technical moms.

[ Parent | on HN ]