WHwhycombagator·Aug 31, 2024
Similar project that supports files: https://github.com/mprimi/portable-secret
In Password protect a static HTML page, decrypted in-browser in JavaScriptmprimi
portable-secret
HTML2022–2024
mprimi / portable-secret
portable-secret
Better privacy without special software
8Distinct people
9Mentions
0Explicit recommenders
1.7KGitHub stars
What to know before exploring
What it is
Better privacy without special software
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by month9 dated mentions
Observed mentions: 2022-12-12 16:18:34 UTC to 2024-08-31 14:37:27 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| Dec 2022 | 2022-12-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 6 | 1 | 5 |
| Jan 2023 | 2023-01-01 00:00:00 UTC | 2023-02-01 00:00:00 UTC | 0 | 0 | 0 |
| Feb 2023 | 2023-02-01 00:00:00 UTC | 2023-03-01 00:00:00 UTC | 1 | 0 | 1 |
| Mar 2023 | 2023-03-01 00:00:00 UTC | 2023-04-01 00:00:00 UTC | 0 | 0 | 0 |
| Apr 2023 | 2023-04-01 00:00:00 UTC | 2023-05-01 00:00:00 UTC | 0 | 0 | 0 |
| May 2023 | 2023-05-01 00:00:00 UTC | 2023-06-01 00:00:00 UTC | 1 | 0 | 1 |
| Jun 2023 | 2023-06-01 00:00:00 UTC | 2023-07-01 00:00:00 UTC | 0 | 0 | 0 |
| Jul 2023 | 2023-07-01 00:00:00 UTC | 2023-08-01 00:00:00 UTC | 0 | 0 | 0 |
| Aug 2023 | 2023-08-01 00:00:00 UTC | 2023-09-01 00:00:00 UTC | 0 | 0 | 0 |
| Sep 2023 | 2023-09-01 00:00:00 UTC | 2023-10-01 00:00:00 UTC | 0 | 0 | 0 |
| Oct 2023 | 2023-10-01 00:00:00 UTC | 2023-11-01 00:00:00 UTC | 0 | 0 | 0 |
| Nov 2023 | 2023-11-01 00:00:00 UTC | 2023-12-01 00:00:00 UTC | 0 | 0 | 0 |
| Dec 2023 | 2023-12-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 0 | 0 | 0 |
| Jan 2024 | 2024-01-01 00:00:00 UTC | 2024-02-01 00:00:00 UTC | 0 | 0 | 0 |
| Feb 2024 | 2024-02-01 00:00:00 UTC | 2024-03-01 00:00:00 UTC | 0 | 0 | 0 |
| Mar 2024 | 2024-03-01 00:00:00 UTC | 2024-04-01 00:00:00 UTC | 0 | 0 | 0 |
| Apr 2024 | 2024-04-01 00:00:00 UTC | 2024-05-01 00:00:00 UTC | 0 | 0 | 0 |
| May 2024 | 2024-05-01 00:00:00 UTC | 2024-06-01 00:00:00 UTC | 0 | 0 | 0 |
| Jun 2024 | 2024-06-01 00:00:00 UTC | 2024-07-01 00:00:00 UTC | 0 | 0 | 0 |
| Jul 2024 | 2024-07-01 00:00:00 UTC | 2024-08-01 00:00:00 UTC | 0 | 0 | 0 |
| Aug 2024 | 2024-08-01 00:00:00 UTC | 2024-09-01 00:00:00 UTC | 1 | 0 | 1 |
What Hacker News says
9 sourcesI like portable-secret which uses the built-in browser cryptographic functions, no external software.
https://github.com/mprimi/portable-secret
In Ask HN: What is the best password manager available today?Similar to portable-secret? https://github.com/mprimi/portable-secret
In Password protect a static HTML pageInteresting... on 2022-12-13 the bounty has been claimed! Just a few hours after mprime1 shared the project in a comment on HackerNews, someone managed to drain the BTC.
https://github.com/mprimi/portable-secret/commit/3b22d2b42ba...
I'd love to hear more about this.
In Show HN: Portable Secret – How I store my secrets and communicate privatelyIt looks like the plaintext is being padded so that its length is a multiple of the block size [1]. I can't find any resources that say you need to pad a message before encrypting it with AES-GCM though. The official examples from MDN [2][3] don't pad the message before encrypting. The source code links to a wikipedia article that states that padding isn't necessary for counter mode, which the code is using (GCM is Galois Counter Mode)[4].
[1] https://github.com/mprimi/portable-secret/blob/6efdb4618216f...
[2] https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypt...
[3] https://github.com/mdn/dom-examples/blob/main/web-crypto/enc...
[4] https://en.wikipedia.org/wiki/Padding_(cryptography)#PKCS#5_....
In Show HN: Portable Secret – How I store my secrets and communicate privatelyI think this is very cool, and from a cursory look you've made most of the right design choices (to the extent that the Web Crypto API allows).
That being said, I think most security professionals (myself included!) aren't equipped to outright "crack" this kind of thing in just a few minutes, and most should know better than to think that their inability to do so implies soundness.
With that in mind, here are some things I noticed (none of which represent an immediate break!)
* You're using SHA-1 in your KDF. That's probably fine since PBKDF2 doesn't rely on the properties of SHA-1 that have been broken, but the Web Crypto API gives you better alternatives. You could switch it out for SHA2-256 here without any breakage to the rest of the scheme.
* I'm not a JS expert, but I _think_ your encryption page might allow a confused user to reuse
Read the rest
an IV[2]. Normally this wouldn't happen because the user would refresh or reload and trigger the `init` on page load, but it would probably be better to generate the IV on demand rather than having it wait in an HTML attribute.
Again, very cool work! The fact that people can make these kinds of self-containing encrypted applications with Web APIs is a serious testament to how far the standards have progressed.
[1]: https://github.com/mprimi/portable-secret/blob/3b22d2b42baf8...
[2]: https://github.com/mprimi/portable-secret/blob/4de5e958fe6f8...
It looks like it uses a randomly generated unique 128bit salt from crypto.getRandomValues, can you explain what it is doing wrong to be rainbow attack resistant?
https://github.com/mprimi/portable-secret/blob/main/creator/...
In Show HN: Portable Secret – How I store my secrets and communicate privatelyPortableSecret: Better privacy with the tools you already have
3 points · Open discussionVery low tech, but helps me communicate privately with friends and family over non-private channels (like email).
Also use it to store critical password and keys, and have copies of my passport with me everywhere.
https://github.com/mprimi/portable-secret
In Ask HN: What's your proudest hack?