Rendered at 09:06:09 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
itake 53 minutes ago [-]
I built something similar, but mine used asymetric encryption.
It allowed people encrypt files and then the only person that can decrypt is the person with the private key, which may or may not be the person the encrypted the file.
technion 5 hours ago [-]
I never thought I'd see a browser support list that specifically includes "Dilo" or, in the last few years, "Internet Explorer", but apparently you're comprehensive.
I went to look for unauthenticated CBC mode like every time I see this sort of thing but it's actually GCM mode so, well consider me surprised.
G_o_D 1 hours ago [-]
Isnt use of typescript, svelte etc unnecessary.
Been using a bookmarklet for decade for this purpose sharing encrypted text or files. Keep the bookmarklet hosted in git.
lukan 13 hours ago [-]
I assume the "air gapped" part is merely indicating no internet required?
az226 13 hours ago [-]
Offline would be a better word.
som 13 hours ago [-]
A version of this that supported PKE would be cool. So you don't have to share a password in a side channel
thih9 3 hours ago [-]
Is there a scenario where this solution would be preferable to an encrypted zip archive?
My guess is some heavily locked down systems. But perhaps there is more?
creatonez 1 hours ago [-]
ZIP encryption is quite flawed.
That being said, I can see this being useful for a similar use case where encrypted ZIPs are useful. When malware testing, you sometimes want to avoid accidentally running the malware or exposing it to antivirus software until briefly before testing begins. Encrypted zips (as well as simple transformations like ROT13 or reversing the bytes in the file) can help control the moment the malware is unleashed. This HTML based tool could be useful for doing this in network sandboxed systems, with the specific property that it's testing the antivirus behavior when the file is marked as browser downloaded.
socketcluster 4 hours ago [-]
This is brilliant. Keen to try it out.
pwdisswordfishq 2 hours ago [-]
I never expected to find a circumstance in which this article would be relevant, but here I am.
I mean, basing this on HTML arguably mitigates the portability and vulnerability concerns, but the problem of trusting the decrypted contents still remains.
firefax 13 hours ago [-]
cool project!
also does everyone have to enable js to vote, or did i troll too hard? (sorry!)
DylanMerigaud 1 days ago [-]
Self-decrypting HTML? That's an innovative approach.
emurlin 1 days ago [-]
Yeah, I was inspired by self-extracting archives. I wanted to share files with basically no dependencies.
The goal was:
1. Something that didn't require any installation (assuming a web browser)
2. Have a single file with no network that could self-decrypt
3. Be fully auditable
The second point is done by having (sort of(*)) reproducible builds and embedded OpenPGP signatures.
The first point is made by cleverly manipulating the HTML structure so that it can decrypt without breaking the PGP signature. It can even decrypt using bare openssl (which was a design goal too, though getting the exact structure right took some work and bug reports).
The third point is accomplished by the first two, and by the source being freely available.
(*) Depends on the OS at the moment.
dang 15 hours ago [-]
I'm going to move this description to the top and re-up the post - I hope that's ok!
It allowed people encrypt files and then the only person that can decrypt is the person with the private key, which may or may not be the person the encrypted the file.
I went to look for unauthenticated CBC mode like every time I see this sort of thing but it's actually GCM mode so, well consider me surprised.
My guess is some heavily locked down systems. But perhaps there is more?
That being said, I can see this being useful for a similar use case where encrypted ZIPs are useful. When malware testing, you sometimes want to avoid accidentally running the malware or exposing it to antivirus software until briefly before testing begins. Encrypted zips (as well as simple transformations like ROT13 or reversing the bytes in the file) can help control the moment the malware is unleashed. This HTML based tool could be useful for doing this in network sandboxed systems, with the specific property that it's testing the antivirus behavior when the file is marked as browser downloaded.
https://jdebp.uk/FGA/dont-use-self-decrypting-files.html
I mean, basing this on HTML arguably mitigates the portability and vulnerability concerns, but the problem of trusting the decrypted contents still remains.
also does everyone have to enable js to vote, or did i troll too hard? (sorry!)
The goal was:
1. Something that didn't require any installation (assuming a web browser)
2. Have a single file with no network that could self-decrypt
3. Be fully auditable
The second point is done by having (sort of(*)) reproducible builds and embedded OpenPGP signatures.
The first point is made by cleverly manipulating the HTML structure so that it can decrypt without breaking the PGP signature. It can even decrypt using bare openssl (which was a design goal too, though getting the exact structure right took some work and bug reports).
The third point is accomplished by the first two, and by the source being freely available.
(*) Depends on the OS at the moment.
EDIT: Here's a patent from 2006 [0]
[0] https://image-ppubs.uspto.gov/dirsearch-public/print/downloa...
From here: https://pajhome.org.uk/crypt/md5/uses.html#sdp
I used this many years ago, like literally 20 years ago. And it appears to have had a bounty! Maybe it is what you recall as well!
Lol @ "airgapped".
https://github.com/ApelegHQ/ts-cms-ep-sfx