Show HN: Air-gapped file encryption as self-decrypting HTML page

(cms-sfx-demo.apeleg.com)

53 points | by emurlin 21 hours ago

9 comments

  • technion 1 hour ago
    I never thought I'd see a browser support list that specifically includes "Dilo" or, in the last few years, "Internet Explorer", but apparently you're comprehensive.

    I went to look for unauthenticated CBC mode like every time I see this sort of thing but it's actually GCM mode so, well consider me surprised.

  • lukan 9 hours ago
    I assume the "air gapped" part is merely indicating no internet required?
    • az226 9 hours ago
      Offline would be a better word.
  • som 8 hours ago
    A version of this that supported PKE would be cool. So you don't have to share a password in a side channel
  • firefax 9 hours ago
    cool project!

    also does everyone have to enable js to vote, or did i troll too hard? (sorry!)

  • DylanMerigaud 21 hours ago
    Self-decrypting HTML? That's an innovative approach.
    • emurlin 21 hours ago
      Yeah, I was inspired by self-extracting archives. I wanted to share files with basically no dependencies.

      The goal was:

      1. Something that didn't require any installation (assuming a web browser)

      2. Have a single file with no network that could self-decrypt

      3. Be fully auditable

      The second point is done by having (sort of(*)) reproducible builds and embedded OpenPGP signatures.

      The first point is made by cleverly manipulating the HTML structure so that it can decrypt without breaking the PGP signature. It can even decrypt using bare openssl (which was a design goal too, though getting the exact structure right took some work and bug reports).

      The third point is accomplished by the first two, and by the source being freely available.

      (*) Depends on the OS at the moment.

      • dang 10 hours ago
        I'm going to move this description to the top and re-up the post - I hope that's ok!
    • 112233 9 hours ago
      Somebody already has copied this innovative approach and travelled to past apparently: https://acme.com/software/securepage/
  • nikhilkxmar 14 hours ago
    Cool!
  • kooi 2 hours ago
    This is great!

    Lol @ "airgapped".

  • futuristicgeeks 3 minutes ago
    [flagged]
  • FatalLogic 21 hours ago
    • dang 9 hours ago
      Added above. Thanks!
    • emurlin 21 hours ago
      Correct