[{"data":1,"prerenderedAt":656},["ShallowReactive",2],{"project-14553401":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":34,"aspects":35,"strip":47,"post_text":50,"what":51,"said":82,"maker_in_thread":189,"shape":198,"grid":202,"attempts":621,"same_week":622,"maker_shows":40,"maker_hidden":648,"reader_version":649,"card":650},"14553401","StatiCrypt","Password-protect a static HTML page","title","Show HN: Password-protect a static HTML page","https:\u002F\u002Frobinmoisson.github.io\u002Fstaticrypt","robinmoisson.github.io","yoble",1497453896,2017,348,149,50,2242,3,"legend","security_privacy","page encryption","web_app",[24,25,26,27],"password protect html","static site encryption","client-side encryption","static page password","mixed",-0.189,{"positive":31,"neutral":32,"mixed":18,"critical":33},9,30,24,66,{"privacy":36,"docs":39,"design":41,"execution":42,"idea":44},{"positive":37,"critical":38},0,12,{"positive":37,"critical":40},1,{"positive":37,"critical":40},{"positive":40,"critical":43},8,{"positive":45,"critical":46},6,2,[18,46,37,37,37,37,18,40,18,37,37,37,18,37,37,40,46,40,37,48,18,18,40,18,49,18,40,18,40,18,18,18,18,18,18,46,18,40,40,18],5,4,null,{"problem":52,"audience":50,"pricing":50,"motivation":50,"time_to_build":50,"stack":58,"openness":80,"stage":81,"team_size":80},{"value":53,"source":54,"evidence":55},"Password-protecting a static HTML page without a server","maker",[56],{"id":57},"post",[59,71,76],{"value":60,"source":61,"evidence":62},"JavaScript","inferred",[63,67],{"id":64,"by":65,"text":66},"14554385","fredsted","Encrypted page includes javascript from 2 CDNs, one for jQuery and one for \"crypto-js\". The jQuery one has an integrity hash, but \"crypto-js\" does not. Granted, they both use…",{"id":68,"by":69,"text":70},"14554477","acdha","Using a CDN is only a problem if it's compromised, which is unlikely to be a threat for most applications. You can avoid this entirely by using Subresource Integrity:…",{"value":72,"source":73,"evidence":74},"jQuery","commenter",[75],{"id":64,"by":65,"text":66},{"value":77,"source":73,"evidence":78},"crypto-js",[79],{"id":64,"by":65,"text":66},"unknown","prototype",{"praise":83,"objections":98,"requests":130,"questions":148,"alternatives":163},[84,91],{"value":85,"source":73,"evidence":86},"Simple and useful idea for a Show HN",[87],{"id":88,"by":89,"text":90},"14554935","examancer","Simple and useful. The perfect \"Show HN\".",{"value":92,"source":73,"evidence":93},"Useful for static site generators and scripting",[94],{"id":95,"by":96,"text":97},"14554367","StavrosK","Oooh, this is pretty cool. All that it needs is a cli utility so I can plug it in my scripts, and I can just tell my static site generator to encrypt specific pages while building.",[99,110,115],{"value":100,"source":73,"evidence":101},"Client-side crypto is weak; needs key derivation like PBKDF2",[102,106],{"id":103,"by":104,"text":105},"14555810","jopsen","That's a fun toy.. and a great example of how easy it is to get crypto wrong. I'm just guessing here, but you are probably missing some key derivation like PBKDF2. Edit: For this…",{"id":107,"by":108,"text":109},"14556929","amenghra","In 2017, one ought to use browsers' native crypto API instead of doing crypto in js...",{"value":111,"source":73,"evidence":112},"Loads external JS from CDNs without integrity checks",[113,114],{"id":64,"by":65,"text":66},{"id":68,"by":69,"text":70},{"value":116,"source":73,"evidence":117},"Generated page failed to decrypt in some browsers and with some inputs",[118,122,126],{"id":119,"by":120,"text":121},"14555173","syphilis2","It does not seem to work for me on multiple machines. I just get an incomplete HTML file that ends abruptly after the \"border-top\" CSS line. There is no closing semicolon to the…",{"id":123,"by":124,"text":125},"14555753","mlok","Still not working.",{"id":127,"by":128,"text":129},"14554688","romanovcode","For some reason it doesn't work with password 123",[131,137,141],{"value":132,"source":54,"evidence":133},"Embed the JavaScript library inline for offline use",[134],{"id":135,"by":11,"text":136},"14554785","I like the idea of the page relying as little as possible on my code (you have a better chance to trust a well known public CDN on HTTPS than some minified code inlined from an…",{"value":138,"source":73,"evidence":139},"Add a CLI for build scripts",[140],{"id":95,"by":96,"text":97},{"value":142,"source":73,"evidence":143},"Document the KDF and block mode used",[144],{"id":145,"by":146,"text":147},"14555164","snakeanus","From the source code I was unable to deduce what KDF and Block mode is used with it. Does anybody know what does it use? crypto-js seems to support multiple different KDFs and…",[149,156],{"value":150,"source":73,"evidence":151},"How does it compare to HTTP basic auth?",[152],{"id":153,"by":154,"text":155},"14554266","tspike","Interesting. What is the use case for this versus HTTP basic auth?",{"value":157,"source":73,"evidence":158},"How secure is it for sensitive content?",[159],{"id":160,"by":161,"text":162},"14554060","bluetidepro","This would be neat if you could build a wrapper of this around GitHub pages. Then you could finally use GitHub pages sites for private content! Also, as a non-security person,…",[164,175,182],{"value":165,"source":73,"evidence":166},"HTTP basic authentication",[167,171],{"id":168,"by":169,"text":170},"14555239","shams93","Back in the day we used to use Apache basic authentication for this, that was before single page apps. Not you do have jwt that is explicitly designed to handle things like…",{"id":172,"by":173,"text":174},"14556138","Animats","There's basic authentication for protecting static web pages. It's no better or worse than any other password scheme.",{"value":176,"source":73,"evidence":177},"TiddlyWiki",[178],{"id":179,"by":180,"text":181},"14558527","speps","And no one mentions TiddlyWiki[0]... [0] http:\u002F\u002Ftiddlywiki.com\u002F",{"value":183,"source":73,"evidence":184},"securepage by acme.com",[185],{"id":186,"by":187,"text":188},"14558242","112233","A feeling of saying \"what is this familiar thing\": http:\u002F\u002Fwww.acme.com\u002Fsoftware\u002Fsecurepage\u002F (2010 or earlier, basically does similar trick, from the authors of thttpd, mini_httpd…",{"comments":45,"answered":40,"key":190},[191,194,195],{"id":192,"text":193},"14554838","Oops thanks, that should be fixed - the generating page now gets its libraries from CDNs. I'll probably look into adding Subressource Integrity checks for the other two as well.",{"id":135,"text":136},{"id":196,"text":197},"14556571","Thank you for the reports, @thread. Firefox was escaping the downloaded data (loaded in a href attribute) differently than chrome, that problem should be solved now. Do let me…",{"commenters":199,"max_depth":43,"maker_replies":45,"first_comment_mins":200,"lifespan_hours":201},109,79,44,[203,207,211,215,219,221,225,228,232,235,238,241,243,245,248,251,253,255,258,260,263,265,268,270,273,277,280,283,285,287,289,292,296,298,300,303,306,309,312,315,318,321,324,326,329,332,335,337,341,344,346,349,352,355,357,359,361,364,367,371,372,373,375,378,381,383,385,388,391,392,395,398,401,404,407,412,415,418,421,422,425,429,431,433,436,439,442,445,447,450,453,456,459,463,465,469,471,474,477,479,481,484,487,490,492,495,498,501,505,507,511,515,519,522,525,528,531,533,535,537,539,541,543,547,551,553,556,559,563,568,571,572,574,578,582,585,588,591,594,596,598,600,603,605,608,611,613,617,619],[204,37,37,205,206,37],"14554227","other\u002Fneutral\u002Fprivacy","roywiggins",[208,37,18,209,210,37],"14554591","project\u002Fneutral\u002Fprivacy","kinkrtyavimoodh",[212,37,37,213,214,37],"14554623","commenter\u002Fneutral\u002Fnone","_ZeD_",[216,37,18,217,218,37],"14554625","project\u002Fneutral\u002Fnone","SomeStupidPoint",[220,37,18,217,206,37],"14554670",[222,37,40,223,224,37],"14554615","project\u002Fcritical\u002Fprivacy","haywirez",[226,37,18,209,227,37],"14556285","mmcnl",[229,37,37,230,231,37],"14555230","other\u002Fneutral\u002Fnone","joekrill",[233,37,37,230,234,37],"14555493","ythn",[236,37,37,230,237,37],"14555628","mintplant",[239,37,37,230,240,37],"14555662","Natsu",[242,37,37,230,206,37],"14555952",[244,37,37,230,218,37],"14556080",[246,37,37,230,247,37],"14556385","cyberferret",[249,37,37,230,250,37],"14557101","stcredzero",[252,37,37,230,247,37],"14557610",[254,37,37,230,250,37],"14561677",[256,37,37,230,257,37],"14557861","lgas",[259,37,37,230,250,37],"14557986",[261,37,37,230,262,37],"14558265","spc476",[264,37,37,230,247,37],"14558441",[266,37,37,213,267,37],"14557436","feelix",[269,37,37,230,247,37],"14557590",[271,37,37,230,272,37],"14556470","paulddraper",[274,37,18,275,276,37],"14556608","project\u002Fneutral\u002Fdocs","jacquesm",[278,37,37,205,279,37],"14557364","cycomachead",[281,37,37,205,282,37],"14558253","3131s",[64,40,40,284,65,37],"project\u002Fcritical\u002Fdesign",[68,40,18,286,69,37],"project\u002Fneutral\u002Fexecution",[192,40,37,288,11,40],"maker\u002Fpositive\u002Fexecution",[290,40,18,209,291,37],"14555095","joshu",[293,40,37,294,295,37],"14556266","commenter\u002Fneutral\u002Fprivacy","a3_nm",[297,40,37,294,146,37],"14556605",[299,40,37,294,69,37],"14556800",[301,40,37,230,302,37],"14554491","pc86",[304,40,37,230,305,37],"14554663","wlesieutre",[307,40,37,230,308,37],"14555158","egeozcan",[310,40,37,230,311,37],"14558205","Cyphase",[313,40,37,230,314,37],"14561072","johnsonjo",[316,40,37,213,317,37],"14555175","steveadoo",[319,40,37,230,320,37],"14559235","Already__Taken",[322,40,37,230,323,37],"14554901","enobrev",[325,40,37,213,302,37],"14555232",[327,40,37,213,328,37],"14554693","johnhenry",[330,40,18,286,331,37],"14556481","onion2k",[333,40,18,286,334,37],"14556711","TeMPOraL",[135,40,37,336,11,40],"maker\u002Fneutral\u002Fexecution",[338,40,37,339,340,37],"14555831","commenter\u002Fpositive\u002Fdesign","sodafountan",[342,40,37,213,343,37],"14557545","Gaelan",[345,40,37,213,340,37],"14560246",[347,46,37,230,348,37],"14554847","jszymborski",[350,18,37,205,351,37],"14553994","devy",[353,18,37,205,354,37],"14554126","wyc",[356,18,37,205,351,37],"14555797",[358,18,37,205,354,37],"14556290",[119,49,40,360,120,37],"project\u002Fcritical\u002Fexecution",[362,49,40,360,363,37],"14555305","chicob",[365,49,18,286,366,37],"14555560","torrey_braman",[368,49,40,369,370,37],"14555674","project\u002Fcritical\u002Fdocs","memco",[123,49,40,360,124,37],[196,49,37,336,11,40],[374,49,40,360,363,37],"14556787",[376,49,48,377,363,37],"14556802","project\u002Fpositive\u002Fexecution",[379,49,40,360,380,37],"14555544","zokier",[382,49,40,360,124,37],"14555738",[384,49,37,336,11,40],"14556051",[386,48,37,230,387,37],"14554243","viggity",[389,48,37,230,390,37],"14556150","pbhjpbhj",[168,45,37,230,169,37],[393,45,37,230,394,37],"14555867","xaedes",[95,396,48,397,96,37],7,"project\u002Fpositive\u002Fnone",[399,396,48,397,400,37],"14556257","perryprog",[402,43,37,230,403,37],"14559683","finchisko",[405,31,37,230,406,37],"14559263","renhoeknl",[408,409,18,410,411,37],"14557396",10,"project\u002Fneutral\u002Fidea","bandrami",[413,409,18,410,414,37],"14559100","thesmok",[88,416,48,417,89,37],11,"project\u002Fpositive\u002Fidea",[419,416,40,223,420,37],"14558404","nroets",[186,38,18,410,187,37],[423,38,37,424,11,40],"14567906","maker\u002Fneutral\u002Fnone",[426,427,37,230,428,37],"14554907",13,"calebm",[430,427,37,213,400,37],"14556291",[103,432,40,223,104,37],14,[434,432,37,294,435,37],"14555870","lwhsiao",[437,432,40,223,438,37],"14556430","cryptoishard",[440,432,37,294,441,37],"14557381","shawnz",[443,444,37,230,328,37],"14554649",15,[153,446,18,410,154,37],16,[448,446,18,410,449,37],"14554290","artursapek",[451,446,48,417,452,37],"14554303","apetresc",[454,446,18,217,455,37],"14554305","merkaloid",[457,446,18,217,458,37],"14554496","simlevesque",[460,446,18,461,462,37],"14554930","project\u002Fmixed\u002Fprivacy","jewbacca",[464,446,18,209,146,37],"14555994",[466,467,37,230,468,37],"14555371",17,"nealrs",[160,470,18,410,161,37],18,[472,470,18,461,473,37],"14554095","sleepychu",[475,470,40,223,476,37],"14554664","falcolas",[478,470,37,294,473,37],"14554897",[480,470,37,294,476,37],"14555624",[482,470,37,294,483,37],"14557913","plaguuuuuu",[485,470,18,209,486,37],"14554131","dangom",[488,470,37,294,489,37],"14554220","Darphe",[491,470,37,294,161,37],"14554380",[493,470,18,209,494,37],"14555190","nico_h",[496,470,40,223,497,37],"14555362","codazoda",[499,470,40,223,500,37],"14556940","olkid",[502,503,37,230,504,37],"14558544",19,"minhajuddin",[179,506,37,230,180,37],20,[508,509,37,230,510,37],"14555183",21,"alexbecker",[512,513,18,209,514,37],"14558737",22,"anilgulecha",[516,517,37,230,518,37],"14557212",23,"chiefalchemist",[520,33,18,410,521,37],"14554390","conmarap",[523,524,18,410,473,37],"14554066",25,[526,524,37,294,527,37],"14554353","zyx321",[529,524,37,205,530,37],"14554415","ColanR",[532,524,37,205,527,37],"14554702",[534,524,18,410,89,37],"14554860",[536,524,37,294,530,37],"14555344",[538,524,18,209,89,37],"14554816",[540,524,37,294,527,37],"14554911",[542,524,37,294,530,37],"14555320",[544,545,18,410,546,37],"14558911",26,"ConfucianNardin",[548,549,48,417,550,37],"14556239",27,"Steeeve",[107,552,40,360,108,37],28,[554,552,37,213,555,37],"14557010","colejohnson66",[557,552,37,213,558,37],"14558152","kaoD",[560,552,37,561,562,37],"14557839","other\u002Fneutral\u002Fexecution","petethomas",[564,565,18,566,567,37],"14555571",29,"project\u002Fmixed\u002Fidea","skdotdan",[569,565,18,410,570,37],"14555676","akeck",[127,32,40,360,128,37],[573,32,37,336,11,40],"14554873",[575,576,48,417,577,37],"14553935",31,"ezekg",[579,576,40,580,581,37],"14554083","project\u002Fcritical\u002Fidea","ComputerGuru",[583,576,48,417,584,37],"14554187","unknownid",[586,576,40,223,587,37],"14554323","paulgb",[589,576,37,294,590,37],"14554456","pdx",[592,576,40,223,593,37],"14555811","jodoherty",[595,576,37,294,587,37],"14556222",[597,576,40,223,581,37],"14554358",[599,576,37,294,590,37],"14554429",[601,576,40,223,602,37],"14554661","iancarroll",[604,576,37,294,590,37],"14554936",[606,576,37,294,607,37],"14555125","dpark",[609,576,40,223,610,37],"14557655","gjjrfcbugxbhf",[172,612,40,580,173,37],32,[614,615,48,417,616,37],"14554052",33,"cdevs",[145,618,18,275,146,37],34,[620,618,18,275,438,37],"14556433",[],[623,628,633,637,641,644],{"id":624,"name":625,"points":626,"category":627},"14552615","DemandRush",1100,"web_saas",{"id":629,"name":630,"points":631,"category":632},"14553551","Vexlio",309,"dev_tools",{"id":634,"name":635,"points":636,"category":632},"14552140","SimulDocs",220,{"id":638,"name":639,"points":640,"category":632},"14515494","Retool",190,{"id":642,"name":643,"points":640,"category":627},"14538351","Keygen",{"id":645,"name":646,"points":647,"category":20},"14530250","Probable-Wordlists",184,false,"v2",{"id":651,"name":5,"line":6,"ai":648,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":652,"top":18,"kw":653,"maker":11,"domain":10,"tier":19,"attempts":37,"strip":654,"url":9,"mix":655,"praise":85,"objection":100,"sub":21},14553401,-0.19,[24,25,26,27],"3200003130003001210533134313133333323113",[31,32,18,33],1794036556298]