[{"data":1,"prerenderedAt":283},["ShallowReactive",2],{"project-23242290":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":35,"aspects":36,"strip":44,"post_text":45,"what":46,"said":85,"maker_in_thread":185,"shape":193,"grid":196,"attempts":243,"same_week":244,"maker_shows":274,"maker_hidden":275,"reader_version":276,"card":277},"23242290","Link-lock","Distributed app to password-protect URLs","title","Show HN: Link-lock – Distributed app to password-protect URLs","https:\u002F\u002Fgithub.com\u002Fjstrieb\u002Flink-lock","github.com","jstrieb",1589937038,2020,73,24,851,3028,29,"notable","security_privacy","url encryption","web_app",[24,25,26,27],"password protect url","encrypted link","client side encryption","aes-gcm","debated",-0.074,{"positive":31,"neutral":32,"mixed":33,"critical":34},4,5,0,6,15,{"idea":37,"privacy":40,"execution":41,"docs":42,"design":43},{"positive":38,"critical":39},3,1,{"positive":33,"critical":31},{"positive":33,"critical":39},{"positive":33,"critical":33},{"positive":33,"critical":33},[33,32,32,33,38,38,39,33,33,39,33,38,33,39,33,38,33,39,39,39,38,33,32,32],null,{"problem":47,"audience":45,"pricing":45,"motivation":54,"time_to_build":45,"stack":58,"openness":82,"stage":83,"team_size":84},{"value":48,"source":49,"evidence":50},"Lets people password-protect a URL so the link content is hidden without a server","maker",[51],{"id":52,"by":11,"text":53},"23250152","I originally made this as a complement to the URL Pages tool I made last summer, which stores an entire web page in its own URL.[0] Now, it is possible for URL Pages to be…",{"value":55,"source":49,"evidence":56},"Complement to URL Pages and explore decentralized password protection",[57],{"id":52,"by":11,"text":53},[59,70],{"value":60,"source":61,"evidence":62},"JavaScript","inferred",[63,66],{"id":64,"by":11,"text":65},"23253990","Thanks so much for the feedback! Based on this and tptacek's comment,[0] I will likely remove the ability to disable randomizing the IV in future versions. Luckily, this will not…",{"id":67,"by":68,"text":69},"23253815","riquito","Interesting concept, thanks for sharing. It looks like the password is transformed to bytes by decoding base64, which is not a realistic assumption. You could use…",{"value":71,"source":72,"evidence":73},"AES-GCM encryption","commenter",[74,78],{"id":75,"by":76,"text":77},"23253817","sarakayakomzin",">it seems hard-coding an IV and giving the user the ability to disable randomization may unnecessarily make unwitting users vulnerable Yes. There's not a great reason to disable…",{"id":79,"by":80,"text":81},"23254638","prophesi","A hard-coded IV with AES-GCM is bad only if you're encrypting content with the same key. Since you're deriving keys via a password, that would mean that two Link-Lock URL's…","open_source","unknown","solo",{"praise":86,"objections":106,"requests":137,"questions":164,"alternatives":173},[87],{"value":88,"source":72,"evidence":89},"Useful and clever idea from a prolific maker",[90,94,98,102],{"id":91,"by":92,"text":93},"23252429","mrkramer","This is so useful, thanks for making it!",{"id":95,"by":96,"text":97},"23251507","adelrosarioh","I've never thought of something like this! it's awesome!",{"id":99,"by":100,"text":101},"23252651","627467","Amazing tool! And of course by the same person who did urlpages! Just this weekend I was exploring embedding a whole deterministic password gen into urlpages so I could have a…",{"id":103,"by":104,"text":105},"23253408","h43z","Cool idea! I love those small experiments.",[107,119,130],{"value":108,"source":72,"evidence":109},"Hard-coded IV with AES-GCM is insecure if keys or IVs are reused",[110,114,115,118],{"id":111,"by":112,"text":113},"23253488","tptacek","I don't understand the \"non-randomization of IVs\" feature, since GCM is totally insecure if an IV is reused. Is this code deriving deterministic IVs from the plaintext or…",{"id":75,"by":76,"text":77},{"id":116,"by":112,"text":117},"23254581","I haven't looked carefully at the design; in fact, I've only read enough of the code to see that there's a flag to disable IV randomization. I'm only here to say that GCM is…",{"id":79,"by":80,"text":81},{"value":120,"source":72,"evidence":121},"Static web host could serve malicious JS that steals the password",[122,126],{"id":123,"by":124,"text":125},"23254235","XMPPwocky","At the risk of being annoyingly negative - as a webapp, this design does require you to trust the web server hosting it (it could just send you JS to steal your password!)…",{"id":127,"by":128,"text":129},"23254412","applecrazy","> this design does require you to trust the web server hosting it (it could just send you JS to steal your password!) The author mentioned elsewhere in this thread that it's all…",{"value":131,"source":72,"evidence":132},"Gimmicky; encrypting small text would be more general",[133],{"id":134,"by":135,"text":136},"23251687","fr2null","While I like the idea, it does seem very gimmicky to me. The only real reason I see to use this, is ease of use, but then, why only encrypt URLs. Why not just make an easy tool…",[138,143,150,157],{"value":139,"source":72,"evidence":140},"Remove the option to disable IV randomization",[141,142],{"id":67,"by":68,"text":69},{"id":75,"by":76,"text":77},{"value":144,"source":72,"evidence":145},"Use TextEncoder instead of base64 for password bytes",[146,147],{"id":67,"by":68,"text":69},{"id":148,"by":68,"text":149},"23254206","Oh, `b64.asciiToBinary` tripped me off, I thought it was about base64, but it encodes any string using utf-8, which is fine for what you use it but a bit confusing to the reader.…",{"value":151,"source":72,"evidence":152},"Use password fields for the decryption prompt",[153],{"id":154,"by":155,"text":156},"23252329","jedimastert","Is there a reason the password boxes are regular input fields and not password fields?",{"value":158,"source":72,"evidence":159},"Support timed self-disappearing URLs",[160],{"id":161,"by":162,"text":163},"23259240","egberts1","Now if we can have some kind of a timed-self-disappearing URL to go with this? I had a rough idea outlined but this OP here effectively deals with any IDS\u002FIPS trying to visit the…",[165,169],{"value":166,"source":72,"evidence":167},"Why are IVs non-random by default",[168],{"id":111,"by":112,"text":113},{"value":170,"source":72,"evidence":171},"Why password inputs are not password fields",[172],{"id":154,"by":155,"text":156},[174,181],{"value":175,"source":72,"evidence":176},"Hashify and Shortly earlier URL-page tools",[177],{"id":178,"by":179,"text":180},"23281245","pmachinery","> the URL Pages tool I made last summer, which stores an entire web page in its own URL 9 years ago (hashify): https:\u002F\u002Fnews.ycombinator.com\u002Fitem?id=2464213…",{"value":182,"source":72,"evidence":183},"One-time URL designs",[184],{"id":161,"by":162,"text":163},{"comments":34,"answered":186,"key":187},2,[188,189,192],{"id":52,"text":53},{"id":190,"text":191},"23252816","Glad to hear you like URL Pages! Because neither this project, nor that one use any tracking or analytics, my only indications that people are using it are GitHub stars, GitHub…",{"id":64,"text":65},{"commenters":35,"max_depth":31,"maker_replies":34,"first_comment_mins":194,"lifespan_hours":195},1042,80,[197,199,201,202,204,205,206,208,210,212,214,216,218,220,222,225,227,230,231,232,233,235,238,240],[52,33,33,198,11,39],"project\u002Fneutral\u002Fidea",[95,33,32,200,96,33],"project\u002Fpositive\u002Fidea",[99,33,32,200,100,33],[190,33,33,203,11,39],"maker\u002Fneutral\u002Fnone",[178,33,38,198,179,33],[161,39,38,198,162,33],[123,186,39,207,124,33],"project\u002Fcritical\u002Fprivacy",[127,186,33,209,128,33],"commenter\u002Fneutral\u002Fprivacy",[211,186,33,209,124,33],"23255109",[67,38,39,213,68,33],"project\u002Fcritical\u002Fexecution",[64,38,33,215,11,39],"maker\u002Fneutral\u002Fexecution",[148,38,38,217,68,33],"maker\u002Fneutral\u002Fdocs",[219,38,33,203,11,39],"23255297",[134,31,39,221,135,33],"project\u002Fcritical\u002Fidea",[223,31,33,224,155,33],"23252267","commenter\u002Fneutral\u002Fidea",[111,32,38,226,112,33],"project\u002Fneutral\u002Fprivacy",[228,32,33,229,11,39],"23253689","maker\u002Fneutral\u002Fprivacy",[75,32,39,207,76,33],[116,32,39,207,112,33],[79,32,39,207,80,33],[154,34,38,234,155,33],"project\u002Fneutral\u002Fdesign",[236,34,33,237,11,39],"23252746","maker\u002Fneutral\u002Fdesign",[103,239,32,200,104,33],7,[91,241,32,242,92,33],8,"project\u002Fpositive\u002Fnone",[],[245,250,254,259,264,269],{"id":246,"name":247,"points":248,"category":249},"23209142","toro",551,"finance_crypto",{"id":251,"name":252,"points":253,"category":249},"23190921","senator-filings",350,{"id":255,"name":256,"points":257,"category":258},"23205579","XP.css",297,"dev_tools",{"id":260,"name":261,"points":262,"category":263},"23180298","Virtual Reality DOS",206,"games",{"id":265,"name":266,"points":267,"category":268},"23223358","aitextgen",174,"ai",{"id":270,"name":271,"points":272,"category":273},"23215360","Career Fair",161,"productivity",9,false,"v2",{"id":278,"name":5,"line":6,"ai":275,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":279,"top":18,"kw":280,"maker":11,"domain":10,"tier":19,"attempts":33,"strip":281,"url":9,"mix":282,"praise":88,"objection":108,"sub":21},23242290,-0.07,[24,25,26,27],"055033100103010301113055",[31,32,33,34],1793991009762]