s4
Security and privacy
secret sharing
SHOW HN2020
How HN took it
4 positive, 21 neutral or asking, 1 mixed, 11 critical, out of 37 comments about the project. Thread score -0.20.
Execution: 0 for, 5 againstIdea: 0 for, 3 againstPrivacy: 0 for, 2 againstDocs: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Useful and well-done, responsive maker fixing bugs quickly
From 3 comments
Nice work and extra points for being super responsive to bugs/fixes/recommendations from comments :-) Reminds me of something similar: https://iancoleman.io/shamir/
NKosmatos on HN> You can find the code on Github and this website works completely offline. Save it to your computer (Ctrl+S) in order to not loose access to the s4 in case this website will be…
kickscondor on HNThis is really neat! I found a minor issue; changing the number of shares on the decode panel (after a successful decode) seems to freeze the output; using a recent firefox on…
klyrs on HN
Objections
Page could make network requests; needs CSP or offline enforcement
From 2 comments
Hate to be this guy, but things trying to be like this should implement a CSP with `connect-src 'none'` (and `form-action: 'none'` and `self` restrictions on everything else).…
analyte123 on HNYou can't be assured that they will send that CSP header or meta tag with every request, either. If your threat model includes this, might as well save the page locally.
dylz on HN
Shares lack integrity; bad shares can corrupt the secret
From 1 comment
While SSSS provides information theoretic security, there are a couple of security gotchas. One example is that it leaks the length of a secret unless padding is used. In…
e79 on HN
Browser crashes or freezes with large share counts and some inputs
From 2 comments
Love to be this guy, good way to crash the browser. Set share size to 1000+ and Enjoy!
CortexM4 on HNThis is really neat! I found a minor issue; changing the number of shares on the decode panel (after a successful decode) seems to freeze the output; using a recent firefox on…
klyrs on HN
Requests
Add Content Security Policy restricting network access
From 1 comment
Hate to be this guy, but things trying to be like this should implement a CSP with `connect-src 'none'` (and `form-action: 'none'` and `self` restrictions on everything else).…
analyte123 on HN
Add verifiable shares or share signing
From 2 comments
Can't these problems be solved with another layer like signing with a pubkey where the private is thrown away after issuance? And then maybe some error correcting algorithm to…
kcolford on HNwouldn't an easy fix for verifiability be that you include a list of hashes of every valid share along with each individual key?
this_was_posted on HN
Questions
Is it compatible with other SSSS implementations?
From 1 comment
Interesting. But what about ssss? Also, I vaguely recall that results may be implementation specific, in that shares must be combined with the same app that produced them. So is…
mirimir on HN
Alternatives named
BananaSplit (bs.parity.io)
From 1 comment
> save the HTML on your local machine, and then run it from there Yes; there is another js Shamir utility that works like that; it requires you to download the html and refuses…
ahazred8ta on HN
iancoleman.io/shamir
From 1 comment
Nice work and extra points for being super responsive to bugs/fixes/recommendations from comments :-) Reminds me of something similar: https://iancoleman.io/shamir/
NKosmatos on HN
Multisig wallets
From 1 comment
I have usually seen multisig as the recommended way, not Shamir. One Shamir vs multisig article :…
nope96 on HN