[{"data":1,"prerenderedAt":495},["ShallowReactive",2],{"project-39105502":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":27,"sentiment":28,"stance_mix":29,"scored_comments":34,"aspects":35,"strip":45,"post_text":48,"what":49,"said":73,"maker_in_thread":196,"shape":207,"grid":212,"attempts":456,"same_week":457,"maker_shows":37,"maker_hidden":487,"reader_version":488,"card":489},"39105502","Retriever","Securely share secrets over the internet","title","Show HN: Retriever – Securely share secrets over the internet","https:\u002F\u002Fretriever.corgea.io\u002F","retriever.corgea.io","asadeddin",1706027208,2024,193,99,409,3515,12,"notable","security_privacy","secret sharing","web_app",[21,24,25,26],"public key encryption","zero knowledge","one-time secrets","roasted",-0.256,{"positive":30,"neutral":31,"mixed":32,"critical":33},11,13,0,28,52,{"design":36,"privacy":38,"idea":41,"docs":44},{"positive":37,"critical":37},2,{"positive":39,"critical":40},1,20,{"positive":42,"critical":43},8,6,{"positive":32,"critical":32},[46,47,32,32,47,47,39,39,39,47,39,39,47,32,39,39,39,32,47,46,47,47,39,46,39,47,39,46,47,47,46,39,32,39,32,39,39,39,39,39],5,3,"Retriever (https:\u002F\u002Fretriever.corgea.io\u002F), an open-source research project to help users receive secrets and sensitive information without needing a server in the middle. It works by using Public-key cryptography to coordinate the message sharing between the two devices.\n\nRead more on why we built it here: https:\u002F\u002Fretriever.corgea.io\u002Fwhy.html",{"problem":50,"audience":56,"pricing":56,"motivation":57,"time_to_build":56,"stack":63,"openness":70,"stage":71,"team_size":72},{"value":51,"source":52,"evidence":53},"Receiving secrets and sensitive information without a server in the middle","maker",[54],{"id":55},"post",null,{"value":58,"source":52,"evidence":59},"Open-source research project for zero-knowledge secret sharing that is minimal work to run on your own",[60],{"id":61,"by":11,"text":62},"39119377","You can definitely do that. This is just a different mechanism to do so. Your statement could be applied on any secret sharing system that 1password, Bitwarden, Lastpass have.…",[64],{"value":65,"source":52,"evidence":66},"JavaScript (browser crypto)",[67],{"id":68,"by":11,"text":69},"39122030","The crypto in this case doesn't come from the server. Nothing goes to the server for encryption. It's actually the browser that's generating the key pair and encrypting and…","open_source","beta","unknown",{"praise":74,"objections":93,"requests":134,"questions":149,"alternatives":163},[75,87],{"value":76,"source":77,"evidence":78},"Simple and easy for non-technical users with no account needed","commenter",[79,83],{"id":80,"by":81,"text":82},"39120922","sherifnada","Great tool. Secret sharing always felt needlessly complicated and clunky. I love that this lets you securely share secrets with zero barriers to entry in seconds. No need for…",{"id":84,"by":85,"text":86},"39119984","taffit","I'm loving it! So simple, yet exactly the thing needed to share a secret quickly in a secure manner over a non-secure channel, e. g. email. Still a fresh idea I've never seen…",{"value":88,"source":52,"evidence":89},"Easy to self-host",[90],{"id":91,"by":11,"text":92},"39119247","Thanks! Yea, that's all you need to do really. It's pretty simple to get it up and running :)",[94,105,116,127],{"value":95,"source":77,"evidence":96},"Browser-delivered JavaScript means users must trust the server to serve unchanged code",[97,101],{"id":98,"by":99,"text":100},"39122047","paulgb","Right, but how do we know that https:\u002F\u002Fretriever.corgea.io faithfully returns the code in that GitHub repo? We still have to trust corgea.io.",{"id":102,"by":103,"text":104},"39142093","akerl_","> But if we assume this site can be trusted not to send secrets online (which is easy to verify) This would require every sender and recipient to read and understand the…",{"value":106,"source":77,"evidence":107},"Third-party scripts and trackers loaded by the page",[108,112],{"id":109,"by":110,"text":111},"39127722","tmoehle","Generally a good idea, but it’s implementation is not fully thought through. It’s supposed to be a secure place where secrets are shared, but it comes with Remote Code Executions…",{"id":113,"by":114,"text":115},"39128347","dncornholio","I will not use this. It loads too many third party domains. It has a tracker. Something like this should not be this leaky IMHO.",{"value":117,"source":77,"evidence":118},"Sharing URLs over ordinary channels adds little security",[119,123],{"id":120,"by":121,"text":122},"39123638","SamBam","No, I think the question is: if you're passing the URLs via email, WhatsApp, or anything else, then if that system is compromised then you've revealed the secret. If you trust…",{"id":124,"by":125,"text":126},"39124980","rerdavies","Why bother encrypting the fragment of the URL at all? Anyone who has the text of the URL gets the message, whether the fragment is encrypted or not. Encryption is just…",{"value":128,"source":77,"evidence":129},"Requests lack sender identity authentication",[130],{"id":131,"by":132,"text":133},"39122211","MattPalmer1086","Interesting. I guess the only weakness I can see is that there is no way to know that a request genuinely comes from the person you think is requesting it. On the one hand, that…",[135,142],{"value":136,"source":77,"evidence":137},"Generate a fresh key pair per request",[138],{"id":139,"by":140,"text":141},"39115350","bvrmn","It seems key-pair is generated only once. Could be great to get fresh for every request.",{"value":143,"source":77,"evidence":144},"Delete or regenerate the private key",[145],{"id":146,"by":147,"text":148},"39121826","bnpxft","great, my browser history is going to be full of secrets now",[150,157],{"value":151,"source":77,"evidence":152},"Why not just send the secret directly over E2E encrypted chat",[153],{"id":154,"by":155,"text":156},"39115907","rakoo","I don't get it: if you have a canal of communication anyway, why not send the secret directly ? We have many options for E2E encrypted communications, some of which are perfect…",{"value":158,"source":77,"evidence":159},"How the two URL exchange works",[160],{"id":161,"by":121,"text":162},"39126245","I'm confused. How do you send the request URL, and how do you receive the encrypted secret? If the answer is \"email, chat, text, Whatsapp\" or whatever, them why not just send the…",[164,175,182,189],{"value":165,"source":77,"evidence":166},"Magic Wormhole and croc",[167,171],{"id":168,"by":169,"text":170},"39123257","tptacek","People keep reinventing Magic Wormhole, and nobody has really done it better; most of them don't even reach parity. https:\u002F\u002Fgithub.com\u002Fmagic-wormhole\u002Fmagic-wormhole",{"id":172,"by":173,"text":174},"39127483","emptysongglass","Haven't found anything better than croc, personally. https:\u002F\u002Fgithub.com\u002Fschollz\u002Fcroc",{"value":176,"source":77,"evidence":177},"yopass",[178],{"id":179,"by":180,"text":181},"39127065","hashmush","We use self-hosted yopass at work. Works great and since the link only works once you can simply send the URL with the decryption key to the receiver. If they can open it, the…",{"value":183,"source":77,"evidence":184},"privnote",[185],{"id":186,"by":187,"text":188},"39112461","_el1s7","Nothing new here. Sites like privnote.com have been around much longer. PGP, end-to-end encryption is everywhere now.",{"value":190,"source":77,"evidence":191},"GPG",[192],{"id":193,"by":194,"text":195},"39129437","g4zj","I generally just use GPG. 1. I share my public key (if not done previously). 2. They encrypt the secret and send the result back, all using whichever tools they'd like. 3. Only I…",{"comments":197,"answered":198,"key":199},16,7,[200,203,204],{"id":201,"text":202},"39131392","That's definitely a good way to do it, and if it works for you then awesome! We're kind of doing something similar here with this in a workflow where you don't have to share the…",{"id":68,"text":69},{"id":205,"text":206},"39122112","Totally valid concern! Retriever.corgea.io is actually hosted on Github pages (do a CNAME check to see).…",{"commenters":208,"max_depth":209,"maker_replies":197,"first_comment_mins":210,"lifespan_hours":211},55,10,391,173,[213,215,219,223,225,227,230,233,235,239,242,245,249,251,253,254,255,256,259,262,263,264,265,268,272,274,277,279,281,284,288,291,292,295,298,300,302,304,305,308,310,312,315,318,321,323,326,328,331,333,336,338,340,341,342,345,348,351,353,355,356,359,362,365,367,370,372,375,378,381,384,385,388,390,392,395,397,399,401,403,405,408,410,412,414,416,419,422,424,426,428,431,435,437,441,442,447,449,452],[168,32,32,214,169,32],"other\u002Fcritical\u002Fidea",[216,32,46,217,218,32],"39124017","project\u002Fpositive\u002Fdesign","chasingtheflow",[220,32,47,221,222,32],"39134957","project\u002Fneutral\u002Fprivacy","meejah",[172,32,32,224,173,32],"commenter\u002Fneutral\u002Fnone",[226,32,32,224,169,32],"39130450",[228,32,32,224,229,32],"39130516","subtra3t",[231,32,32,232,169,32],"39130752","other\u002Fneutral\u002Fnone",[234,32,32,224,229,32],"39132045",[236,32,32,237,238,32],"39128556","other\u002Fneutral\u002Fprivacy","amelius",[240,32,39,241,169,32],"39130443","project\u002Fcritical\u002Fprivacy",[243,32,32,244,238,32],"39130632","commenter\u002Fneutral\u002Fprivacy",[246,32,46,247,248,32],"39135085","project\u002Fpositive\u002Fidea","jcul",[250,32,39,241,103,32],"39137822",[252,32,46,247,248,32],"39139579",[102,32,39,241,103,32],[193,39,32,232,194,32],[201,39,32,247,11,39],[257,39,39,258,194,32],"39131516","project\u002Fcritical\u002Fdesign",[260,37,39,241,261,32],"39121946","forty",[68,37,32,221,11,39],[98,37,39,241,99,32],[205,37,32,221,11,39],[266,37,39,267,169,32],"39123271","project\u002Fcritical\u002Fidea",[269,37,46,270,271,32],"39123464","project\u002Fpositive\u002Fprivacy","jackson1442",[273,37,39,267,169,32],"39123666",[275,37,39,258,276,32],"39123948","quesera",[278,37,39,241,169,32],"39123974",[280,37,39,241,276,32],"39123997",[282,37,32,244,283,32],"39129768","UncleMeat",[285,37,47,286,287,32],"39126875","maker\u002Fneutral\u002Fprivacy","mdekkers",[289,37,32,232,290,32],"39127624","muchosandwich",[179,47,32,232,180,32],[293,47,32,232,294,32],"39127195","semi-extrinsic",[296,47,32,232,297,32],"39129288","damentz",[299,47,32,232,294,32],"39140178",[154,301,39,267,155,32],4,[61,301,32,303,11,39],"project\u002Fneutral\u002Fidea",[120,301,39,241,121,32],[306,301,47,221,307,32],"39126682","Twisell",[309,301,39,241,155,32],"39128827",[311,301,39,267,155,32],"39128783",[313,301,32,232,314,32],"39121260","doublerabbit",[316,301,32,232,317,32],"39121860","0xdeadbeefbabe",[319,301,32,232,320,32],"39122715","minitech",[322,301,32,224,155,32],"39128683",[324,301,47,221,325,32],"39122183","Luctct",[327,301,32,244,155,32],"39128693",[329,301,46,247,330,32],"39128936","andrewaylett",[161,46,47,332,121,32],"project\u002Fneutral\u002Fdesign",[334,46,47,221,335,32],"39126669","nielsole",[337,46,32,221,11,39],"39127000",[339,46,32,332,11,39],"39127006",[84,43,46,247,85,32],[109,198,39,241,110,32],[343,198,47,221,344,32],"39128422","jotaen",[346,198,39,241,347,32],"39128466","psd1",[349,42,46,217,350,32],"39114056","Semitangent",[91,42,32,352,11,39],"maker\u002Fpositive\u002Fnone",[80,354,46,247,81,32],9,[186,209,39,267,187,32],[357,209,32,244,358,32],"39115100","tholdem",[360,209,32,361,11,39],"39119317","maker\u002Fneutral\u002Fidea",[363,209,47,221,364,32],"39121580","lcnPylGDnU4H9OF",[366,209,32,221,11,39],"39121992",[368,209,39,241,369,32],"39123851","e12e",[371,209,32,244,330,32],"39128953",[373,30,46,247,374,32],"39123162","prophesi",[376,30,46,247,377,32],"39123490","deoxykev",[379,30,32,380,11,39],"39123504","maker\u002Fneutral\u002Fnone",[382,30,47,303,383,32],"39128702","za_creature",[139,18,47,332,140,32],[386,18,32,387,11,39],"39119268","project\u002Fneutral\u002Fexecution",[389,18,47,221,377,32],"39123517",[391,18,47,221,374,32],"39123853",[393,31,46,247,394,32],"39111166","brianoconnor",[396,31,32,352,11,39],"39111687",[124,398,39,241,125,32],14,[400,398,32,244,374,32],"39125614",[402,398,39,241,125,32],"39192515",[404,398,32,244,374,32],"39196041",[406,398,32,244,407,32],"39128617","lkbm",[409,398,32,244,407,32],"39129181",[131,411,39,241,132,32],15,[413,411,32,224,290,32],"39123877",[415,411,32,361,11,39],"39127030",[417,411,32,418,132,32],"39127448","commenter\u002Fneutral\u002Fidea",[420,197,32,232,421,32],"39129291","glitchc",[146,423,39,241,147,32],17,[425,423,32,286,11,39],"39122378",[427,423,39,241,290,32],"39127651",[429,423,32,244,430,32],"39129478","8organicbits",[432,433,39,241,434,32],"39129835",18,"kreetx",[436,433,32,286,11,39],"39130855",[438,439,32,232,440,32],"39130534",19,"alxgsv",[113,40,39,241,114,32],[443,444,47,445,446,32],"39123329",21,"project\u002Fneutral\u002Fdocs","city41",[448,444,32,380,11,39],"39123508",[450,451,39,267,222,32],"39134915",22,[453,454,39,241,455,32],"39125544",23,"38",[],[458,463,468,473,478,482],{"id":459,"name":460,"points":461,"category":462},"39120647","funding simulator",654,"finance_crypto",{"id":464,"name":465,"points":466,"category":467},"39113879","teachyourselfmath",384,"learning_science",{"id":469,"name":470,"points":471,"category":472},"39113972","nlm-ingestor",293,"data",{"id":474,"name":475,"points":476,"category":477},"39067496","Coffeehouse",229,"consumer_social",{"id":479,"name":480,"points":481,"category":467},"39072079","Checkmate Champ",192,{"id":483,"name":484,"points":485,"category":486},"39099980","Kener",187,"infrastructure",false,"v2",{"id":490,"name":5,"line":6,"ai":487,"cat":20,"year":13,"points":14,"comments":15,"rec":27,"s":491,"top":18,"kw":492,"maker":11,"domain":10,"tier":19,"attempts":32,"strip":493,"url":9,"mix":494,"praise":76,"objection":95,"sub":21},39105502,-0.26,[21,24,25,26],"5300331113113011103533151315335101011111",[30,31,32,33],1794036648601]