boris1

12 ms·

1.
by boris1 5y ago
I've now implemented folder encryption. If you encrypt folder 'foo', you get the file 'foo.encrypted'. When you decrypt it using the same tool, you get file 'foo.zip' which you download and uncompress int
2.
Website switcheroo: links opening in tabs are dangerous (Tab Nabbing)(borisreitman.medium.com)
2 points by boris1 5y ago|0 comments
3.
Problems with ancient musical scales(borisreitman.medium.com)
22 points by boris1 5y ago|11 comments
4.
by boris1 5y ago
Update: the tool now allows to encrypt (and decrypt) files. It works in mobile browser too.
5.
by boris1 5y ago
The check digits solve the MITM problem. You should compare them by another channel than email, such as text message. This is called "Short Authentication String" (SAS).
6.
by boris1 5y ago
Thanks, gonna fix it.
7.
by boris1 5y ago
I've improved the encrypt/decrypt form. Now the textareas expand, and there's a copy to clipboard button in order to copy the output. It makes it much easier to use on the phone.
8.
Diffie-Hellman for the layman(borisreitman.medium.com)
21 points by boris1 5y ago|8 comments
9.
by boris1 5y ago
Yes, just do not write (mod p), as it can be misleading to the reader. A mathematician doesn't care, but in RFCs they call the (mod p) groups a "prime group" to differentiate it from the Elliptic Curve group. (In fact, I thin
10.
by boris1 5y ago
I'm using Elliptic Curve variant. There's no "mod". But you got the general idea. Also, all the math is built-in and done natively by the browser.
11.
by boris1 5y ago
The only way is to use another channel for the Short Authentication String (SAS) (check digits in my case). I recommend that people SMS them the check digits, and exchange the DH offers by email.
12.
by boris1 5y ago
There's no difference for the MITM how I pick the Short Authentication String (SAS) (the check digits). But there's a difference in terms of strength of the encryption key, if you are planning to use the full password as input to
13.
by boris1 5y ago
I've simplified the page by creating two modes: "simple" and "advanced". By default "simple" is shown, and it's what you'd need if you are the recipient, rather than an initiator would would be n
14.
by boris1 5y ago
I've simplified the page by creating two modes: "simple" and "advanced". By default "simple" is shown, and it's what you'd need if you are the recipient, rather than initiator.
15.
by boris1 5y ago
Do yourselves a favor, and read Ayn Rand. Monopolies are created by governments, and are impossible in laissez-faire. Apple has created the App store when MS was seen as a "monopoly" that no one could move. Innovations beats anyon
16.
by boris1 5y ago
I've made a new addition: now the operating system of the other party is also sent as part of the exchange. This info helps decide what software to use for further encryption. e.g. DMG or BitLocker? And, I managed to do it without maki
17.
by boris1 5y ago
You are right about YouTube embed. The sw.js is sending stuff, and I don't want that. I'm going to put the YouTube into an overlay, and will remove it from DOM after it's watched. EDIT: it's done.
18.
by boris1 5y ago
Note that I'm using the Elliptic Curve Diffie-Hellman (ECDH) exchaneg, which is an additive group. That's how I can get the shared keys down to a small size.
19.
by boris1 5y ago
I didn't roll my own. I'm using built-in browser functionality, available under crypto.subtle object of the browser. You can review the code in my WebUtil library on Github @borisreitman. It's just a light wrapper on top of b
20.
by boris1 5y ago
I'm the author. This is a good suggestion, and I have moved my picture from the side menu, to the top of the scrollable portion.
21.
by boris1 5y ago
Good idea. I will change it, should be live in 1 hour. I am going to SHA-256 hash it, then add the bytes of the hash and mod by 10000. It's better than just taking the first two bytes, because I want a 4 digit number.
22.
by boris1 5y ago
Hi, I am the author. I know, but I wanted to use something built-in in the browser. When the browser implements Curve25519 I will change the code.
23.
by boris1 5y ago
I'm the author. No data is sent after dependencies have loaded. The "init()" function in the page runs right after. So you can use the Network debugger to see that nothing is sent anywhere. I just don't think an ugly pag
24.
by boris1 5y ago
Thank you, I am the author. Feel free to contact me if you have tips how to make it even simpler.
25.
by boris1 5y ago
I'm the author. If you are referring to my page, the Developer notes provide all the info you need, and the source code is trivial. I've placed all the encryption stuff in a barebones open source library that you can read on GitHu
26.
by boris1 5y ago
That's why you have the Check Digits. There's no way to communicate a long and cryptic password on the phone. But it is easy to compare check digits on the phone.
27.
Show HN: Diffie-Hellman exchange for the layman(borisreitman.com)
75 points by boris1 5y ago|52 comments
28.
Show HN: Outdoor standing desk that goes on a tree(indiegogo.com)
8 points by boris1 6y ago|0 comments
29.
by boris1 6y ago
It would make good history: A novel tree-based data structure invented while working on a tree table.
30.
by boris1 6y ago
I refactored it and posted a pic. It's simple to carry now. (You were right.) The final product will be even better (would pack smaller, and will be lighter. That's because I'm planning to use thin aluminium for the table to

More ›