Crypt: Free, Anonymous AES256 file encryption(wesh.gift)

7 pointsby liamnewman11 anni fa15 comments

Crypt: Free, Anonymous AES256 file encryption

http://wesh.gift/crypt/

5 comments

Virtually everyone on the Internet is using an OS that has the built-in capability to encrypt files with AES. Why would anyone delegate that to a server?

freefouran11 anni fa

Only thing I could think of is that you can transfer it from one computer to another quickly. And you don't need to create an account (like say if I transferred it through DropBox), just type in a password.

tptacek11 anni fa

Right, so you encrypt locally, upload to Dropbox, pass the link to your friend, and they decrypt locally. Still not seeing why you'd opt to trust this doohickey.

freefouran11 anni fa

I always found DropBox a pain, you have to email them the link, which is a bit more effort than saying going to a short URL and typing in a password. So I could see this being somewhat useful :)

tptacek11 anni fa

If you've invented the most convenient file transfer tool on the whole Internet, you've buried the lede here; forget about the encryption, and get your Dropbox-competitor funded.

If you haven't, well, people should use that other service instead of this one.

Either way: I'm still totally unclear on why anyone would allow a server to encrypt files for them. I don't even reach the question of whether it's possible to do it securely, because it seems like such a weird thing to want.

[deleted]11 anni fa

heimatau11 anni fa

I agree. But it's good that people are playing with cryptography though. The more that play, the better the whole can be.

tptacek11 anni fa

If you want to learn how cryptography works, learn how to break it. Building sites like this isn't a very good educational tool.

liamnewman11 anni fa

Well, there goes the server. If you're having issues, wait. I'm about to switch servers.

juddus11 anni fa

The actual encryption of the file is secure, but everything else about the site is insecure. Plus using a free web host to encrypt files with 256 aes is kinda silly. The fact you use md5 for password hashing isn't very secure either.

Edit: The idea of this is nice though. Maybe instead of focusing on encrypting the files, focus on providing a very secure environment to store the files in. Plus sort out the ssl and remove plain text transmission. This could turn into a good site

junto11 anni fa

I assume that you're doing client side encryption here right?

To try and guarantee that the Javascript you are delivering is from your server and not MITMed 'by the man', doesn't everything need to be over TLS/SSL and certificate pinning needs to be in place?

I'm no security expert, but there are plenty around who can confirm or deny that.

Edit: The password is being sent in a POST without any encryption to protect that request, or am I missing something?

liamnewman11 anni fa

Encryption is server side. Your file is uploaded, encrypted, then deleted.

junto11 anni fa

But the password and file are sent over the wire without any protection?

liamnewman11 anni fa

Also, I should state that I am getting SSL working atm.

junto11 anni fa

If you need free just to get it working I think Cloudflare offer that: https://www.cloudflare.com/ssl

StartSSL as well.

wglb11 anni fa

How is it that the site does not have the password do the encryption server side?

Unclear that claims match the reality.