Horcrux
francoisbest.com
Split and recompose secrets with Shamir Secret Sharing

Tired of loosing your passwords/secrets? Shamir’s Secret Sharing has got your back! Split your secrets into many shards and encrypt those for your friends’ public keys, and voilà! demo

PLEASE DON’T USE THIS FOR ANYTHING SENSITIVE. NEVER ENCRYPT ANYTHING IN THE WEB BROWSER IT CAN NEVER EVER EVER BE SECURE BECAUSE THAT IS NOT WHAT A WEB BROWSER IS FOR AT ALL AND IT WILL NEVER BE NO MATTER WHAT PRETEND EXPERTS SAY.

  • kevincox
    4·
    4 years ago

    That’s odd warning. This site claims that everything is done locally so it isn’t any less secure than downloading a program from the site then using it. (If fact that is exactly what a website is.) Unless you are going to sandbox the app to prevent filesystem and network access the website will be just as secure. (In fact more secure because of the sandboxing browsers provide)

    • southerntofuOP
      2·
      4 years ago

      it isn’t any less secure than downloading a program from the site then using it

      Correct, because ideally you should never have to do any of those things! Allowing random people from the Internet to run code on your machine is an anti-feature that opens many problems for security (see browser CVEs) as well as avenues for people to ruin your life in many other ways, cryptomining using your own resources against your will, leaving you to wonder why everything on your system is so slow when your browser is open.

      However, the good way to run a program is to follow the established chain of trust, usually using your distro’s packagers as middlepersons. Another good way is to introduce another layer of trust with either guix or nix and their packagers. They are both focused on reproducible builds, and have 100% packaging/development in the open. But guix has (at least on paper) much better security. AppImage with PGP signatures is also worth mentioning for some situations.

      I didn’t mention Flatpak/Snap, because they’re miles behind (flatpak being less terrible than snap).

      • kevincox
        4·
        4 years ago

        But where are you downloading from? The attacker’s website in either case.

        I guess what you are advocating is that you can use a “trusted” version forever and not run the risk of the author turning trustworthy in the future. However you can also just save the webpage.

          • southerntofuOP
            5·
            4 years ago

            a command-line tool too (does something like that exist?)

            Yes, it’s called ssss and has very good chances of being packaged for your distro!

          • kevincox
            2·
            4 years ago

            Yeah, you could save the page. But at that point, you could use a command-line tool too

            For a lot of users using a saved webpage is much easier than a command-line tool. In fact if it is something I use infrequently I would also rather use a webpage than a command-line tool as well.

  • ayoon
    1·
    4 years ago

    I’ve heard of this technique but didn’t really understand it until I read the wikipedia page just now, really clever stuff