Show HN: Air-gapped file encryption as self-decrypting HTML page
Thread
Unofficial Hacker News client; not affiliated with Y Combinator.
Show HN: Air-gapped file encryption as self-decrypting HTML page
Unofficial Hacker News client; not affiliated with Y Combinator.
pwdisswordfishq · · focus · HN ↗
<a href="https://jdebp.uk/FGA/dont-use-self-decrypting-files.html" rel="nofollow">https://jdebp.uk/FGA/dont-use-self-decrypting-files.html
I mean, basing this on HTML arguably mitigates the portability and vulnerability concerns, but the problem of trusting the decrypted contents still remains.
Hacker_Yogi · · focus · HN ↗
emurlin · · focus · HN ↗
This was motivated for situations where using GPG just isn't practical. The issue is that there are very limited options to share a file securely without needing to install additional software (ZIP files come close to this, with some important caveats).
As I was making this, I tried to mitigate many of the concerns raised in that article. For example:
> ask for an file that can be decrypted with an ordinary standalone decryption tool
You don't need to run the self-decryption code at all. You can use 'ordinary' tools like `openssl` to decrypt the contents (note to self, add the `openssl` instructions to the `<noscript>` rendering).
> People who publish decryption tools expend effort to ensure that recipients can trust the actual decryption tools themselves before running them.
You _can_ verify the integrity of the tool itself using gpg. Since you can't verify the entire HTML file (otherwise, you wouldn't be able to inject the encrypted payload), there's ways a malicious actor could add additional scripts and still pass the integrity check. However, if you're diligent enough to be using gpg to check this, you'd likely also be diligent enough to spot such additions, or you'd be using the openssl route.