PrivacyProtect includes many updates from Portable Secret!

[therockstorm]

The following is a list of PRs, issues, and discussions from Portable Secret and their status in Privacy Protect.

PRs

• Use password type for inputs: @ggorlen @bend-n, this is incorporated!
• Various improvements to secret template html file: @gamedevsam, this is incorporated!
• Rewrite code for better readability and performance: @smunteanu6, I made many changes from the original code and believe this is incorporated.
• created a css file for the styling and re-arrange the html layout: @Faruqoloyede, I made many style changes, let me know what you think.
• Wraps the password input field and "Decrypt" button in a form: @jrc03c, this is incorporated!
• Fix encoding issue: @TeddyBear06, @Unkn0wnCreator, I think mine has the same bug, I'll get this fixed, thanks!
  • This is now incorporated!
• Make links to other projects active: @janek37, @millette, my links should work, let me know if they don't!

Issues

• Creator giving "TypeError: Failed to fetch" error on ChromeOS and Secret Creator doesn't work from file:// offline and Creator fails on Chrome for CORS policy: @Comicly69, @dardoor, @MaggieLeber, shouldn't be an issue with this repo.
• Add date/time to saved html file: @hsingfoo, good idea! This isn't incorporated yet.
• Plausible deniability feature?: @vinhdizzo, interesting idea! I'll have to think about how I might implement this.
• State the encryption algorithms in the README: @shadowbq, I link to https://www.privacyprotect.dev/security, which describes the encryption used.
• Few comments: @dzek69, do you still see browser freezes with this version?
• Allow ImageCapture API to enable accepting images direct from mobile camera, @cameronelliott, good idea! I'll have to look into how much work this is.
• “Prior Art” ⇒ 2 suggestions, @smondet, @ryan-williams, I'm working on the shell script, more soon!
  • The script is live! It's not published anywhere (for now) so you'll need to clone the repo. It's documented in the README.
• Specific message for incorrect decryption password, @Cade66, this should be incorporated!

Discussions

• @KenyOS, @sidcode, @Super-Gee, @fredjohnsen, @MarkusZoppelt, @cottsak: this repo contains many updates. Let me know if I'm missing anything from your discussion comments!

[dumblob]

Thanks for the (growing) list and all the effort!

[ghost]

Thanks indeed!

[dzek69]

It's much better in terms of performance, with almost 100MB file browser still struggles a little bit, but it's much better than it was before on 19MB file.

One thing to improve: disable the button when trying to decode a file - currently it does the fading animation but i can still click it and trigger the heavy computations few times, so browser is still much less responsive after initial "wrong password" message

Awesome job you did with the project! So much more user friendly!

[therockstorm]

Thanks for looking into this! Great idea on the button disabling. I did this on the encrypt side but totally forgot for decrypt. This is fixed now.

[TeddyBear06]

Awesome work... Well done!

[hsingfoo]

Indeed, top! and many thanks

[therockstorm]

@vinhdizzo, plausibly deniable encryption is working via the CLI!

./cli.ts encrypt -m "My secret" --hint "My hint" --deniableMessage "My deniable secret" ./out/secret.html will prompt for two passwords. Running ./cli.ts decrypt ./out/secret.html and giving the first password will yield My secret. If you run it again and give the second password, you'll get My deniable secret.

[dzek69]

Not really a plausibly deniable when it's definitely visible that two things are encrypted in the file:

The feature is nice, but name can be misleading

[dumblob]

Generally plausible deniability lacks any usefulness if not done from (and including!) the HW upwards - see mprimi/portable-secret#28 (comment) .

[therockstorm]

This isn't going to fool someone versed in software development or cryptography, but may fool an overzealous border agent demanding that you decrypt your secret. The use-case is laid out in this Wikipedia scenario. I implemented it as a simple array because it's flexible and allows for future features like encrypting any number of files and messages.

There are other ways to obfuscate the two ciphertexts, but to @dumblob's point, in order to fool an expert, you'd need it all the way down, especially since the code is open-sourced.

So it will by no means fool everyone, but I believe it fits the definition of deniable encryption.