jes / hardbin Goto Github PK

Encrypted pastebin using IPFS

CSS 2.54% HTML 18.55% JavaScript 78.92%

hardbin's Issues

Insecure Cryptography

Lines 5 to 11 in c77c2d7

 function encrypt(data, key) { 

 return CryptoJS.AES.encrypt(data, key).toString(); 

 } 

 function decrypt(data, key) { 

 return CryptoJS.AES.decrypt(data, key).toString(CryptoJS.enc.Utf8); 

 }

-> http://cryptojs.altervista.org/secretkey/doc/doc_aes_cryptojs-v3.html

You're using unauthenticated AES-CBC. https://paragonie.com/blog/2015/05/using-encryption-and-authentication-correctly

Your About section says:

Since nobody can modify the code, and nobody can view the key unless you show it to them, nobody without the key can either read the plaintext or ship a malicious viewer which would exfiltrate the plaintext (or key).

...but this is strictly not true with unauthenticated encryption. In fact, you can recover the plaintext with a padding oracle attack.

Also, your RNG is biased.

hardbin/js/hardbin.js

Lines 13 to 25 in c77c2d7

 function generate_key() { 

 var alphabet = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'; 

 var randombytes = new Uint8Array(32); 

 crypto.getRandomValues(randombytes); 

 var k = ''; 

 for (var i = 0; i < 32; i++) { 

 var idx = Math.floor(randombytes[i] * alphabet.length / 256); 

 k += alphabet.charAt(idx); 

 } 

 return k; 

 }

Add markdown support

Awesome tool! This would seem to make a good replace for gists :)

Which chrome extension to recommend?

There's IPFS Companion and IPFS Station on the chrome store. Which one is better and why?

Subdomain gateway support

When accessing via a subdomain gateway it is unable to resolve

ipfs resolve -r /ipfs/bafybeidu5fa3wnoj6ixuluw6h5otbnsicgwbma7xhnao7zs3wpcn3nj7te/ipfs/bafybeiczbt5m3sox6r7drnzhg5dln33vffy372b42x2v7pmchncqrbbxxu: no link named "ipfs" under bafybeidu5fa3wnoj6ixuluw6h5otbnsicgwbma7xhnao7zs3wpcn3nj7te

Could change the hash replace to <cid>.ipfs.localhost:8080/#<decryption_key>-firstview

hardbin.com can be used to view any IPFS address

Just paste in the one you want and it fetches arbitrary IPFS documents, for example https://hardbin.com/ipfs/Qmbg9p7V6gK58HdGFc7oe9YDyMfXtuytNYUzwbGktc6g1q

This is probably kind of intrinsic to how it works, and you probably realize this already, but it's a sort of weird edge case that I didn't expect to work but does.

Make paste name permanent (add a permanent link to a paste)

Title.
IPNS, was it?

jes / hardbin Goto Github PK

hardbin's Issues

Insecure Cryptography

Add markdown support

Which chrome extension to recommend?

Subdomain gateway support

hardbin.com can be used to view any IPFS address

Make paste name permanent (add a permanent link to a paste)

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent

	function encrypt(data, key) {
	return CryptoJS.AES.encrypt(data, key).toString();
	}

	function decrypt(data, key) {
	return CryptoJS.AES.decrypt(data, key).toString(CryptoJS.enc.Utf8);
	}

	function generate_key() {
	var alphabet = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';

	var randombytes = new Uint8Array(32);
	crypto.getRandomValues(randombytes);

	var k = '';
	for (var i = 0; i < 32; i++) {
	var idx = Math.floor(randombytes[i] * alphabet.length / 256);
	k += alphabet.charAt(idx);
	}
	return k;
	}