Crypt: Free, Anonymous AES256 file encryption

by liamnewman • 11 years ago

7 15 11 years ago

junto3• 11 years ago

I assume that you're doing client side encryption here right?

To try and guarantee that the Javascript you are delivering is from your server and not MITMed 'by the man', doesn't everything need to be over TLS/SSL and certificate pinning needs to be in place?

I'm no security expert, but there are plenty around who can confirm or deny that.

Edit: The password is being sent in a POST without any encryption to protect that request, or am I missing something?

liamnewman3• 11 years ago

Encryption is server side. Your file is uploaded, encrypted, then deleted.

junto3• 11 years ago

But the password and file are sent over the wire without any protection?

liamnewman3• 11 years ago

Also, I should state that I am getting SSL working atm.

junto3• 11 years ago

If you need free just to get it working I think Cloudflare offer that: https://www.cloudflare.com/ssl

StartSSL as well.

liamnewman3• 11 years ago

Well, there goes the server. If you're having issues, wait. I'm about to switch servers.

tptacek4• 11 years ago

Virtually everyone on the Internet is using an OS that has the built-in capability to encrypt files with AES. Why would anyone delegate that to a server?

freefouran2• 11 years ago

Only thing I could think of is that you can transfer it from one computer to another quickly. And you don't need to create an account (like say if I transferred it through DropBox), just type in a password.

tptacek4• 11 years ago

Right, so you encrypt locally, upload to Dropbox, pass the link to your friend, and they decrypt locally. Still not seeing why you'd opt to trust this doohickey.

heimatau• 11 years ago

I agree. But it's good that people are playing with cryptography though. The more that play, the better the whole can be.

tptacek4• 11 years ago

If you want to learn how cryptography works, learn how to break it. Building sites like this isn't a very good educational tool.

juddus• 11 years ago

The actual encryption of the file is secure, but everything else about the site is insecure. Plus using a free web host to encrypt files with 256 aes is kinda silly. The fact you use md5 for password hashing isn't very secure either.

Edit: The idea of this is nice though. Maybe instead of focusing on encrypting the files, focus on providing a very secure environment to store the files in. Plus sort out the ssl and remove plain text transmission. This could turn into a good site

wglb• 11 years ago

How is it that the site does not have the password do the encryption server side?

Unclear that claims match the reality.

Crypt: Free, Anonymous AES256 file encryption

Related Stories