Show HN: Air-gapped file encryption as self-decrypting HTML page

▲ Show HN: Air-gapped file encryption as self-decrypting HTML page(cms-sfx-demo.apeleg.com)

22 points by emurlin 13 hours ago | 10 comments

Air-gapped file encryption packed into a single, self-decrypting HTML page. Repo: https://github.com/ApelegHQ/ts-cms-ep-sfx

I was inspired by self-extracting archives. I wanted to share files with basically no dependencies. The goal was:

  1. Something that didn't require any installation (assuming a web browser)
  2. Have a single file with no network that could self-decrypt
  3. Be fully auditable

The second point is done by having (sort of(*)) reproducible builds and embedded OpenPGP signatures.

The first point is made by cleverly manipulating the HTML structure so that it can decrypt without breaking the PGP signature. It can even decrypt using bare openssl (which was a design goal too, though getting the exact structure right took some work and bug reports).

The third point is accomplished by the first two, and by the source being freely available.

(*) Depends on the OS at the moment.

▲ lukan 17 minutes ago | parent | next [-]

I assume the "air gapped" part is merely indicating no internet required?

▲ DylanMerigaud 12 hours ago | parent | prev | next [-]

Self-decrypting HTML? That's an innovative approach.

▲

112233 44 minutes ago | parent | next [-]

Somebody already has copied this innovative approach and travelled to past apparently: https://acme.com/software/securepage/

	▲	jszymborski 23 minutes ago \| parent [-]
		Methods like these go way further back than 2010... I recall one that had a reward promised if you could break it. EDIT: Here's a patent from 2006 [0] [0] https://image-ppubs.uspto.gov/dirsearch-public/print/downloa...

▲

emurlin 12 hours ago | parent | prev [-]

Yeah, I was inspired by self-extracting archives. I wanted to share files with basically no dependencies.

The goal was:

1. Something that didn't require any installation (assuming a web browser)

2. Have a single file with no network that could self-decrypt

3. Be fully auditable

The second point is done by having (sort of(*)) reproducible builds and embedded OpenPGP signatures.

The third point is accomplished by the first two, and by the source being freely available.

(*) Depends on the OS at the moment.

	▲	dang 2 hours ago \| parent [-]
		I'm going to move this description to the top and re-up the post - I hope that's ok!

▲ nikhilkxmar 6 hours ago | parent | prev | next [-]

Cool!

▲ FatalLogic 12 hours ago | parent | prev [-]

Maybe this is the source?

https://github.com/ApelegHQ/ts-cms-ep-sfx

	▲	dang 19 minutes ago \| parent \| next [-]
		Added above. Thanks!
	▲	emurlin 12 hours ago \| parent \| prev [-]
		Correct