Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

"Do you think this cannot possibly be secure? Great, prove it.

This secret contains the recovery key for a Bitcoin wallet. Crack it and take my money!"

Love it.



The first few times I shared this with (security professional) colleagues and friends, they'd dismiss it right away "this can't possibly work", but it was because they _assumed_ it didn't work (too simple).

Attaching a challenge made a big difference, they'd spend 5 minutes trying to crack it and, in the process, realize it is actually sound (despite the simplicity).


I think this is very cool, and from a cursory look you've made most of the right design choices (to the extent that the Web Crypto API allows).

That being said, I think most security professionals (myself included!) aren't equipped to outright "crack" this kind of thing in just a few minutes, and most should know better than to think that their inability to do so implies soundness.

With that in mind, here are some things I noticed (none of which represent an immediate break!)

* You're using SHA-1 in your KDF. That's probably fine since PBKDF2 doesn't rely on the properties of SHA-1 that have been broken, but the Web Crypto API gives you better alternatives. You could switch it out for SHA2-256 here without any breakage to the rest of the scheme.

* I'm not a JS expert, but I _think_ your encryption page might allow a confused user to reuse an IV[2]. Normally this wouldn't happen because the user would refresh or reload and trigger the `init` on page load, but it would probably be better to generate the IV on demand rather than having it wait in an HTML attribute.

Again, very cool work! The fact that people can make these kinds of self-containing encrypted applications with Web APIs is a serious testament to how far the standards have progressed.

[1]: https://github.com/mprimi/portable-secret/blob/3b22d2b42baf8...

[2]: https://github.com/mprimi/portable-secret/blob/4de5e958fe6f8...


Thank you.

> most security professionals (myself included!) aren't equipped to outright "crack" this kind of thing in just a few minutes

When I say 'crack' in this context, I mean review the scheme and point out any obvious flaws, like you just did!

> SHA-1 -> SHA2-256

I should do this!

> reuse an IV

Indeed (there is a fine-print in the creator page that says "don't reuse across messages", but I should just regenerate proactively)

Thank you very much for the great comment!


> despite the simplicity

FWIW, it's a simple composition of complex things. Still really cool, thanks for the idea!


Why would they dismiss this?


Because it seems too simple to be secure.

(People are busy, attention is scarce, etc)


Feels like the default human response in a lot of situations...


Notice they have also given clues to what the password words are. So with brute force, maybe spending a good portion of the bounty on cloud resources, you might crack it that way :-)


This is a smart use of crypto too. The verifiable and public parts of crypto here are a benefit and not a con.


If someone tells you:

    This secret image contains a Bitcoin wallet recovery key
    If you can crack the secret, the funds are yours!

    You can check the status of the wallet here: 
    https://www.blockchain.com/explorer/addresses/btc/1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa

Now here's the secret:

    0002146273a3774b3828effff3382000someGarbageSecretThatsActuallyIs{https://youtu.be/eBGIQ7ZuuiU}EnctyptedUsingARandom4096BitStringAsPassword


Which "verifiable and public" part helped?

- Anyone can point to a random link on blockchain.com

- the encrypted secret can contain anything


They didn't do it here, but you can sign a message that includes a checksum of the application with the private key of that address. The signed message can be proved using just the public key that they have linked to.


but you are not guaranteed that the decrypted key is valid.


I hate that I’m saying this because I believe all of cryptocurrency to be a pyramid scheme, but… this is the perfect use case for a smart contract on ethereum…

(Now I gotta go wash my hands after typing this.)


why would a smart contract help though? there needs to be proof that the encrypted key is valid, this would require zero knowledge proof but I'm not sure how you can do it for this use case.


He could post a secret in the decrypted text on the page that, once submitted to the chain, fulfills the contract and transfers the ETH. I know very little about smart contracts but I thought this is what they’re good at… “if a value is posted with a sha512 hash that matches x, the contract is fulfilled”, and put the value on the page, encrypted, and ask hackers to decrypt it.

It doesn’t necessarily prove that the encrypted key is valid, but it proves that the author put some money up on the chain at least. It could always be that the decrypted text doesn’t provide the key that fulfills the contract, but ultimately that isn’t a solvable problem. You can’t prove a claim about some encrypted text without someone having the ability to decrypt it.


But then you don’t need to have a smart contract, simply posting public key of the wallet is enough (to verify the content of the wallet). The contract at most provides an escrow, but even that isn’t really the case since presumably the originator has the key to pull the money (since he knows the secret key).

Proving that an encrypted text has the private key is possible for some encryption schemes through zero knowledge proofs, but I guess not in this case in particular.


Offering a bounty like this has value, but probably only for finding shallow bugs.

Thoroughly evaluating security/cryptography takes deep expertise and a lot of time. You're not going to elicit that without more money, impact/fame, or technical excellence.

- Money: The original bounty was $400. An expert can probably earn $400 an hour just to investigate something, without needing to completely break it.

- Impact/fame: Barely anyone uses this project. There are tons of other tools and services that are more widely used.

- Technical excellence: There's no evidence of anything clever or interesting.

For example, researchers around the world spend tons of effort analyzing the algorithms in the various NIST cryptography competitions. There's significant impact/fame and clear evidence of technical excellence. But if some rando offers a $10k bounty for their encryption algorithm, it's not going to get the required level of scrutiny.

Plus, the bounty is just for the encryption mechanism. With security, it's usually the other moving parts that cause issues, especially in how they interact with human behavior. Phishing works without needing to break TLS, DKIM/SPF, browser sandboxing, etc.

(I read an article ~5-10 years ago by a security/crypto researcher that said basically this, but sadly I can't find it anymore.)

I still think it's great when people build things like this and when they offer any kind of bounty. I just worry that the presence of an unclaimed bounty might mislead people into overestimating the level of security.


FWIW, I (author) agree wholeheartedly with everything you say.

I'm just sharing a little hack I came up with. I hope some people add it to their toolchain (not my specific implementation, the idea in general).

And offering a bounty seemed like a fun things to do, which may also catch some shallow bugs, reward the hunter, and shame me publicly :-)


Very creative and efficient use of $400 on PR/advertising!


$400 or $0?

I don't think of it as PR/Ad. It's a bounty. If you put in time to find a flaw, you deserve at least that much (and I'll give you more if you help me fix it).


Why can't it be both?


What is your comment referring to? I must have missed something...



What happened to the "don't roll your own crypto" that HN loves?


this doesn't, it uses the browser's builtin Web Cryptography API.

if using a crypto algorithm also counts as "rolling your own crypto" then what's left? just don't encrypt anything, ever, because HN says we shouldn't roll our own?


Yes, using a crypto algorithm also counts as rolling your own crypto. You're putting together crypto libs that others wrote. Most crypto vulnerabilities come from glueing together solid crypto implementations. The glueing has to be solid too. Just "using" a crypto algorithm sounds like a recipe for a vulnerability.

I'm not a crypto expert, I'm just telling you what I've been reading on HN for the past few years.


You're not completely wrong in that it's still possible to f up, even when using misuse resistant primitives.

The difference is, you're sort-of allowed to f up if it's an intelligent mistake that teaches the creators of misuse resistant libraries a thing or two about where they went wrong. If OTOH you're clearly just yoloing it, introducing your pseudo-math BS into the mix, or intentionally deviating from best practices or breaking it, then it's on you.


re-using primitives is on a completely different level from creating your own cipher.


[flagged]


Using the output of a language model like mine as a comment reply on a forum like HN could potentially have a negative impact on the discourse in a number of ways.

1. It could undermine the authenticity and integrity of the conversation by introducing responses that are not genuinely from a human.

2. It could create confusion or misunderstanding, as the responses generated by the language model may not be relevant or appropriate for the specific context in which they are used.

3. It could discourage genuine participation and contribution from other members of the community, as it may seem like the conversation is being dominated by automated responses rather than authentic human interaction.

Overall, it is important to consider the impact of your actions on the online community and to strive to contribute to respectful and meaningful discourse. Using the output of a language model as a substitute for genuine human interaction is generally not a good idea, as it can undermine the authenticity and integrity of the conversation.


They didn’t roll their own crypto? They used the web crypto API provided by the web browser.


I can't be the only one who thinks this wallet will be emptied before 2023.

Security by obscurity is real, there's nothing secret about defining the problem space in which your attackers can search.


I'd be happy to see the wallet emptied.

This is what the bounty is for. I just hope whoever cracks it lets me know how they did it and how hard it was.

This is what a bounty is, no?


$400 is nothing, put your life savings into this system if you trust it so much.

It's a cute marketing gimmick, that's about it.




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: