TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Show HN: Pass.sh – simple, secure, password sharing service

20 pointsby jc_secover 7 years ago

10 comments

tatersolidover 7 years ago
Simple, yes.<p>Secure, not so much.<p>Saying “I used encryption” doesn’t make it secure; password distribution is a <i>key management</i> problem which is not solved by encryption.<p>Your secret is stored in a DB you don’t own, and the encryption keys are on a random third party’s servers.<p>No way to verify anything is actually deleted.<p>Email filters will visit the links if you send the URL via email, further exposing the password.<p>Even if sharing a limited-time “reset” password that is forced to be changed immediately there are tons of simpler and more secure options for distribution.<p>I don’t know what scenarios this is useful for in the real world, but I certainly don’t advise using it for anything even approaching important.
评论 #15877312 未加载
iKlsRover 7 years ago
Has little or no server side validation? (form prompts for min 1), I shared <a href="https:&#x2F;&#x2F;pass.sh&#x2F;show&#x2F;2582dbae-5450-4a74-a758-152cdac1c049" rel="nofollow">https:&#x2F;&#x2F;pass.sh&#x2F;show&#x2F;2582dbae-5450-4a74-a758-152cdac1c049</a> with delete after -1 views (simple inspect and edit). It does work to some extent tho as I the link comes up empty. :)
评论 #15876944 未加载
tugberkkover 7 years ago
I see how this is seen as useless and non-secure; and there is logic behind it. But also, as the author suggested this may be a better solution rather than sending e-mails or writing passwords onto a text.<p>Also, since it is open source as the author stated, you can run it yourself on your platform. At least you are going to reduce the number of 3rd parties involved.
bhhaskinover 7 years ago
Name kind of conflicts with Pass (password-store). <a href="https:&#x2F;&#x2F;www.passwordstore.org" rel="nofollow">https:&#x2F;&#x2F;www.passwordstore.org</a>
jesperlangover 7 years ago
This is a neat little application! Would not use it for passwords, but like the idea of temporary snippets of text
wrinkl3over 7 years ago
Why no Unicode support?
B3QLover 7 years ago
You should definitely checkout Shamir&#x27;s Secret Sharing.
mrdavidover 7 years ago
This looks just like pwpush. Have you seen pwpush.com?
评论 #15877344 未加载
conorgil145over 7 years ago
@jc_sec, I see that you commented that you&#x27;re the author of this tool. I am trying to wrap my head around why you created it, but am having a really difficult time understanding the motivation. Perhaps, it was an educational project for yourself to learn about working with crypto. If that was the case, then I applaud your learning, but encourage you to treat such projects as throw away learning experiences and not publish them. In fact, I think that this tool is actually quite dangerous and it would be irresponsible to leave it available online and encourage its use.<p>First, users should NEVER share their passwords with anyone. Ever. The entire purpose of this tool is to encourage users to share their passwords, which is the exact opposite behavior that any good security training program should be teaching users. Any reason that someone offers to justify the sharing of a password is simply a shortcoming in a specific piece of software supporting business needs. Ironically, Troy Hunt had an article this week about password sharing, which covers the topic well [1][2]. I won&#x27;t rehash the argument here, but do please read his post.<p>Second, the tool offers zero security benefit over sending a password via email.<p>&gt; It&#x27;s better than emailing passwords in plaintext<p>No it is not.<p>The content entered into the text box is accessible simply by visiting a link, which means that the data is not end to end encrypted. Any email containing the link is equivalent to containing the password because someone simply needs to click on the link to obtain the password. It doesn&#x27;t matter which cipher you use, which library you use, where you store the keys, etc because the server running the application has the ability to read the plain text content. This tool does <i>not</i> provide end to end encryption, which is required for any reasonable password management tool.<p>&gt; makes security more accessible to folks who dont have the time&#x2F;incinlination&#x2F;technical ability to set up keybase and&#x2F;or estbalish PKI for sharing secrets.<p>Again, no it does not. This tool does not offer any security value, so it cannot make security more accessible to users. Users do not need to know how to setup Keybase or PKI in order to use other existing secure tools. For example, users should utilize software specifically built for managing passwords, such as LastPass [3], 1Password [4], Dashlane [5], Keeper [6], or a vetted open source alternative.<p>I know a thing or two about building end to end encryption systems based on my first hand experience as a Senior Engineer at Virtru [7], a commercially available end to end email encryption solution. I was one of the original employees and helped design the fundamental security architecture, which has been audited by respected independent third parties. You can read more about Virtru&#x27;s technology on their website [8].<p>Again, I do not know whether you truly think that this tool is secure, or if you were just trying to educate yourself and develop some new skills working with crypto libraries. Please realize that this feedback is not intended to vilify, but to educate. Please consider taking this tool down and instead promoting a secure alternative to password management to anyone who asks for guidance on sharing passwords.<p>[1] <a href="https:&#x2F;&#x2F;www.troyhunt.com&#x2F;the-trouble-with-politicians-sharing-passwords&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.troyhunt.com&#x2F;the-trouble-with-politicians-sharin...</a><p>[2] <a href="https:&#x2F;&#x2F;www.troyhunt.com&#x2F;weekly-update-64&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.troyhunt.com&#x2F;weekly-update-64&#x2F;</a><p>[3] <a href="https:&#x2F;&#x2F;www.lastpass.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.lastpass.com&#x2F;</a><p>[4] <a href="https:&#x2F;&#x2F;1password.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;1password.com&#x2F;</a><p>[5] <a href="https:&#x2F;&#x2F;www.dashlane.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.dashlane.com&#x2F;</a><p>[6] <a href="https:&#x2F;&#x2F;keepersecurity.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;keepersecurity.com&#x2F;</a><p>[7] <a href="https:&#x2F;&#x2F;www.virtru.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.virtru.com&#x2F;</a><p>[8] <a href="https:&#x2F;&#x2F;www.virtru.com&#x2F;client-side-encryption&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.virtru.com&#x2F;client-side-encryption&#x2F;</a>
评论 #15897787 未加载
评论 #15929849 未加载
评论 #15929085 未加载
rubatugaover 7 years ago
Interesting, but otherwise useless project