Use Case about self-decrypting-html-page

[derhuerst]

I originally built this as part of html-vault and then pulled this part out of it. The idea is two have a tool that encrypts any message/secret and generates something that can decrypt itself. I see mainly two advantages of the HTML-based solution over others:

• low entry-barrier: everyone has a web browser. everyone with a reasonably modern browser will be able to use the tool, without installing anything. it is also more platform-independent than other solutions.
• self-contained: the generated self-decrypting page contains all the logic it needs to decrypt the encrypted messages it contains. it can be easily stored as a file.

With self-decrypting-html-page, you can use this functionality anywhere. The example in the readme uses sodium-encryption as an example, but you can pass any key & nonce you want.

[derhuerst]

How it works:

• lib/decrypt.js contains the logic to decrypt the message, using the nonce and the password entered by the user.
• lib/decrypt.js gets bundled with all its dependencies and stored in decrypt.js, using Browserify.
• Then, using brfs, the generated bundle will be inserted into another JS file generate.js. The version of self-decrypting-html-page published to npm already contains it.
• When you call generateHTML, it will replace placeholders in the HTML (that already contains the code to decrypt) and give the string back to you.

[jadster]

Can the page only contain an encrypted string? Or could you send a whole styled page in an encrypted format and have the styled page only show up in full after entering a password?

[jadster]

I mean a page with images, links, css, etc.

[derhuerst]

Currently the decrypted message is being shown in a text field. One could modify self-decrypting-html-page though, so that the message can e.g. be download as another HTML page.

On the other hand, what you suggest has security implications: If your browser downloaded the decrypted HTML automatically, you would store the decrypted message on disk by accident.

[jadster]

The string is not saved to disk? Cached?

[derhuerst]

Right now the string will only be shown in a text field. Try it at https://html-vault.jannisr.de !

[derhuerst]

Please reopen if you have any other questions.