Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add "Remember me" button #124

Merged
merged 10 commits into from
Feb 10, 2022
Merged

Add "Remember me" button #124

merged 10 commits into from
Feb 10, 2022

Conversation

robinmoisson
Copy link
Owner

@robinmoisson robinmoisson commented Feb 9, 2022

Inspired by the discussion of #120 and #122 - this adds the option to put a "Remember me" checkbox on the decrypt screen.

When checked, when a user decrypts the page the passphrase will be saved in localStorage in plain text in the staticrypt_passphrase field and will automatically decrypt the page when they come back.

If a non-zero expiration has been set when encrypting the page, another field staticrypt_expiration is created and saved in localStorage when the passphrase is successfully entered. If the user comes back to the page after this expiration date, both values are cleared from localStorage and the user has to enter their passphrase again.

It's also possible to clear the saved passphrase at anytime by appending staticrypt_logout to the URL query parameters.


The PR also adds more parameters to make all strings from the default password template editable (to help make i18n more accessible).

Screenshot from 2022-02-09 11-42-59

Closes #120, closes #114, closes #122

Copy link
Contributor

@epicfaace epicfaace left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, thanks for adding this!!

README.md Outdated Show resolved Hide resolved
@epicfaace
Copy link
Contributor

epicfaace commented Feb 9, 2022

Also -- your suggestion -- "A mitigation I had in mind was salting + hashing the passphrase and store that in localStorage, so the hashed passphrase effectively becomes the key to the encrypted page. This doesn't mitigate the leaking of the hashed passphrase, which allows decryption of the page, but does mitigate password reuse." -- I think it's worth it to run something like pbdkf2 on the password, just to mitigate this risk of password reuse! Might be better to add now in this PR rather than later and expose people to more risk

Copy link
Contributor

@epicfaace epicfaace left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

typo

Copy link
Contributor

@epicfaace epicfaace left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

typo

README.md Outdated Show resolved Hide resolved
@robinmoisson
Copy link
Owner Author

@epicfaace yes I agree it would be better to not release a version that store cleartext password even temporarily, so I did the change in this PR and it's now the salted + hashed passphrase that we store in localStorage.

Thanks for your review & feedback!

cli/index.js Outdated Show resolved Hide resolved
robinmoisson and others added 2 commits February 9, 2022 23:33
Co-authored-by: Ashwin Ramaswami <aramaswamis@gmail.com>
@robinmoisson robinmoisson merged commit 26563f5 into gh-pages Feb 10, 2022
@robinmoisson robinmoisson linked an issue Feb 10, 2022 that may be closed by this pull request
@robinmoisson robinmoisson deleted the remember-me branch February 10, 2022 19:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Extension for encrypting an entire website Allow caching of password Encrypting Multiple Pages
2 participants