Hacker News Reader

Comment by rubbingalcohol | Hacker News Reader

> passwords are generated on the client

Using remotely loaded JavaScript code. This is just not safe.

Hey now, I wouldn't disregard this project completely just because it's built on web tech. The most popular Bitcoin paper wallet generator is the same way - and using that directly involves your money. Their approach to the "it's not safe" argument is by open-sourcing it and letting people run it locally (bottom right) [1]. Maybe that would work well for this project, too.

That said, it's a nice UI, OP. I wouldn't abandon this because of the lack of response you got here.

[1] https://bitcoinpaperwallet.com/bitcoinpaperwallet/generate-w...

Thanks for the feedback and link, much appreciated. Since the application is fully client-side, anyone could download the site and run it locally without any issues. Maybe making this more apparent by providing a download link (similar to Bitcoin paper wallet) is a good idea.

I have a GitHub project (https://github.com/cxam/passed.pw) open at the moment to track issues and plan to make this open source soon after fixing any bugs found during the initial trials.

All the libraries used in this project are open source and I have listed these on the about page with the relevant links.

The most popular Bitcoin paper wallet generator explictly tells you that it's very very unsafe to be running it remotely. It is the equivalent of wgetting a compiled executable, weakly signed with keys that may be compromised (HTTPS), instead of building something from source.

I suggest re-doing this with a better stack.

For the less crypto-educated of us: outside of an air gapped laptop, wouldn't JS loaded from an HTTPS location be just as secure as most other media? Is the concern that execution on the client-side could be hijacked or snooped after the JS fetch?

Reply on news.ycombinator.com