Filekey - Passkey File Encryption

[rockwellshah (Rockwell)]

@corrideat

I’ve built a similar web-based tool that coincidentally got posted around the same time as this one.

1. Crazy coincidence! Your tool looks cool, and reminds me of Portable Secret, which was one of my inspirations for starting to create security tools. Thanks for taking the time to look at Filekey!

@corrideat

As many have pointed out, it’s difficult to get to use it (I tried a Yubikey and also tried software keys, like those one can simulate from the Developer Tools pane, all to no avail).

2. Do you remember what browser you used? Unfortunately passkeys+PRF are only supported by certain browsers and password managers. I think we could make it clearer in the interface though with the failure message what the requirements are so people aren’t confused. We had considered fallbacks, but we really are trying to get away from passwords.

@corrideat

You suggest installing Filekey as a PWA for offline use (or at least, mention the option). Unfortunately, PWAs are vulnerable to arbitrary updates from the server, so I’m not sure how I feel about this option.

3. You can make PWA updates explicitly user opt-in to prevent this. We did this approach for our other privacy app BitNote and we intend to bring it over to filekey.

@corrideat

Filekey doesn’t use a Content Security Policy (CSP). I suggest that you add this and block as much as you reasonably can

4. Agreed. It’s on the to-do list. We have a very strict CSP for BitNote, so we are familiar with the benefits.

@corrideat

It’d be nice to have a repository one can use to inspect the source code as well as a build process that’s deterministic.

5. Agreed, a repo would be nice, and I’ll be building one out soon.

@corrideat

Nitpick: Since I’m not able to use the app, I wasn’t able to test this, but I noticed that you generate extractable AES keys when they don’t really seem to be exported. For defence-in-depth, the extractable flag should be false.

6. Agreed, thanks for pointing that out.