Filekey - Passkey File Encryption

[rockwellshah (Rockwell)]

@basenote thank you for taking the time to break all of this down, very much appreciate it

We’re excited to keep improving filekey, and this is just the kind of feedback we need.

@basenote

Yubikey’s work* - I could not for the life of me get it to work on any other browser than Brave. I do not know why.

1. What browsers did you try? Unfortunately browsers like Safari will not work with hardware security keys until they have better PRF support.

@basenote

Large files don’t work. At most, I could get a 1.55 GB video file to encrypt but even then, I could not get it to save/download the encrypted file.

2. The file size is basically limited by memory right now. We’re implementing an improved approach that should get around this limitation in v2.

@basenote

I know PRF is not supported by popular password mangers and the dev may have a technical reason for this. But from a user POV, it should still support passkey encryption for what software passkeys from password managers do support. It is incredibly restrictive for what this tool is otherwise. I would categorize this barely as a MVP (using product management terminology)

3. Originally we were only going to support hardware security keys for this very reason. Some of the popular password managers just don’t natively support PRF very well or at all, making this an issue. But they should catch up soon, and then this shouldn’t be an issue going forward.

@basenote

Small files, documents, etc work well, encryption is fast and so is decryption. The save/download after encryption is still iffy sometimes and having used it as much I have, I no longer feel confident in even encrypting a small file at risk of the webpage not working to download/save it. In other words, it works majority of the time but if it’s not 100% for small files, the raison d’être for this tool is non existent.

4. Sounds like a weird bug, if you’re open to it would love to DM you so I can capture what’s going on and we can fix the issue for you.

@basenote

There is no folder support - only singular files. Somewhat limiting if you ask me.

5. Agreed, it’s annoying, we’re working on it.

@basenote

I could not get it to work on Windows at all. This could be because of several factors as mine is heavily debloated and many MSFT services and what have you are disabled but that should not matter now, should it. It’s web based and should work on any web browser but it doesn’t. I know it should as the claim reads - but it doesn’t. I have yet to try it on Linux.

6. If you have a version of windows 10 or below it won’t work, because there’s not OS level support. But Windows 11 should work. Which version of Windows did you try?

Again, thank you for writing all of this up, it’s super helpful! I’ll followup over DM to see if we can fix issue 4 for you.

[anon36940904]

@rockwellshah

1. What browsers did you try? Unfortunately browsers like Safari will not work with hardware security keys until they have better PRF support.

I tried Firefox, Brave, and Safari. Only Brave worked. I personally only want it to work on Firefox and Brave at the vert least. But bonus points for others.

@rockwellshah

4. if you’re open to it would love to DM you so I can capture what’s going on and we can fix the issue for you.

Sure!

@rockwellshah

Which version of Windows did you try?

Windows 11. I am 24H2 on the latest version as far as I can tell.

–

Thank you for following up. I’m happy to help you improve this!

[pika]

Found it very slick in my test usage. I like the share key feature the most . I don’t know if any other project has ever had this type of usage with fido2

[corrideat]

@rockwellshah I’ve built a similar web-based tool that coincidentally got posted around the same time as this one.

I ended up taking a look at Filekey and how it works, partly to satisfy curiosity and partly to see how it compares to what I implemented.

I thought that I’d share a couple of suggestions based on my experience with it and with writing a similar tool:

1. As many have pointed out, it’s difficult to get to use it (I tried a Yubikey and also tried software keys, like those one can simulate from the Developer Tools pane, all to no avail). I understand that this may not be entirely your fault (my own experience with WebAuthn show that it’s non-trivial to implement something that works consistently for a wide user-base). Now, that’d be fine if this is intended as an MVP / tech preview, but otherwise you may want to improve on this aspect. Similarly, I’d consider offering a fallback for users that can’t or won’t use a key or supported password manager, such as generating a passphrase.
2. The following is mostly based on what I could gather from looking at the source code and looking at your demo video, since I wasn’t able to actually try it out:
   • You suggest installing Filekey as a PWA for offline use (or at least, mention the option). Unfortunately, PWAs are vulnerable to arbitrary updates from the server, so I’m not sure how I feel about this option. Since the tool is quite capable of running offline, I suggest offering an option to download the HTML directly, and maybe some brief instructions on self-hosting for mobile (since iOS in particular doesn’t like opening local HTML files)
   • Filekey doesn’t use a Content Security Policy (CSP). I suggest that you add this and block as much as you reasonably can (it’s supported as a header and as a meta tag, I’d do both; the more restrictive CSP applies, and you can even make it dynamically more restrictive). The reason being that this is a foolproof way (at least, as much as the web allows) of blocking network capabilities. This way, you and your users can be reasonably certain that data won’t be leaked.
   • While one can inspect the source code and it’s reasonably readable, I’m assuming that you have some kind of build process in place (if you don’t, maybe I suggest starting with that). It’d be nice to have a repository one can use to inspect the source code as well as a build process that’s deterministic. This way, one can more easily audit how things work and also be reasonably certain that it hasn’t been tampered with.
   • Nitpick: Since I’m not able to use the app, I wasn’t able to test this, but I noticed that you generate extractable AES keys when they don’t really seem to be exported. For defence-in-depth, the extractable flag should be false.

I see that you’re working on version 2, so I hope that these comments may be useful to incorporate to that.

[rockwellshah (Rockwell)]

@corrideat

I’ve built a similar web-based tool that coincidentally got posted around the same time as this one.

1. Crazy coincidence! Your tool looks cool, and reminds me of Portable Secret, which was one of my inspirations for starting to create security tools. Thanks for taking the time to look at Filekey!

@corrideat

As many have pointed out, it’s difficult to get to use it (I tried a Yubikey and also tried software keys, like those one can simulate from the Developer Tools pane, all to no avail).

2. Do you remember what browser you used? Unfortunately passkeys+PRF are only supported by certain browsers and password managers. I think we could make it clearer in the interface though with the failure message what the requirements are so people aren’t confused. We had considered fallbacks, but we really are trying to get away from passwords.

@corrideat

You suggest installing Filekey as a PWA for offline use (or at least, mention the option). Unfortunately, PWAs are vulnerable to arbitrary updates from the server, so I’m not sure how I feel about this option.

3. You can make PWA updates explicitly user opt-in to prevent this. We did this approach for our other privacy app BitNote and we intend to bring it over to filekey.

@corrideat

Filekey doesn’t use a Content Security Policy (CSP). I suggest that you add this and block as much as you reasonably can

4. Agreed. It’s on the to-do list. We have a very strict CSP for BitNote, so we are familiar with the benefits.

@corrideat

It’d be nice to have a repository one can use to inspect the source code as well as a build process that’s deterministic.

5. Agreed, a repo would be nice, and I’ll be building one out soon.

@corrideat

Nitpick: Since I’m not able to use the app, I wasn’t able to test this, but I noticed that you generate extractable AES keys when they don’t really seem to be exported. For defence-in-depth, the extractable flag should be false.

6. Agreed, thanks for pointing that out.

[corrideat]

Thank you for your response.

@rockwellshah

You can make PWA updates explicitly user opt-in to prevent this. We did this approach for our other privacy app BitNote and we intend to bring it over to filekey.

That’s pretty cool. Do you have reference material about this, or could you point me to the parts in BitNote that implement this? I wasn’t aware that this was possible (one of the ways I thought this usually breaks is that the service worker source itself can’t be intercepted, and browsers may refresh the SW every ~24 hours or so).