jstrieb/link-lock

Password-protect URLs using AES in the browser; create hidden bookmarks without a browser extension

Link Lock

Password-protect URLs using AES in the browser.

Link Lock now supports secure, hidden bookmarks via bookmark knocking! Read more here.

About

Link Lock is a tool for encrypting and decrypting URLs. When a user visits an encrypted URL, they will be prompted for a password. If the password is correct, Link Lock retrieves the original URL and then redirects there. Otherwise, an error is displayed. Users can also add hints to display near the password prompt.

Each encrypted URL is stored entirely within the link generated by the application. As a result, users control all the data they create with Link Lock. Nothing is ever stored on a server, and there are no cookies, tracking, or signups.

Link Lock has many uses:

• Store private bookmarks on a shared computer
• Encrypt entire web pages (via URL Pages)
• Send sensitive links over public or insecure channels (e.g., posting links to a public website that require a password to access)
• Implement simple CAPTCHAs – particularly effective against basic web scrapers that do not respect robots.txt
• Add a password to shared Dropbox or Google Drive links
• Share password-protected magnet links and torrents
• Evade censorship

Link Lock uses AES in GCM mode to securely encrypt passwords, and PBKDF2 and salted SHA-256 (100,000 iterations) for secure key derivation. Encryption, decryption, and key derivation are all performed by the SubtleCrypto API. The initialization vector is randomized by default, but the salt is not. Randomization of both the initialization vector and salt can be enabled or disabled by the user via "advanced options." The salt and initialization vector are sent with the encrypted data if they are randomly generated. The API is versioned such that old encrypted links will always work, even if later versions of Link Lock are updated to be more secure. Please read the code (api.js in particular) for more information.

Read the Hacker News discussion here.

Also discussed on r/netsec and discussed on r/programming.

Examples

• Regular link encryption - Password: hackernews
• Encrypt entire pages - Password: urlpage5
• Implement a simple CAPTCHA
• Emoji support - Password: avocado
• Riddles in the dark - The password is a single, lowercase word
• Share torrents - Password: torrenting_is-legal!

Disclaimer

The code was written to be read. Please read it, especially if you don't trust me to build a secure encryption application. In particular:

• I am a college student, not a security professional – there may be best practices I am not aware of. I have graduated college, and now work for a cybersecurity company.
• Once someone decrypts a link, they can share the original URL as much as they want. Only share encrypted links with trusted people.
• I am not comfortable using JavaScript, and I don't have a firm grasp of the nuances of the language – there may be bugs that I don't even know to check for.
• This is the first project I have ever done using encryption – there is likely a subtle mistake somewhere.
• Most of the encryption/decryption code is based on MDN tutorials for the SubtleCrypto API.

Usage

• Create a locked link here: https://jstrieb.github.io/link-lock.
• Once you have a locked link, create a hidden bookmark here: https://jstrieb.github.io/link-lock/hidden.
• Use the advanced options when creating a link to make the encryption more secure (at the cost of a longer link).
  • By default, the initialization vector is randomized for security, but this can be disabled, even though doing so is a vulnerability.
  • By default, the salt used to hash the password during key derivation is not randomized, but this can be enabled.
• To bookmark a locked link, drag it from the output box to the bookmarks bar. Alternatively, visit the locked link and bookmark it before entering the password.
• If you lose the password, it is almost impossible to recover the original link. The strong security guaranteed by encryption can be a blessing or a curse if you are not careful!
• Currently, the only way to recover a lost password is by trying all possible options (very slowly) by brute force. An example application to brute force Link Lock URLs in the browser can be found here: https://jstrieb.github.io/link-lock/bruteforce.
• A parallelized, cross-platform, CPU-based brute forcer can be found here: https://github.com/jstrieb/bruteforce-link-lock
• If you receive a Link Lock URL that you do not trust, decrypt it using this interface that does not automatically redirect: https://jstrieb.github.io/link-lock/decrypt.

Evading Censorship

Link Lock can be used to evade censorship. If you are concerned that sending links with the jstrieb.github.io domain name will put you at risk, just replace the domain with another. For example, share

https://wikipedia.org/#eyJ2IjoiMC4wLjEiLCJlIjoiYUgrNDhISkpBWWhkeFFMc0l0VlIzeFlma21mYlZCOFJ5Zz09In0=

instead of

https://jstrieb.github.io/link-lock/#eyJ2IjoiMC4wLjEiLCJlIjoiYUgrNDhISkpBWWhkeFFMc0l0VlIzeFlma21mYlZCOFJ5Zz09In0=

Any domain can be used in place of wikipedia.org. That way, a malicious third-party who clicks the altered link will be taken to a valid page, which helps alleviate suspicion. When sharing the password to unlock the link, explain how to switch out the domain name with either jstrieb.github.io/link-lock, or with the path to a local clone of Link Lock. Using a local copy is particularly recommended for evading censorship, since no request to my domain is ever made.

Alternatively paste the altered link directly into the decrypt page. This page does not check the domain name of the pasted link, only the "fragment" (the part after the #). So, for example, the Wikipedia link above can be pasted directly in there and decrypted without changing the domain.

Using a local copy of URL Pages is also recommended. Entire web pages can be shared safely and secretly this way.

Project Status

This project is actively maintained. If there are no recent commits, it means that everything has been running smoothly! Even if the link storage protocol is updated, Link Lock is designed to be 100% backwards-compatible, so your locked links will never break.

Even if something were to happen to me, and I could not continue to work on the project, Link Lock will continue to work as long as my GitHub account is open and the jstrieb.github.io domain is online.

Other Versions & Related Projects

• French translation: cachetonsite.di20.net
• German translation: ebildungslabor.github.io/link-lock
• Polish translation: yoursenseicreeper.github.io/link-lock

Acknowledgments

Thank you to those who offered feedback on this program before its release. Thanks also to the Hacker News second-chance pool.

Thanks to @IAmMandatory for discovering a reflected XSS vulnerability resulting from allowing non-hypertext protocols in the URL. The vulnerability has since been fixed.

Thank you to Guillaume (@gverdun) for translating Link Lock into French, and hosting a translated version. Likewise, thanks to Nele Hirsch (@eBildungslabor) for translating and hosting a German version, and to Piotr Wereszczyński (@YourSenseiCreeper) for translating and hosting a Polish version.

Support the Project

There are a few things you can do to support the project:

• Star the repository and follow me on GitHub
• Share and upvote on sites like Twitter, Reddit, and Hacker News
• Report any bugs, glitches, or errors that you find
• Translate into other languages

These things motivate me to to keep sharing what I build, and they provide validation that my work is appreciated! They also help me improve the project. Thanks in advance!

If you are insistent on spending money to show your support, I encourage you to instead make a generous donation to one of the following organizations. By advocating for Internet freedoms, organizations like these help me to feel comfortable releasing work publicly on the Web.

• Electronic Frontier Foundation
• Signal Foundation
• Mozilla
• The Internet Archive

link-lock's Issues

Suggestions: use window.atob instead of b64.js

Cool concept!

One idea, if you hadn't already considered, is to use the built-in atob function instead of loading a custom base-64 library.

How to change the password?

Can we change the password?

Embedding decryption in a data: scheme

Hi! I found your project really interesting. I read the discussions about it in Hacker News and one comment got me thinking about another potential feature: embed the decryption code in a data:// url, instead of relaying on gh-pages (or other mirrors).

I'm guessing that the URL may end up being too long, so another solution would be to use a CDN: the data:// url simply contains an html with the cdn import, and the package would decrypt the rest of the URL. It would still have a single point of failure (CDN may fail) but I think it's a bit more versatile than the gh-pages approach.

Is this possible? Is there something I've missed? I don't know the limitations of the data: scheme, nor those of the CDN approach.

TypeError: Cannot read property 'importKey' of undefined

When I try to self-host the site I get this error when filling out the form and pressing the encrypt button on the main index.html page:

api.js:45 Uncaught (in promise) TypeError: Cannot read property 'importKey' of undefined
    at Object.deriveKey (api.js:45)
    at Object.encrypt (api.js:74)
    at generateFragment (create.js:70)
    at async onEncrypt (create.js:138)

Any idea what's going on?

Lock Icon | Flat Finance Iconset | GraphicLoads

https://icon-library.com/icon/lock-icon-10.html

Can you not show the letters when entering the password?

Hey there!

I am really enjoying this project, it's exactly what i was looking for. My only problem with it is that when i enter the password for the locked link then all the letters are visible. i am encrypting the links so that only certain persons and i can use them but when the password is clearly visible for everybody nearby whilst i am entering it it's kinda defying its purpose for me. is there an option to not show the letters you are entering when asked for the password? or can you implement it?

thanks a lot for this tool

Cielain

Link Lock - Password-protect links

https://jstrieb.github.io/link-lock/#eyJ2IjoiMC4wLjEiLCJlIjoidmVQeW8xSmd4V1dWRUg2bmNVb25qaGpTY2J0Zm9PU3JzYXl0bFdPekVJb09nNjFEZXhSVVVkWXJkbWJ0UHpQNDlneW5pSys1K3o5UEJGWGVzSElnRlFkTXRGbk4iLCJpIjoiY0hUZE02T2lhZ0orL0N2NCJ9

Is there protection against brute force attacks?

For example, a potential attacker could potentially keep on guessing a password many times via brute-force until the link unlocks.

Polish translation

Hi,

I've translated Link Lock into Polish.
https://yoursenseicreeper.github.io/link-lock
I found this way to implement Github corner link - https://github.com/tholman/github-corners

Very interesting project.
Cheers

is there a bookmarklet?

Please con you open this link

GitHub - jstrieb/urlpages: Create and view web pages stored entirely in the URL
is.gd/rAv4pa

Translation

Hi! It would be very interesting if the project had a translation for other languages OR that it was possible to "edit" the texts (password box and error screen) during the creation of the link.

Thanks for this great project.

Newbie Question

Hi
Is it possible to hide the text at the top of the Password request that says: "jstrieb.github.io says"?
Cheers
Hywel

question abt password

is there a way to make it so the password changes each time a password is inputed

git.io

GitHub operates a URL shortener at https://git.io that only works on github.com and github.io pages, making its use a bit limited. However, this is a good use case for it. It maybe useful to add a note about this to the README.

question

hi there , i love the resource ,

lets say i want to prevent users from downloading a specific file , but the way its downloaded is not by browser
is there a way to generate a token of somesort ?