Crypo Encrypts Text On The Go

@vrillusions: You can use any number of bits for most encryption schemes. The 128, 256, 1024, etc. values are arbitrary but chosen because they are multiples of 32.

czarandy

@jetRink: Look up "cryptographic hash". There are various ways to generate long strings from shorter ones.

Well, I have to at least say that the advertised website does---AT PRESENT---work in offline mode, meaning the encryption is actually taking place on your local system, as opposed to sending your plain text over the Internet and encrypting it remotely. That said, who knows if that could change at any moment. And it still says nothing about the quality of encryption.

One of the similar sites given at MakueUseOf is http://encodor.com. If you take a peek at this site, and view the source, you'll notice that your text and password are sent in plain text over the Internet to the website. The encryption is not done on the client side, and it's not even sent securely just to the site. So even if you did trust that encodor.com was not snooping your private data, your data is effectively visible to anyone on the Internet. So always be wary of web based encryption tools

@balls187: what did I say wrong?
Wasn't my statement enough... "As Jason mentionned, the implementation of the encryption scheme is the important information to consider." enough?

You want to bore vrillusion to death?

The only thing I would change to my comment is not "that you would die of old age" before brute forcing a goo 128 bit key. Rather, the Sun would run out of fuel...

lifeh4xor

This has all the warning signs of people who don't know what they are talking about (for all the reasons other commenters have already mentioned so I won't repeat).

Really laughable stuff actually.

Michael Tiller

@balls187: No, its trust in the combination of a third party and a secure algorithm. For PKI (as you referred to certificate authorities), the third part never has access to your plain text.

@vrillusions: Unless it's over a secure connection or on your local machine, using a self-authored PHP form will just send your private message out over the Internet in plain text before encrypting it. Plus, unless you're actually an expert in cryptography, writing your own encryption algorithm would be a big mistake. Until you've studied the problem in depth, you can't imagine how easy it is (relatively speaking) to break a lot of schemes that seem utterly impossible.

Case in point, the Vigenère cipher uses a secret pass phrase, and just adds each letter of the passphrase to corresponding letter of the plain text. To an amateur that seems pretty freaking solid: without the password, how could you possible decrypt it. But it turns out its insanely easy is almost all cases. So I would highly recommend against writing your own encryption unless you can compete intellectually and academically with the best minds in the business.

@lifeh4xor: No, you'll die of old age before you can enumerate all 2^128 possible key values, but that's not the only way to attack a crypto scheme. Even if you don't know what algorithm is being used, there are plenty of ways to figure it out.

Using an unspecified crypto algorithm is an awful Idea. Unless they're using a well tested public algorithm, there's a very good chance that the encryption is trivial enough that a 12 year old script kiddie could crack it in a few minutes.

And this web interface is another horrible idea. You're not comfortable sending text messages, but you're fine typing the same information into someone else website? Unless you put your browser is offline mode first, or know enough about Javascript to verify the script is client side only, then you might as well just skywrite the message.

Just get GnuPG or one of the dozen other PGP implementations.

@balls187: For most business communications, third-party trust is fine. For personal use, I'd have to build up a web of trust with PGP or GPG. It's just not possible to trust anything less than that.

@lifeh4xor: Again, thats not true at all.

If you generate an AES key in an insecure manner (for instance using GUID generation, or taking the hash of a string), it is possible to break AES by key guessing.

Adobe used an MD5 of user passwords for a version Acrobat, and it blew up in their face.

@vrillusions: No, thats not the proper way to create and AES key.

The proper way is to use a PKCS5 (RFC2898 for instance) to transform the password over several iterations.

A straight hash of the password is insecure, and is susceptible to rainbow table attacks.

Using RFC2898 with an iteration count of over 1000, it's possible to use a customer supplied 8-12 character password to generate a sufficiently strong AES key.

@mahumphrey: Actually thirdparty trust is the basis for most secure internet communication.

See CA Trusts for more information.

@Vasto:

I would like to know this myself

Digital_Pirate

Shouldn't the destination for this link be http://www.crypo.com/
as opposed to http://crypo.biz/

psiokinetic

The use of the term "military-grade" is highly suggestive that this is cryptographic snake oil. If they wanted to show that their product is secure, they're better off revealing what kind of encryption standard they use. Only people who don't know anything about cryptography (and are most vulnerable to being ripped off) are likely to be satisfied by claims of having a "military-grade" system.

http://www.interhack.net/people/cmcurtin/snake-oil-faq.html#SECTION000511000000000000000

OdeliaSarpedon

@vrillusions:
The only importance of key lenght is resistance to brute force attacks. That being said, you will die of old age before you can brute-force a 128-bit key. As Jason mentionned, the implementation of the encryption scheme is the important information to consider. And since in this case it's not specified... fogetaboutthis.

lifeh4xor

@Shai: I'm being watched right now

But how to I tell the other person what the password is?

@vrillusions:
Stupid question, but how can I find out how to make my own?

@TheLostVikings R.O.A.C.H.: especially one which runs google analytics which is known for its bulletproof privacy rules. but whoever sends a message via sms which is that important that it better would be encrypted should reconsider his messaging habbits anyway.

1280? that seems like a typo. There's 128-bit AES which is "military grade" although military probably uses 256-bit which is the max for AES (and insanely secure).

There's public key authentication (think PGP) that has key lengths of 1024, 2048, and 4096. No 1280. But this wouldn't be public key encryption anyway. So I'm guessing they meant 128.

And yeah, you have the obvious shortcommings of being some website that no one has heard of till now.

If you really want to communicate with someone else over txt messages and want to encrypt it, I'd spend 5 minutes creating my own form in php that I know what it's doing.

Also the screenshot says it has to be 4-12 characters. I have doubts on their implementation. The "proper" way would be to let them enter anything they want, then create a sha128 hash of it and use that for the key.

Are there any crypto apps that work on non smart phones?

Vasto

12 symbols * (8 to 21) bits per character is 96 to 252 bits. How do they make up the rest of the 1280?

jetRink

It's not working.

Skid-Vicious

@TheLostVikings R.O.A.C.H.: No kidding. In what strange universe does this pass as secure.
Not only that, but when I go to the link I get a new page template instead of the promised site.

eien

Because when you really want your data to be secure you enter them into a web app run by some random 3rd party that you know nothing about...

TheLostVikings R.O.A.C.H.