PortableSecret - Carry and Share Your Most Critical Secrets Without Special Software

The talk starts with a gap: people who are not comfortable with GPG or private keys still need to exchange sensitive items such as a door code or a scanned passport. Common messengers and email expose that content to platform operators, and anyone with brief access to a phone can read it. The proposed fix is PortableSecret, a single HTML file holding an encrypted payload and a small amount of script. The recipient opens it in any modern browser, online or offline, and enters a password to view the content.

The cryptography relies on standard primitives exposed through the browser's Web Crypto interface: AES in GCM mode for confidentiality and integrity, and a password-based key derivation function run for many iterations to slow guessing attacks. The talk walks through the file layout, a live decryption, and a creator tool. It also covers the design's assumptions and weak points, including poor passwords, guessable password hints, and tampered copies, and notes that keyloggers and compromised systems are outside what any file can protect against.

Practical use cases include keeping a backup decryption key on several USB drives, publishing an encrypted passport copy as a retrievable page, and leaving family instructions for worst-case scenarios. Other examples include sharing temporary SSH keys and sending messages from a borrowed phone. The Q&A covered iOS handling, file size limits caused by URL encoding, and USB drive longevity. The takeaway is that a simple, open design can give non-technical people a practical privacy layer.