3 |
4 |
5 |
6 | 
7 |
8 |
9 |
12 |
13 | 
15 |
16 |
17 |
18 |
84 |
86 |
87 |
88 |
90 |
91 |
93 |
--------------------------------------------------------------------------------
/dynamo.go:
--------------------------------------------------------------------------------
1 | package sharedpw
2 |
3 | import (
4 | "encoding/base64"
5 | "encoding/json"
6 | "errors"
7 | "fmt"
8 | "github.com/aws/aws-sdk-go/aws"
9 | "github.com/aws/aws-sdk-go/aws/session"
10 | "github.com/aws/aws-sdk-go/service/dynamodb"
11 | "github.com/aws/aws-sdk-go/service/dynamodb/dynamodbattribute"
12 | "log"
13 | "net"
14 | "os"
15 | "regexp"
16 | "time"
17 | )
18 |
19 | // Secret is the structure saved to dynamo.
20 | // Secret.Secret is the index, generated by GetRandomId
21 | // Expire is a unixtime value, for the Dynamo TTL
22 | type Secret struct {
23 | Secret string `json:"secret"`
24 | Expire int64 `json:"expire"` // calculated by server, dynamo db removal timestamp in unixtime
25 | Hours int `json:"hours"` // sent by client, should be < 72
26 | Message string `json:"message"`
27 | Ip string `json:"ip"`
28 | HasPass bool `json:"has_pass"`
29 | Hint string `json:"hint"`
30 | Err error `json:"error"`
31 | Tag string `json:"tag"`
32 | Iv string `json:"iv"`
33 | PwTag string `json:"pw_tag"`
34 | PwIv string `json:"pw_iv"`
35 | }
36 |
37 | // NewSecret initializes a Secret -- not sure this is useful outside of tests.
38 | func NewSecret() *Secret {
39 | s := &Secret{
40 | Expire: time.Now().UTC().Add(time.Hour * 72).Unix(), // default 3 days lifetime
41 | }
42 | id, err := GetRandomId()
43 | if err != nil {
44 | s.Err = err
45 | return s
46 | }
47 | s.Secret = id
48 | return s
49 | }
50 |
51 | // NewId sets a new random ID for the secret
52 | func (s *Secret) NewId() (err error) {
53 | s.Secret, err = GetRandomId()
54 | return err
55 | }
56 |
57 | // SetTimeout sets the expiration timestamp in dynamo based on the hours requested.
58 | func (s *Secret) SetTimeout() (err error) {
59 | if s.Hours < 1 || s.Hours > 72 {
60 | return errors.New(`invalid expiration`)
61 | }
62 | s.Expire = time.Now().UTC().Add(time.Hour * time.Duration(s.Hours)).Unix()
63 | return
64 | }
65 |
66 | // ToJson returns a JSON string
67 | func (s *Secret) ToJson() (string, error) {
68 | j, err := json.MarshalIndent(s, "", " ")
69 | if err != nil {
70 | return "", err
71 | }
72 | return string(j), nil
73 | }
74 |
75 | // Save persistes a secret into the database
76 | func (s *Secret) Save(b64EncSecret string) error {
77 | if s.Expire == 0 {
78 | s.Expire = time.Now().UTC().Add(time.Hour * 24).Unix()
79 | }
80 | s.Message = b64EncSecret
81 |
82 | table, db, err := newClient()
83 | if err != nil {
84 | return err
85 | }
86 | j, err := dynamodbattribute.MarshalMap(s)
87 | if err != nil {
88 | return err
89 | }
90 | input := &dynamodb.PutItemInput{
91 | Item: j,
92 | TableName: aws.String(table),
93 | }
94 | i, err := db.PutItem(input)
95 | fmt.Printf("%#v\n", i)
96 | if err != nil {
97 | log.Printf("| ERROR dynamo.go Save: %v", err)
98 | }
99 | fmt.Printf("%#v\n", s)
100 | return err
101 | }
102 |
103 | // Revealed holds the response from a secret lookup
104 | type Revealed struct {
105 | Secret string
106 | Exists bool
107 | HasPass bool
108 | Hint string
109 | Tag string
110 | Iv string
111 | PwTag string
112 | PwIv string
113 | }
114 |
115 | // Reveal returns a base64 encoded string of the secret stored in the db, and immediately deletes it.
116 | func Reveal(id string, ip net.IP, reveal bool) (revealed Revealed, err error) {
117 | dbIndex := `secret`
118 | notHex, _ := regexp.MatchString(`\W|[g-zA-Z]`, id)
119 | if len(id) != 16 || notHex {
120 | return revealed, errors.New("bad id")
121 | }
122 | table, db, err := newClient()
123 |
124 | // first get the secret:
125 | var queryInput = &dynamodb.QueryInput{
126 | TableName: aws.String(table),
127 | KeyConditions: map[string]*dynamodb.Condition{
128 | dbIndex: {
129 | ComparisonOperator: aws.String("EQ"),
130 | AttributeValueList: []*dynamodb.AttributeValue{
131 | {
132 | S: aws.String(id),
133 | },
134 | },
135 | },
136 | },
137 | }
138 | result, err := db.Query(queryInput)
139 | if err != nil {
140 | return revealed, err
141 | }
142 | r := make([]interface{}, 0)
143 | err = dynamodbattribute.UnmarshalListOfMaps(result.Items, &r)
144 | if err != nil {
145 | return revealed, err
146 | }
147 | if len(r) < 1 {
148 | return revealed, errors.New("no items found")
149 | }
150 | // marshall and unmarshal so we can get the right struct type,
151 | j, err := json.Marshal(r[0])
152 | if err != nil {
153 | return revealed, err
154 | }
155 | s := &Secret{}
156 | err = json.Unmarshal(j, s)
157 |
158 | // check the IP
159 | if len(s.Ip) > 0 && s.Ip != ip.String() {
160 | fmt.Printf("IP Mismatch, wanted %s got %s\n", s.Ip, ip.String())
161 | return revealed, errors.New("not found")
162 | }
163 |
164 | // are we actually getting the secret, or just checking it exists?
165 | if !reveal {
166 | if s.Secret == id {
167 | revealed.Exists = true
168 | return revealed, nil
169 | }
170 | return revealed, nil
171 | }
172 |
173 | secret, err := base64.StdEncoding.DecodeString(string(s.Message))
174 | if err != nil {
175 | return revealed, errors.New(fmt.Sprintf("could not decode secret %v", err))
176 | }
177 | if err != nil || len(secret) == 0 {
178 | return revealed, errors.New(fmt.Sprintf("could not decode secret, got %d chars and error: %v", len(secret), err))
179 | }
180 |
181 | // the secret looks okay, but make sure we can delete it before returning ...
182 | delInput := &dynamodb.DeleteItemInput{
183 | Key: map[string]*dynamodb.AttributeValue{
184 | dbIndex: {
185 | S: aws.String(id),
186 | },
187 | },
188 | TableName: aws.String(table),
189 | }
190 | _, err = db.DeleteItem(delInput)
191 | if err != nil {
192 | log.Printf("| ERROR db.go DbRemove: %v", err)
193 | return revealed, err
194 | }
195 |
196 | revealed.Secret = s.Message
197 | revealed.Exists = true
198 | revealed.Hint = s.Hint
199 | revealed.HasPass = s.HasPass
200 | revealed.Tag = s.Tag
201 | revealed.Iv = s.Iv
202 | revealed.PwTag = s.PwTag
203 | revealed.PwIv = s.PwIv
204 | return revealed, nil
205 | }
206 |
207 | // newClient returns a table name and dynamodb interface, references the
208 | // environ vars: TABLE and REGION, or uses sane defaults. Defaults to
209 | // "sharedpw" and "us-east-1" respectively.
210 | func newClient() (table string, db *dynamodb.DynamoDB, err error) {
211 | return func() string {
212 | if t, ok := os.LookupEnv("APPLICATION"); ok {
213 | return t
214 | }
215 | return "sharedpw"
216 | }(),
217 | func() *dynamodb.DynamoDB {
218 | region, ok := os.LookupEnv("REGION")
219 | if !ok {
220 | region = "us-east-1"
221 | }
222 | sess, err := session.NewSession(&aws.Config{
223 | Region: aws.String(region)},
224 | )
225 | if err != nil {
226 | log.Println("| ERROR dynamo.go newClient: did not create session")
227 | }
228 | return dynamodb.New(sess)
229 | }(), err
230 | }
231 |
--------------------------------------------------------------------------------
/terraform/api_gateway.tf:
--------------------------------------------------------------------------------
1 | # API Gateway object
2 | resource "aws_api_gateway_rest_api" "apigw" {
3 | name = "api_gw_${var.app_name}"
4 | description = "${var.app_name} API Gateway"
5 | }
6 |
7 | # POST method for /save endpoint
8 | resource "aws_api_gateway_resource" "save" {
9 | rest_api_id = aws_api_gateway_rest_api.apigw.id
10 | parent_id = aws_api_gateway_rest_api.apigw.root_resource_id
11 | path_part = "save"
12 | }
13 |
14 | resource "aws_api_gateway_method" "save" {
15 | rest_api_id = aws_api_gateway_rest_api.apigw.id
16 | resource_id = aws_api_gateway_resource.save.id
17 | http_method = "POST"
18 | authorization = "NONE"
19 | }
20 |
21 | resource "aws_api_gateway_integration" "lambda_save" {
22 | rest_api_id = aws_api_gateway_rest_api.apigw.id
23 | resource_id = aws_api_gateway_method.save.resource_id
24 | http_method = aws_api_gateway_method.save.http_method
25 |
26 | integration_http_method = "POST"
27 | type = "AWS_PROXY"
28 | uri = aws_lambda_function.lambda_save.invoke_arn
29 | }
30 |
31 | # POST method for /view endpoint
32 | resource "aws_api_gateway_resource" "view" {
33 | rest_api_id = aws_api_gateway_rest_api.apigw.id
34 | parent_id = aws_api_gateway_rest_api.apigw.root_resource_id
35 | path_part = "view"
36 | }
37 |
38 | resource "aws_api_gateway_method" "view" {
39 | rest_api_id = aws_api_gateway_rest_api.apigw.id
40 | resource_id = aws_api_gateway_resource.view.id
41 | http_method = "POST"
42 | authorization = "NONE"
43 | }
44 |
45 | resource "aws_api_gateway_integration" "lambda_view" {
46 | rest_api_id = aws_api_gateway_rest_api.apigw.id
47 | resource_id = aws_api_gateway_method.view.resource_id
48 | http_method = aws_api_gateway_method.view.http_method
49 |
50 | integration_http_method = "POST"
51 | type = "AWS_PROXY"
52 | uri = aws_lambda_function.lambda_view.invoke_arn
53 | }
54 |
55 | # Deployment. Add this later https://medium.com/coryodaniel/til-forcing-terraform-to-deploy-a-aws-api-gateway-deployment-ed36a9f60c1a
56 | resource "aws_api_gateway_deployment" "deployment" {
57 | depends_on = [
58 | aws_api_gateway_integration.lambda_save,
59 | aws_api_gateway_integration.lambda_view,
60 | ]
61 |
62 | rest_api_id = aws_api_gateway_rest_api.apigw.id
63 | stage_name = "v1"
64 | }
65 |
66 | resource "aws_lambda_permission" "apigw_save" {
67 | statement_id = "AllowAPIGatewayInvoke"
68 | action = "lambda:InvokeFunction"
69 | function_name = aws_lambda_function.lambda_save.function_name
70 | principal = "apigateway.amazonaws.com"
71 |
72 | # The "/*/*" portion grants access from any method on any resource
73 | # within the API Gateway REST API.
74 | # source_arn = "${aws_api_gateway_rest_api.apigw.execution_arn}/*/*"
75 | source_arn = "${aws_api_gateway_rest_api.apigw.execution_arn}/*/${aws_api_gateway_method.save.http_method}${aws_api_gateway_resource.save.path}"
76 | }
77 |
78 | resource "aws_lambda_permission" "apigw_view" {
79 | statement_id = "AllowAPIGatewayInvoke"
80 | action = "lambda:InvokeFunction"
81 | function_name = aws_lambda_function.lambda_view.function_name
82 | principal = "apigateway.amazonaws.com"
83 |
84 | # The "/*/*" portion grants access from any method on any resource
85 | # within the API Gateway REST API.
86 | # source_arn = "${aws_api_gateway_rest_api.apigw.execution_arn}/*/*"
87 | source_arn = "${aws_api_gateway_rest_api.apigw.execution_arn}/*/${aws_api_gateway_method.view.http_method}${aws_api_gateway_resource.view.path}"
88 | }
89 |
90 | # OPTIONS method for /save endpoint
91 | resource "aws_api_gateway_method" "save_options_method" {
92 | rest_api_id = aws_api_gateway_rest_api.apigw.id
93 | resource_id = aws_api_gateway_resource.save.id
94 | http_method = "OPTIONS"
95 | authorization = "NONE"
96 | }
97 | resource "aws_api_gateway_method_response" "save_options" {
98 | rest_api_id = aws_api_gateway_rest_api.apigw.id
99 | resource_id = aws_api_gateway_resource.save.id
100 | http_method = aws_api_gateway_method.save_options_method.http_method
101 | status_code = "200"
102 | response_models = {
103 | "application/json" = "Empty"
104 | }
105 | response_parameters = {
106 | "method.response.header.Access-Control-Allow-Headers" = true,
107 | "method.response.header.Access-Control-Allow-Methods" = true,
108 | "method.response.header.Access-Control-Allow-Origin" = true
109 | }
110 | depends_on = [aws_api_gateway_method.save_options_method]
111 | }
112 | resource "aws_api_gateway_integration" "save_options_integration" {
113 | rest_api_id = aws_api_gateway_rest_api.apigw.id
114 | resource_id = aws_api_gateway_resource.save.id
115 | http_method = aws_api_gateway_method.save_options_method.http_method
116 | type = "MOCK"
117 | request_templates = {
118 | "application/json": "{\"statusCode\": 200}"
119 | }
120 | depends_on = [aws_api_gateway_method.save_options_method]
121 | }
122 | resource "aws_api_gateway_integration_response" "save_options_integration_response" {
123 | rest_api_id = aws_api_gateway_rest_api.apigw.id
124 | resource_id = aws_api_gateway_resource.save.id
125 | http_method = aws_api_gateway_method.save_options_method.http_method
126 | status_code = aws_api_gateway_method_response.save_options.status_code
127 | response_parameters = {
128 | "method.response.header.Access-Control-Allow-Headers" = "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'",
129 | "method.response.header.Access-Control-Allow-Methods" = "'GET,OPTIONS,POST,PUT'",
130 | "method.response.header.Access-Control-Allow-Origin" = "'${var.scheme}://${var.bucket_name}'"
131 | }
132 | depends_on = [aws_api_gateway_method_response.save_options]
133 | }
134 |
135 | # OPTIONS method for /view endpoint
136 | resource "aws_api_gateway_method" "view_options_method" {
137 | rest_api_id = aws_api_gateway_rest_api.apigw.id
138 | resource_id = aws_api_gateway_resource.view.id
139 | http_method = "OPTIONS"
140 | authorization = "NONE"
141 | }
142 | resource "aws_api_gateway_method_response" "view_options" {
143 | rest_api_id = aws_api_gateway_rest_api.apigw.id
144 | resource_id = aws_api_gateway_resource.view.id
145 | http_method = aws_api_gateway_method.view_options_method.http_method
146 | status_code = "200"
147 | response_models = {
148 | "application/json" = "Empty"
149 | }
150 | response_parameters = {
151 | "method.response.header.Access-Control-Allow-Headers" = true,
152 | "method.response.header.Access-Control-Allow-Methods" = true,
153 | "method.response.header.Access-Control-Allow-Origin" = true
154 | }
155 | depends_on = [aws_api_gateway_method.view_options_method]
156 | }
157 | resource "aws_api_gateway_integration" "view_options_integration" {
158 | rest_api_id = aws_api_gateway_rest_api.apigw.id
159 | resource_id = aws_api_gateway_resource.view.id
160 | http_method = aws_api_gateway_method.view_options_method.http_method
161 | type = "MOCK"
162 | request_templates = {
163 | "application/json": "{\"statusCode\": 200}"
164 | }
165 | depends_on = [aws_api_gateway_method.view_options_method]
166 | }
167 | resource "aws_api_gateway_integration_response" "view_options_integration_response" {
168 | rest_api_id = aws_api_gateway_rest_api.apigw.id
169 | resource_id = aws_api_gateway_resource.view.id
170 | http_method = aws_api_gateway_method.view_options_method.http_method
171 | status_code = aws_api_gateway_method_response.view_options.status_code
172 | response_parameters = {
173 | "method.response.header.Access-Control-Allow-Headers" = "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'",
174 | "method.response.header.Access-Control-Allow-Methods" = "'GET,OPTIONS,POST,PUT'",
175 | "method.response.header.Access-Control-Allow-Origin" = "'${var.scheme}://${var.bucket_name}'"
176 | }
177 | depends_on = [aws_api_gateway_method_response.view_options]
178 | }
--------------------------------------------------------------------------------
/client/src/components/view.vue:
--------------------------------------------------------------------------------
1 |
2 |
7 | ephemera
10 |one-time secret sharing
11 |
19 | This is an application for sharing a secret, the secret can only be accessed once, and then it is gone
20 | forever.
21 |
Basic Usage:
23 |
24 | Type in the secret you want to share, and click "Get Link", provide this to the recipient and they can
25 | retrieve it.
26 |
28 | In the advanced settings you can control more of the behavior:
29 |
-
31 |
How long the secret is valid, the default is 24 hours.Restrict access to the secret for a specific internet address.Add an additional layer of password protection that is neither stored in the database or as part of the link.Is this safe?
36 |37 | This application was designed to offer a moderate level of security, slightly better than pasting a password 38 | in a chat window. But, 39 | there is no provable way to know what is being done behind the scenes, and the only way to be entirely sure 40 | is to get the source from 41 | Github, audit the code, and deploy it under your own 42 | control. 43 |
44 |45 | This application is designed to run as a serverless app in the AWS cloud, with the goal to be almost cost, 46 | and maintenance free. 47 | It uses KMS to encrypt the secrets in the database, which costs ~$1/month, specifically so that it could be 48 | easily deployed within 49 | an organization for exclusive use with little effort. 50 |
51 |How does it work?
52 |-
53 |
When clicking on "Get Link", the browser uses javascript to create an encryption key,
54 | and encrypts the secret using AES-128 GCM with this key. Short secrets have additional plaintext added to further obfuscate the length of the message.The key is included as part of the URL that is displayed in the browser, but is *not* sent to the servers, a
56 | random IV, and the authentication tag are stored in the database.The storage is handled by an AWS Lambda function that: Uses KMS to encrypt the secret with AES-256 a second time,
58 | sets a timeout value for the secret to be deleted, and stores it in DynamoDB. This means by default
59 | the secret is encrypted twice, only Amazon has one key, and whoever has the link gets the second.
60 | When the recipient visits the site to retrieve the secret, the browser extracts the random ID for
62 | the stored secret and sends that to the Lambda function, which performs the first layer of decryption--immediately deleting the database record,
63 | and sends the result to the browser.The recipient's browser then decrypts the ciphertext sent back from the lambda function.
65 | If an optional passphrase was used, another key is created using a pbkdf2 algorithm,
67 | and will require the recipient to supply it for a third round of AES-128 GCM decryption. This could be something simple that is
68 | conveyed out of band to add a small additional layer of protection.Why Bother?
71 |I appreciate that there are other similar services, such as viacry.pt and have used them, but ...
72 | if you want to ensure exclusive access for your organization for example, these rely on running a server full-time for the storage and back-end service.
73 | By using server-less technology in the cloud, anyone can deploy ephemera without committing to the cost of running, and maintaining a VPS.Most of the existing solutions immediately display the link when visited, this creates problems with tools
75 | that prefetch an image of a website (like a chat program.)Being able to limit by IP is crucial when users are on a known network.I wanted to be sure the tool I was using used a stronger cipher, with random IV, and message authentication.The ability to have an additional layer of encryption is nice.
79 | Not shared via a link, and unknown to the backend ... adds a distinct and important layer of security
3 |
4 |
60 |
61 |
62 |
186 |
187 |
189 |
--------------------------------------------------------------------------------
/client/src/components/save.vue:
--------------------------------------------------------------------------------
1 |
2 | 4 |
5 |
6 |
53 |
54 |
55 |
56 |
57 |
58 |
59 |
7 |
8 | Once the secret has been viewed, it will be irretrievable. The link is not valid, the secret has already been viewed, or it has been
48 | restricted to a different IP address.
10 |
11 |
12 | Reveal Secret?
Someone has shared a secret with you!
14 | 
17 | Reveal
18 | Decrypted Secret
{{ passParams.passHint }}
33 |
34 |
36 |
40 | {{ Decipher }}
37 |
38 |
39 |
41 |
46 | 
That secret doesn't exist!
3 |
4 |
108 |
109 |
110 |
220 |
221 |
223 |
--------------------------------------------------------------------------------
4 |
5 |
6 |
22 |
37 |
38 |
39 | 
Get Link
40 |
41 |
42 | Show Advanced Options
43 |
44 |
45 |
46 |
47 |
48 |
49 | 
51 |
52 | {{ expires }} hours
53 |
54 |
56 |
57 |
58 |
59 |
61 |
62 |
63 |
65 |
66 |
69 |
70 |
71 |
72 |
75 |
77 |
78 |
79 |
81 |
82 |
84 |
85 |
86 |
87 |
90 |
92 |
93 |
94 |
95 |
96 |
98 |
99 |
100 |
101 |
102 |
103 |
104 |
107 |
7 | {{ secretLen }} of {{ maxLen }} characters allowed.
14 |
16 |
>
Loading
{{ response }}
24 |
25 |
36 | Get Link
40 | 44 |
51 |
61 |
77 |
92 |