├── .gitignore
├── README.md
├── app.yaml
├── appengine_config.py
├── cron.yaml
├── main.py
├── requirements.txt
├── static
    ├── clippy.svg
    ├── random-password.js
    └── robots.txt
├── template
    ├── about.tpl
    ├── index.tpl
    └── p.tpl
└── vendor.py


/.gitignore:
--------------------------------------------------------------------------------
1 | lib/
2 | TODO.txt
3 | *.pyc
4 | *.bak.20*
5 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # [Temporal.PW]
 2 | 
 3 | [Temporal.PW] provides temporary secure storage for passwords so you can safely transmit them over insecure channels like E-Mail, Instant Messaging, SMS, etc.
 4 |   - All encryption / decryption is done in the client browser, the AES key is never sent to the server.
 5 |   - Passwords are only ever viewable a single time, so you can be certain that only one recipient viewed it.
 6 |   - You can choose to restrict unique temporary password URLs so that they're only accessible from your same IP address (useful for sending passwords securely to someone in the same network).
 7 | 
 8 | 
 9 | [Temporal.PW]: <https://Temporal.PW/>
10 | [PyCrypto]: https://www.dlitz.net/software/pycrypto/
11 | 


--------------------------------------------------------------------------------
/app.yaml:
--------------------------------------------------------------------------------
 1 | ## https://developers.google.com/appengine/docs/python/config/appconfig
 2 | 
 3 | # gcloud app logs read --project temporalpw-1 --logs=stderr,stdout,crash.log,request_log
 4 | 
 5 | ## 2016-11-17 : tkooda : removed per move from `appcfg.py -A temporalpw-1 --oauth2 update .` to `gcloud app deploy --project temporalpw-1 *.yaml`
 6 | #application: temporalpw-1
 7 | #version: 1
 8 | runtime: python27
 9 | api_version: 1
10 | threadsafe: yes
11 | 
12 | handlers:
13 | - url: /cleanup
14 |   script: main.bottle
15 |   login: admin
16 | 
17 | - url: /static
18 |   static_dir: static
19 |   secure: always
20 | 
21 | - url: /robots\.txt
22 |   static_files: static/robots.txt
23 |   upload: static/robots.txt
24 |   secure: always
25 | 
26 | # for letsencrypt.org SSL cert:
27 | - url: /.well-known/acme-challenge/*
28 |   script: main.bottle
29 |   secure: never
30 | 
31 | - url: .*
32 |   script: main.bottle
33 |   secure: always
34 | 
35 | 


--------------------------------------------------------------------------------
/appengine_config.py:
--------------------------------------------------------------------------------
1 | """`appengine_config` gets loaded when starting a new application instance."""
2 | import vendor
3 | # insert `lib` as a site directory so our `main` module can load
4 | # third-party libraries, and override built-ins with newer
5 | # versions.
6 | vendor.add('lib')
7 | 


--------------------------------------------------------------------------------
/cron.yaml:
--------------------------------------------------------------------------------
1 | cron:
2 | - description: hourly purge of any expired password entries
3 |   url: /cleanup
4 |   schedule: every 1 hours
5 | 


--------------------------------------------------------------------------------
/main.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 | 
  3 | ## temporal.pw  -  2016-02-14  -  Thor J. Kooda
  4 | 
  5 | ## 2016-03-26 : rewrote. move password encryption to client side, server is never sent any part of the key (browser does all encryption/decryption)
  6 | 
  7 | """Provide temporary storage for encrypted passwords so they can be sent via E-Mail."""
  8 | 
  9 | from bottle import Bottle, request, template, abort, response, redirect
 10 | from google.appengine.ext import ndb, webapp
 11 | import datetime
 12 | import string
 13 | import random
 14 | import hashlib
 15 | import os
 16 | 
 17 | 
 18 | class Password( ndb.Model ):
 19 |     """temporary storage for encrypted password"""
 20 |     ciphertext = ndb.BlobProperty( required = True )  # password only sent to server AFTER being encrypted by browser, key NEVER sent to server
 21 |     expire_date = ndb.DateTimeProperty( required = True )
 22 |     ip_hash = ndb.StringProperty()
 23 | 
 24 | class LetsEncrypt( ndb.Model ):
 25 |     """LetsEncrypt challenge responses"""
 26 |     response = ndb.StringProperty( required = True )
 27 |     added = ndb.DateTimeProperty( required = True, auto_now_add = True )
 28 | 
 29 | 
 30 | bottle = Bottle()
 31 | 
 32 | 
 33 | # SSL cert from letsencrypt.org
 34 | @bottle.get( "/.well-known/acme-challenge/<challenge>" )
 35 | def letsencrypt( challenge ):
 36 | #    LetsEncrypt( id = challenge, response = "test response" ).put()
 37 |     le = LetsEncrypt.get_by_id( challenge )
 38 |     if le:
 39 |         return le.response
 40 |     return abort( 404 )
 41 | 
 42 | 
 43 | @bottle.get( "/" )
 44 | def index():
 45 |     return template( "template/index", { "ip": os.environ[ "REMOTE_ADDR" ] } )
 46 | 
 47 | 
 48 | @bottle.get( "/p" )
 49 | def p():
 50 |     return template( "template/p" )
 51 | 
 52 | 
 53 | @bottle.get( "/p<redir>" )
 54 | def p_redir( redir ):
 55 |     redirect( "/p" + redir ) # redirect to catch any user mangling of URL ("/p%23...")
 56 | 
 57 | 
 58 | @bottle.get( "/about" )
 59 | def about():
 60 |     return template( "template/about" )
 61 | 
 62 | 
 63 | @bottle.post( "/new" )
 64 | def new():
 65 |     cipher = request.POST.get( "cipher" ).strip()
 66 |     days = int( request.POST.get( "days" ).strip() )
 67 |     myiponly = request.POST.get( "myiponly" )
 68 |     
 69 |     if len( cipher ) < 1 or len( cipher ) > 8192 \
 70 |        or days < 1 or days > 30:
 71 |         abort( 400, "invalid options" )
 72 |     
 73 |     ## generate unique pw_id ..
 74 |     pw_id = ''.join(random.choice(string.ascii_letters + string.digits) for _ in range(4))
 75 |     while Password.get_by_id( pw_id ):
 76 |         pw_id = ''.join(random.choice(string.ascii_letters + string.digits) for _ in range(4))
 77 |     
 78 |     expire = datetime.datetime.now() + datetime.timedelta( days = days )
 79 |     
 80 |     password = Password( id = pw_id,
 81 |                          ciphertext = cipher,
 82 |                          expire_date = expire )
 83 |     
 84 |     if myiponly == "true":
 85 |         ## only store a salted hash of the IP, for privacy
 86 |         ip_salt = ''.join(random.choice(string.ascii_letters + string.digits) for _ in range(4))
 87 |         password.ip_hash = ip_salt + ":" + hashlib.sha1( ip_salt + os.environ[ "REMOTE_ADDR" ] ).hexdigest()
 88 |     
 89 |     password.put()
 90 |     
 91 |     response.add_header( "Access-Control-Allow-Origin", "*" ) # for auditable version + development
 92 |     
 93 |     return { "pw_id": pw_id }
 94 | 
 95 | 
 96 | @bottle.get( "/get/<pw_id>" )
 97 | def get( pw_id ):
 98 |     password = Password.get_by_id( pw_id )
 99 |     
100 |     if not password:
101 |         return abort( 404 )
102 |     
103 |     if password.expire_date < datetime.datetime.now(): # delete immediately if expired
104 |         password.key.delete()
105 |         return abort( 404 )
106 |     
107 |     if password.ip_hash:
108 |         ## only allow viewing from matching IP if myiponly is set..
109 |         ip_salt, ip_hash = password.ip_hash.split( ":", 1 )
110 |         if not ip_hash == hashlib.sha1( ip_salt + os.environ[ "REMOTE_ADDR" ] ).hexdigest():
111 |             return abort( 404 )
112 |     
113 |     cipher = password.ciphertext
114 |     
115 |     password.key.delete() # only return encrypted password for a SINGLE viewing
116 |     
117 |     response.add_header( "Access-Control-Allow-Origin", "https://tkooda.github.io" ) # for auditable version
118 |     
119 |     return { "cipher": cipher }
120 | 
121 | 
122 | @bottle.get( "/cleanup" ) # cron
123 | def cleanup():
124 |     keys = Password.query( Password.expire_date < datetime.datetime.now() ).fetch( keys_only = True )
125 |     ndb.delete_multi( keys )
126 | 


--------------------------------------------------------------------------------
/requirements.txt:
--------------------------------------------------------------------------------
1 | # This requirements file lists all dependecies for this project.
2 | #
3 | # Run 'pip install -r requirements.txt -t lib/' to install these dependencies
4 | # in this project's lib/ directory.  The `lib` directory is added to `sys.path`
5 | # by `appengine_config.py`.
6 | bottle==0.12.7
7 | 


--------------------------------------------------------------------------------
/static/clippy.svg:
--------------------------------------------------------------------------------
1 | <svg height="1024" width="896" xmlns="http://www.w3.org/2000/svg">
2 |   <path d="M128 768h256v64H128v-64z m320-384H128v64h320v-64z m128 192V448L384 640l192 192V704h320V576H576z m-288-64H128v64h160v-64zM128 704h160v-64H128v64z m576 64h64v128c-1 18-7 33-19 45s-27 18-45 19H64c-35 0-64-29-64-64V192c0-35 29-64 64-64h192C256 57 313 0 384 0s128 57 128 128h192c35 0 64 29 64 64v320h-64V320H64v576h640V768zM128 256h512c0-35-29-64-64-64h-64c-35 0-64-29-64-64s-29-64-64-64-64 29-64 64-29 64-64 64h-64c-35 0-64 29-64 64z" />
3 | </svg>
4 | 


--------------------------------------------------------------------------------
/static/random-password.js:
--------------------------------------------------------------------------------
 1 | // attempt to generate cryptographically secure random byte, with optional max for using as a charset index
 2 | function getRandomByte( max = 256 ) {
 3 |     // http://caniuse.com/#feat=getrandomvalues
 4 |     var crypto = window.crypto || window.msCrypto;
 5 |     if ( crypto && crypto.getRandomValues ) {
 6 |         var a = new Uint8Array( 1 );
 7 |         while ( true ) {
 8 |             crypto.getRandomValues( a );
 9 |             if ( a[0] <= max ) return a[0];
10 |         }
11 |     } else {
12 |         return Math.floor( Math.random() * max );
13 |     }
14 | };
15 | 
16 | function generatePassword( minLength = 20, maxLength = 30, charset = "abcdefghijknopqrstuvwxyzACDEFGHJKLMNPQRSTUVWXYZ2345679" ) {
17 |     if ( minLength > maxLength) maxLength = minLength;
18 |     var randomLength = Math.floor( Math.random() * ( maxLength - minLength ) ) + minLength;
19 |     var password = "";
20 |     for ( var i = 0, maxIndex = charset.length; i < randomLength; i++ ) {
21 |         password += charset.charAt( getRandomByte( maxIndex ) );
22 |     }
23 |     return password;
24 | };
25 | 
26 | 


--------------------------------------------------------------------------------
/static/robots.txt:
--------------------------------------------------------------------------------
1 | User-agent: *
2 | Disallow: /new
3 | Disallow: /p/
4 | Disallow: /d/
5 | Disallow: /.well-known/acme-challenge/
6 | 


--------------------------------------------------------------------------------
/template/about.tpl:
--------------------------------------------------------------------------------
 1 | <html>
 2 | <head>
 3 |  <title>Temporal.PW - Temporary secure storage for passwords</title>
 4 |  <meta name="viewport" content="width=device-width, initial-scale=1">
 5 |  <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.6/css/bootstrap.min.css">
 6 |  <link rel="shortcut icon" type="image/png" href="data:image/png;base64,iVBORw0KGgo=">
 7 | </head>
 8 | <body>
 9 | 
10 | <style type="text/css">
11 |   body { background: #d3d3d3 !important; }
12 | </style>
13 | 
14 | <div class="container">
15 | 
16 | <h1>About <a href="/">Temporal.PW</a>:</h1><br/>
17 | <h3>
18 | <a href="/">Temporal.PW</a> can convert a password into a unique temporary secure URL that is safe to send via E-Mail.<br/>
19 | <br/>
20 | I made this because I needed a simple way to send passwords to people with whom I didn't already have end-to-end encryption established.<br/>
21 | </h3>
22 | <br/>
23 | 
24 | <h3>How to use it:</h3><br/>
25 | <h4>
26 | <ol>
27 |   <li>Enter a good, long, random password into <a href="/">temporal.pw</a>, or click "Generate a random password".</li><br/>
28 |   <li>E-Mail the temporary URL to someone:</li><br/>
29 |   <ul>
30 |     <li>If they're able to view the password: you know that nobody else was able to view it, and you know that that URL can't be used again later to determine the password.</li><br/>
31 |     <li>If they see a "This password doesn't exist" error: that password was likely viewed by someone else, the recipient needs to tell you to generate a new password and send them a new temporal.pw URL.</li><br/>
32 |     <li>If they see an "Invalid password URL" error: the URL they're attempting to view isn't the exact URL that you generated for them.</li><br/>
33 |   </ul>
34 | </ol>
35 | </h4>
36 | 
37 | <br/>
38 | <br/>
39 | 
40 | <h3>How it works:</h3><br/>
41 | <h4>
42 | <ul>
43 |   <li>The unencrypted password is NEVER sent anywhere.</li><br/>
44 |   <li>The password encryption key is generated by your browser and is NEVER sent anywhere.</li><br/>
45 |   <li>The browser generates a random 128 bit AES encryption/decryption key, encrypts the password with it, sends (only) the encrypted version of the password to the server (so that the URL can be rendered useless after viewing the password once, and the URL doesn't expose the password to brute force attack), and then the browser builds a unique temporary secure URL that contains the ID of the encrypted password plus the decryption key.</li><br/>
46 |   <li>The password encryption/decryption key only exists in the 'fragment' part of the URL (after the '#' hash symbol) and is never sent to the server.</li><br/>
47 |   <li>The encrypted password is only sent to the server so that the unique temporary secure URL can be rendered useless after it has been viewed once or it has expired.  (the encrypted password is sent instead of the key so that the password can't be brute forced out of the URL, and so that the URL is a fixed short length independent of the password size)</li><br/>
48 |   <li>The encrypted password cannot be decrypted without the decryption key thats in the unique temporary secure URL.</li><br/>
49 | <br/>
50 |   <li>All key generation, encryption, and decryption is 100% done in the browser using common public cryptographic libraries (<a href="https://github.com/ricmoo/aes-js">AES-JS</a>).</li><br/>
51 |   <li>The encrypted password is deleted from the server after it expires, or immediately after being viewed a single time by someone who has the unique temporary secure URL.</li><br/>
52 |   <li>Each password is only viewable a single time so that the intended recipient will NOT be able to view the password if someone else has intercepted and viewed it first.</li><br/>
53 |   <li>Optionally, you can choose to tell the server to only allow a password to be viewed from your same IP address (useful for sending passwords to someone in the same office / network).</li><br/>
54 | </ul>
55 | </h4>
56 | 
57 | <br/>
58 | <br/>
59 | 
60 | <h3>Other Information:</h3><br/>
61 | <h4>
62 | <ul>
63 |   <li>Easy to audit: only ~150 lines of python for the backend, and ~200 lines of JavaScript for the fronend.</li><br/>
64 |   <li><a href="http://github.com/tkooda/temporalpw">100% open source</a>.</li><br/>
65 |   <li>Uses <a href="http://bottlepy.org/">Bottle</a> framework for the backend; <a href="https://jquery.com/">jQuery</a>, <a href="http://getbootstrap.com/">bootstrap</a>, and <a href="https://clipboardjs.com/">clipboard.js</a> for the frontend; and <a href="https://github.com/ricmoo/aes-js">AES-JS</a>, <a href="https://github.com/45678/Base58">Base58</a>, and <a href="https://github.com/h2non/jshashes">jshashes</a> for the in-browser cryptography.</li><br/>
66 |   <li>If you're paranoid, and don't trust that I won't change the JavaScript to send your password or encryption key somewhere (and you don't want to just view the source of the page) : you can use this copy of the JavaScript hosted on github.io: <a href="https://tkooda.github.io/temporalpw/">https://tkooda.github.io/temporalpw/</a> instead, where (you can track any changes to the Javascript you're running at <a href="https://github.com/tkooda/temporalpw/commits/gh-pages">https://github.com/tkooda/temporalpw/commits/gh-pages</a>).</li><br/>
67 |   <li>If you'd like to say "thanks" for this free service: you can send me a few pennies via Bitcoin to: <a href="bitcoin:1MLaaKmMbioyCKZShbyKGJztUP8M7BHRYp">1MLaaKmMbioyCKZShbyKGJztUP8M7BHRYp</a></li><br/>
68 | </ul>
69 | </h4>
70 | 
71 | <br/>
72 | 
73 | <center>
74 | <a href="/">Send another password</a> | <a href="https://github.com/tkooda/temporalpw">Source</a></br>
75 | </center>
76 | 
77 | <br/>
78 | <br/>
79 | 
80 | </div>
81 | 
82 | </body>
83 | </html>
84 | 


--------------------------------------------------------------------------------
/template/index.tpl:
--------------------------------------------------------------------------------
  1 | <html>
  2 | <head>
  3 |  <title>Temporal.PW - Temporary secure storage for passwords</title>
  4 |  <meta name="viewport" content="width=device-width, initial-scale=1">
  5 |  <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.6/css/bootstrap.min.css">
  6 |  <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/2.2.0/jquery.min.js" crossorigin="anonymous" integrity="sha384-K+ctZQ+LL8q6tP7I94W+qzQsfRV2a+AfHIi9k8z8l9ggpc8X+Ytst4yBo/hH+8Fk"></script>
  7 |  <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.6/js/bootstrap.min.js" crossorigin="anonymous" integrity="sha384-0mSbJDEHialfmuBBQP6A4Qrprq5OVfW37PRR3j5ELqxss1yVqOtnepnHVP9aJ7xS"></script>
  8 |  <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/clipboard.js/1.5.8/clipboard.min.js" crossorigin="anonymous" integrity="sha384-6IvGwMLZzeEDqfqkglJOV5PIsjfAnO7VLUOZKdFasr8OfwhrG5BU1xnrmfYhIJbA"></script>
  9 |  <script type="text/javascript" src="https://cdn.rawgit.com/ricmoo/aes-js/v2.0.0/index.js" crossorigin="anonymous" integrity="sha384-PXzFVs1Uwmv9IgXZtHWck4jUzla5FSGAFTRAuiXE3i2yjh7QbVhl6R52oYVRLmTE"></script>
 10 |  <script type="text/javascript" src="https://cdn.rawgit.com/45678/base58/master/Base58.js" crossorigin="anonymous"></script>
 11 |  <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/jshashes/1.0.5/hashes.min.js" crossorigin="anonymous" integrity="sha384-tARwkAjXmhKdUTDed6+4lbwtffWZDOIw7AiDtqp/Zubhc9EK/JvPrX9g27RolaxX"></script>
 12 |  <script type="text/javascript" src="https://cdn.rawgit.com/tkooda/temporalpw/master/static/random-password.js" crossorigin="anonymous" integrity="sha384-/7FPV70hkdAoFrKjuFUVI42WgJQEkmSV/0VRJyXRWF2qBlUSmp9mE4V6nMNJLZBt"></script>
 13 |  <link rel="shortcut icon" type="image/png" href="data:image/png;base64,iVBORw0KGgo=">
 14 | </head>
 15 | <body>
 16 | 
 17 | <style type="text/css">
 18 |   body { background: #d3d3d3 !important; }
 19 |   h1 { font-family: 'Cooper Black', serif; }
 20 | </style>
 21 | 
 22 | <script language="javascript">
 23 | if (window.location.protocol != "https:")
 24 |     window.location.href = "https:" + window.location.href.substring(window.location.protocol.length); // fix github.io redirecting directories w/out trailing slash to http
 25 | 
 26 | var has_url = false;
 27 | 
 28 | function generate_url() {
 29 |   var secret = document.getElementById( "secret" ).value;
 30 |   if ( secret == null || secret == "" ) {
 31 |     return false;
 32 |   }
 33 |   
 34 |   // generate random key byte array ..
 35 |   var crypto = window.crypto || window.msCrypto;
 36 |   if ( ! crypto ) throw new Error( "Your browser does not support window.crypto or window.msCrypto." );
 37 |   var key = new Uint8Array( 16 );
 38 |   crypto.getRandomValues( key );  // generate random 128 bit AES key
 39 |   
 40 |   // encode key byte array ..
 41 |   var encoded_key = Base58.encode( key );
 42 |   
 43 |   // convert password string to byte array, never send this to the server unencrypted ..
 44 |   var password_bytes = aesjs.util.convertStringToBytes( secret );
 45 |   
 46 |   // encrypt password ..
 47 |   var aesCtr = new aesjs.ModeOfOperation.ctr( key, new aesjs.Counter( 5 ) );
 48 |   var encrypted_bytes = aesCtr.encrypt( password_bytes );
 49 |   
 50 |   // encode encrypted password ..
 51 |   var encoded_encrypted_bytes = Base58.encode( encrypted_bytes );
 52 |   
 53 |   $.post( "https://temporal.pw/new",
 54 |           { cipher: encoded_encrypted_bytes, // ONLY send encrypted password to server, NEVER send the key or unencrypted password!
 55 |             days: document.getElementById( "days" ).value,
 56 |             myiponly: document.getElementById( "myiponly" ).checked },
 57 |           function( data, status ) { got_id( data, status, encoded_key ) } ); // encryption key is never sent to server, it's only provided to this ajax success callback so the browser can build the secret URL
 58 |   
 59 |   return false;
 60 | };
 61 | 
 62 | 
 63 | function got_id( data, status, encoded_key ) {
 64 |   var SHA256 = new Hashes.SHA256;
 65 |   
 66 |   $("#docs").text( "This URL can be used ONCE to view the password:" );
 67 |   
 68 |   var token = data.pw_id + "-" + encoded_key;
 69 |   
 70 |   document.getElementById( "secret" ).value = "https://Temporal.PW/p#" + token + SHA256.hex( token ).substr( 0, 2 );
 71 |   $("#secret").attr( "readonly", true );
 72 |   
 73 |   var info = "(this URL will expire in " + document.getElementById( "days" ).value + " days";
 74 |   if ( document.getElementById( "myiponly" ).checked ) {
 75 |     info = info + ", and it is only viewable from this same IP address";
 76 |   }
 77 |   $("#settings").html( info + ")<br/>" );
 78 |   $("#warning").addClass("hidden");
 79 |   $("#genPassword").addClass("hidden");
 80 |   $("#getUrlButton").addClass("hidden");
 81 |   
 82 |   has_url = true;
 83 |   
 84 |   return false;
 85 | };
 86 | 
 87 | 
 88 | $(document).ready(function(){
 89 |   // popup temporary tooltip when clicking copy button ..
 90 |   var clipboard = new Clipboard( "#clip-btn" );
 91 |   clipboard.on( "success", function(e) {
 92 |     if ( has_url ) {
 93 |       $( "#clip-btn" ).tooltip( "enable" ).attr( "title", "URL copied to clipboard" ).tooltip( "fixTitle" ).tooltip( "show" );
 94 |     } else {
 95 |       if ( document.getElementById( "secret" ).value != null && document.getElementById( "secret" ).value != "" ) {
 96 |         $( "#clip-btn" ).tooltip( "enable" ).attr( "title", "Password copied to clipboard" ).tooltip( "fixTitle" ).tooltip( "show" );
 97 |       }
 98 |     }
 99 |   });
100 |   $( "#clip-btn" ).mouseleave( function() {
101 |     $( "#clip-btn" ).tooltip( "disable" );
102 |   });
103 |   
104 |   // make get URL button clickable upon input ..
105 |   $("#getUrlButton").prop( "disabled", true );
106 |   $("#secret").on( "input", function() {
107 |     if ( $( this ).val().length )
108 |         $("#getUrlButton").prop( "disabled", false );
109 |     else
110 |         $("#getUrlButton").prop( "disabled", true );
111 |   });
112 |   
113 | });
114 | 
115 | $(document).on('click','input[type=text]',function(){ this.select(); });
116 | 
117 | </script>
118 | 
119 | <div class="container text-center">
120 | 
121 | <br/>
122 | <br/>
123 | <h1>E-Mail passwords securely with <a href="/">Temporal.PW</a></h1>
124 | <br/>
125 | <br/>
126 | 
127 | <div class="form-group">
128 | <form role="form" id="myForm" name="myForm" action="">
129 | 
130 | <label for="inputlg"><h2><div id="docs">Enter a password to create a temporary secure URL for:</div></h2></label>
131 | <div class="col-xs-8 col-xs-offset-2 text-center">
132 |   <div class="input-group">
133 |     <input type="text" id="secret" name="secret" placeholder="Enter a password" class="form-control input-lg text-center">
134 |     <span class="input-group-addon">
135 |       <button type="button" id="clip-btn" data-clipboard-target="#secret">
136 |         <img src="static/clippy.svg" width="20" alt="Copy to clipboard">
137 |       </button>
138 |     </span>
139 |   </div>
140 |   <div id="genPassword">or: <button type="button" id="generate" class="btn btn-primary btn-xs" onclick="document.getElementById('secret').value = generatePassword(); $('#getUrlButton').prop( 'disabled', false );">Generate a random password</button> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</div>
141 | </div>
142 | 
143 | <br/>
144 | <br/>
145 | <br/>
146 | <br/>
147 | <br/>
148 | 
149 | <h4>
150 | <span id="settings">
151 | <div>
152 | Make this URL expire in <select name="days" id="days">
153 |   <option value="1">1</option>
154 |   <option value="2">2</option>
155 |   <option value="3" selected>3</option>
156 |   <option value="4">4</option>
157 |   <option value="5">5</option>
158 |   <option value="6">6</option>
159 |   <option value="7">7</option>
160 |   <option value="8">8</option>
161 |   <option value="9">9</option>
162 |   <option value="10">10</option>
163 |   <option value="15">15</option>
164 |   <option value="20">20</option>
165 |   <option value="30">30</option>
166 | </select> days.
167 | </div>
168 | 
169 | <div class="checkbox">
170 |  <label><input type="checkbox" name="myiponly" id="myiponly">Only allow it to be viewed from my current IP address<br/>
171 |  <small>(useful for sending a password to someone in the same office / network)</small></label>
172 | </div>
173 | 
174 | </span>
175 | 
176 | <br/>
177 | </h4>
178 | 
179 | <input type="submit" id="getUrlButton" class="btn btn-success btn-lg" value="Get temporary URL for this password" onclick="return generate_url();">
180 | </form>
181 | 
182 | </div>
183 | 
184 | <br/>
185 | <span id="warning">
186 | (Do not include any information that identifies what the password is for)<br/>
187 | </span>
188 | <br/>
189 | 
190 | <a href="/">Send another password</a> | <a href="/about">About</a> | <a href="https://github.com/tkooda/temporalpw">Source</a></br>
191 | 
192 | </div>
193 | 
194 | </body>
195 | </html>
196 | 


--------------------------------------------------------------------------------
/template/p.tpl:
--------------------------------------------------------------------------------
  1 | <html>
  2 | <head>
  3 |  <title>Temporal.PW - Temporary secure storage for passwords</title>
  4 |  <meta name="viewport" content="width=device-width, initial-scale=1">
  5 |  <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.6/css/bootstrap.min.css">
  6 |  <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/2.2.0/jquery.min.js" crossorigin="anonymous" integrity="sha384-K+ctZQ+LL8q6tP7I94W+qzQsfRV2a+AfHIi9k8z8l9ggpc8X+Ytst4yBo/hH+8Fk"></script>
  7 |  <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.6/js/bootstrap.min.js" crossorigin="anonymous" integrity="sha384-0mSbJDEHialfmuBBQP6A4Qrprq5OVfW37PRR3j5ELqxss1yVqOtnepnHVP9aJ7xS"></script>
  8 |  <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/clipboard.js/1.5.8/clipboard.min.js" crossorigin="anonymous" integrity="sha384-6IvGwMLZzeEDqfqkglJOV5PIsjfAnO7VLUOZKdFasr8OfwhrG5BU1xnrmfYhIJbA"></script>
  9 |  <script type="text/javascript" src="https://cdn.rawgit.com/ricmoo/aes-js/v2.0.0/index.js" crossorigin="anonymous" integrity="sha384-PXzFVs1Uwmv9IgXZtHWck4jUzla5FSGAFTRAuiXE3i2yjh7QbVhl6R52oYVRLmTE"></script>
 10 |  <script type="text/javascript" src="https://cdn.rawgit.com/45678/base58/master/Base58.js" crossorigin="anonymous"></script>
 11 |  <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/jshashes/1.0.5/hashes.min.js" crossorigin="anonymous" integrity="sha384-tARwkAjXmhKdUTDed6+4lbwtffWZDOIw7AiDtqp/Zubhc9EK/JvPrX9g27RolaxX"></script>
 12 |  <link rel="shortcut icon" type="image/png" href="data:image/png;base64,iVBORw0KGgo=">
 13 | </head>
 14 | <body>
 15 | 
 16 | <style type="text/css">
 17 |   body { background: #d3d3d3 !important; }
 18 |   .col-centered { float: none; margin: 0 auto; }
 19 | </style>
 20 | 
 21 | <script>
 22 | $(document).ready(function(){
 23 |   var clipboard = new Clipboard( "#clip-btn" );
 24 |   clipboard.on('success', function(e) {
 25 |     $( "#clip-btn" ).tooltip( "enable" ).attr( "title", "Password copied to clipboard" ).tooltip( "fixTitle" ).tooltip( "show" );
 26 |   });
 27 |   $( "#clip-btn" ).mouseleave( function() {
 28 |     $( "#clip-btn" ).tooltip( "disable" );
 29 |   });
 30 |   
 31 |   // attempt to fetch password based on URL fragment (only the password ID is sent to the server, NOT the decryption key)
 32 |   if ( window.location.hash ) {
 33 |     var SHA256 = new Hashes.SHA256;
 34 |     
 35 |     var token = window.location.hash.substring( 1 ).slice( 0, -2 ); // strip "#" from URL fragment
 36 |     var checksum = window.location.hash.substring( 1 ).slice( -2 ); // checksum used for better error message
 37 |     var id_and_key = token.split( "-", 2 );
 38 |     
 39 |     var pw_id = id_and_key[ 0 ]; // pw_id used to fetch encrypted password from server
 40 |     var key   = id_and_key[ 1 ]; // password decryption key is never sent to server!
 41 |     
 42 |     if ( checksum != SHA256.hex( token ).substr( 0, 2 ) ) { // checksum only used to provide alternate error (and postpone deleting the encrypted password from server) in the case of accidental URL mangling (e.g. the user is going to get a malformed password by decrypting with a mangled key)
 43 |       $( "#message" ).text( "Invalid password URL" );
 44 |     } else {
 45 |       $.getJSON( "https://temporal.pw/get/" + pw_id, // this GET also deletes the encrypted password from the server
 46 |              function( data ) {
 47 |                // decode encrypted password ..
 48 |                var decoded_encrypted_bytes = Base58.decode( data.cipher );
 49 |                
 50 |                // decode key ..
 51 |                var decoded_key = Base58.decode( key );
 52 |                
 53 |                // decrypt decoded password with decoded key ..
 54 |                var aesCtr = new aesjs.ModeOfOperation.ctr( decoded_key, new aesjs.Counter( 5 ) );
 55 |                var decrypted_bytes = aesCtr.decrypt( decoded_encrypted_bytes );
 56 |                
 57 |                // Convert our bytes back into text
 58 |                var decrypted_password = aesjs.util.convertBytesToString( decrypted_bytes );
 59 |                
 60 |                $( "#message" ).text( "Your password is:" );
 61 |                $( "#password" ).text( decrypted_password );
 62 |                $( "#clip-btn" ).removeClass( "hidden" );
 63 |                $( "#warning" ).removeClass( "hidden" );
 64 |                
 65 |              } );
 66 |     } // checksum check
 67 |   }
 68 |   
 69 | });
 70 | 
 71 | </script>
 72 | 
 73 | <center>
 74 | <div class="container text-center center-block" align="center">
 75 | <br/>
 76 | <br/>
 77 | 
 78 | <h2><span id="message">This password doesn't exist</span></h2>
 79 | 
 80 | <hr>
 81 | <h1><span id="password" style="font-family: monospace; white-space: pre-wrap"></span></h1>
 82 | <hr>
 83 | <span class="input-group-btn">
 84 |   <button type="button" id="clip-btn" class="btn btn-success mytooltip hidden" data-clipboard-target="#password" data-placement="right">Copy password to clipboard</button>
 85 | </span>
 86 | 
 87 | <br/>
 88 | <br/>
 89 | 
 90 | <h4><b><span id="warning" class="hidden">WARNING: This is the ONLY time this password will be visible via this URL.</span></b></h4>
 91 | 
 92 | <br/>
 93 | 
 94 | <a href="/">Send another password</a> | <a href="/about">About</a> | <a href="https://github.com/tkooda/temporalpw">Source</a></br>
 95 | 
 96 | </div>
 97 | 
 98 | </center>
 99 | </body>
100 | </html>
101 | 


--------------------------------------------------------------------------------
/vendor.py:
--------------------------------------------------------------------------------
 1 | #
 2 | # Copyright 2014 Jon Wayne Parrott, [proppy], Michael R. Bernstein
 3 | #
 4 | # Licensed under the Apache License, Version 2.0 (the "License");
 5 | # you may not use this file except in compliance with the License.
 6 | # You may obtain a copy of the License at
 7 | #
 8 | #     http://www.apache.org/licenses/LICENSE-2.0
 9 | #
10 | # Unless required by applicable law or agreed to in writing, software
11 | # distributed under the License is distributed on an "AS IS" BASIS,
12 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | # See the License for the specific language governing permissions and
14 | # limitations under the License.
15 | #
16 | 
17 | # Notes:
18 | # - Imported from https://github.com/jonparrott/Darth-Vendor/.
19 | # - Added license header.
20 | # - Renamed `darth.vendor` to `vendor.add` to match upcoming SDK interface.
21 | # - Renamed `position` param to `index` to match upcoming SDK interface.
22 | # - Removed funny arworks docstring.
23 | 
24 | import site
25 | import os.path
26 | import sys
27 | 
28 | 
29 | def add(folder, index=1):
30 |   """
31 |   Adds the given folder to the python path. Supports namespaced packages.
32 |   By default, packages in the given folder take precedence over site-packages
33 |   and any previous path manipulations.
34 | 
35 |   Args:
36 |     folder: Path to the folder containing packages, relative to ``os.getcwd()``
37 |     position: Where in ``sys.path`` to insert the vendor packages. By default
38 |       this is set to 1. It is inadvisable to set it to 0 as it will override
39 |       any modules in the current working directory.
40 |   """
41 | 
42 |   # Check if the path contains a virtualenv.
43 |   site_dir = os.path.join(folder, 'lib', 'python' + sys.version[:3], 'site-packages')
44 |   if os.path.exists(site_dir):
45 |     folder = site_dir
46 |   # Otherwise it's just a normal path, make it absolute.
47 |   else:
48 |     folder = os.path.join(os.path.dirname(__file__), folder)
49 | 
50 |   # Use site.addsitedir() because it appropriately reads .pth
51 |   # files for namespaced packages. Unfortunately, there's not an
52 |   # option to choose where addsitedir() puts its paths in sys.path
53 |   # so we have to do a little bit of magic to make it play along.
54 | 
55 |   # We're going to grab the current sys.path and split it up into
56 |   # the first entry and then the rest. Essentially turning
57 |   #   ['.', '/site-packages/x', 'site-packages/y']
58 |   # into
59 |   #   ['.'] and ['/site-packages/x', 'site-packages/y']
60 |   # The reason for this is we want '.' to remain at the top of the
61 |   # list but we want our vendor files to override everything else.
62 |   sys.path, remainder = sys.path[:1], sys.path[1:]
63 | 
64 |   # Now we call addsitedir which will append our vendor directories
65 |   # to sys.path (which was truncated by the last step.)
66 |   site.addsitedir(folder)
67 | 
68 |   # Finally, we'll add the paths we removed back.
69 |   # The final product is something like this:
70 |   #   ['.', '/vendor-folder', /site-packages/x', 'site-packages/y']
71 |   sys.path.extend(remainder)
72 | 


--------------------------------------------------------------------------------