Comment by mprime1
4 years ago
This is not meant as a solution. It's a demo of a self-contained, self-extracting, portable encrypted file.
That said, the password strength and the strength of the side-channel to transmit it depend on your use case.
If we were friends for example, I may not need to send you a password at all. I could just add some secret questions we both know in the hint.
Or, at the opposite side of the spectrum, I could send you a secret as email attachment and *include the password in the email itself*. This adds zero security in certain scenarios, but for example it keeps Google bots out of your private correspondence. Which is all I want sometimes.
the author even says that this is more for convenience rather than impenetrable security:
> I created Portable Secret to securely exchange documents via email with my mother, who can’t be expected to learn PGP, age, or similar.
Challenge: make it possible to use something like Diffie Hellman[0] to exchange a key securely even over an unsecure channel but where they resulting key is actually the password to type in and "reads" like https://xkcd.com/936/ i.e. something my grandma could type in. Without reducing the key space too much to be insecure ;)
[0] https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exc...