Skip to content

Commit

Permalink
Update README
Browse files Browse the repository at this point in the history
  • Loading branch information
ex0dus-0x committed Feb 24, 2021
1 parent 7f694de commit 27f5811
Showing 1 changed file with 7 additions and 31 deletions.
38 changes: 7 additions & 31 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,42 +11,18 @@ Privacy-First Secrets Management Cryptosystem
## Introduction

__Ghostpass__ is a secrets management cryptography scheme that can hide encrypted secrets in cleartext for the purpose of distribution across public mediums. It ensures that your secrets, whether in the form of authentication credentials or actual messages and documents, can appear in plainsight as normal cleartexts, and can be confidently transmitted even in a public medium with potential malicious actors, even those that may act out with coercion to exfiltrate and decrypt it.
__Ghostpass__ is a command-line tool that helps symmetrically encrypt your secrets, and makes it feasible for plainsight distribution. It ensures that your secrets, whether in the form of authentication credentials or
actual messages and documents, can appear in plainsight as normal cleartexts, and can be confidently transmitted even in a public medium with potential malicious actors, even those that may act out with coercion to exfiltrate and decrypt it.

Ghostpass is _novel_ in the sense that it applies modern symmetric cryptography towards digital consumer privacy to mitigate [rubber-hose cryptoanalysis](https://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis). However, it should also be considered _novelty_ because it is __NOT__ a full replacement for current cryptographic software, but an ongoing effort to bridge together cryptography and privacy research. I encourage users to criticize, audit and expose shortcomings in order to better understand how these types of implementations can better be harnessed in the space of digital privacy.

There's quite a bit of password/secrets managers that are out there today, so why even bother with Ghostpass? In order to answer this question, let's take a look at different password managers "models" that already exist, and the problems that plague them:

* __Web-based clients__ are centralized, and data breaches are possible since they are central points of failure.
* __Offline clients__ ( i.e KeePass) don't enable for fast distribution across hosts and portability. They share a unified filetype that require compliant client implementations to work

Ghostpass's implementation aims to create a compromise that doesn't require the authority of a password management service, but can still enable portability for users across whatever mediums they choose.

## Design

For more information regarding

* [Threat Model](https://github.com/ghostpass/ghostpass/blob/master/docs/threat_model.md)
* [Internal Design](https://github.com/ghostpass/ghostpass/blob/master/docs/internal_design.md)

## Features

* __Secure__ - all fields in secret stores are properly protected in-memory and on-disk, such that attackers with even priviledged access to the host can't recover anything.
* __Cryptographically Secure__ - information is secured and validated with secret-key authentication encryption scheme XSalsa20-Poly1305.
* __Privacy-Centric__ - supports "plainsight distribution" using zero-width encoding to hide ciphertext within plaintext, and plausible deniability (TODO) to give back fake entries under an assumption of coercion.
Ghostpass is _novel_ in the sense that it applies modern symmetric cryptography towards digital consumer privacy to mitigate [rubber-hose cryptoanalysis](https://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis).
However, it should also be considered _novelty_ because it is __NOT__ a full replacement for current cryptographic software.

## Use Cases

* Hide and encrypt sensitive and private information away before going into an area of surveillance (ie. airport, government building).
* Use plainsight distribution as a means to make cold storage of keys safer on a host and in transmission.
* Use plainsight distribution as a means to make cold storage of keys safer on a host or in transmission.
* Employ a provably secure "digital book cipher" as a medium of transmission with another party.

### Who Can Use Ghostpass?

* __Journalists__ - hide secrets amongst corpuses of actual documents, and use plausible deniability to return bogus articles if ever interrogated
* __Lawyers__ - protect confidentiality of clients and sensitive anecdotes before trial by encrypting them amongst fake ones.
* __You, a Privacy-Conscious Digital Consumer!__

## Usage

There is on-going support for Ghostpass across different mediums, including the web and chatops. However, Ghostpass can still be used locally through the command line.
Expand All @@ -59,7 +35,7 @@ The Ghostpass command line application can be installed locally as follows:
$ go get -u github.com/ghostpass/ghostpass/cmd/ghostpass
```

However, to minimize the exfiltration of information from the user from a misuser, you may also run Ghostpass under a Docker container:
Docker is also supported if you want to minimize exfiltration on a host:

```
$ docker build .
Expand Down Expand Up @@ -90,4 +66,4 @@ $ git push origin my-branch-name

## License

[MIT License](https://codemuch.tech/license.txt)
[MIT License](https://opensource.org/licenses/MIT)

0 comments on commit 27f5811

Please sign in to comment.