Quote from: pebwindkraft on September 05, 2017, 09:07:27 AM

I have some concerns with this post: Huh

The post is "a bit pushy", also the question why noone is answering - so soon? What is the offer? It is unclear. And some "I have a big project in my mind, which I cannot tell you at this point in time" creates more doubts than questions on the reputation of the post.

Usually it is not recommend to download software/libraries from untrusted sources.
As such it is good to have the sources on github.
Compiled executables can have too many negative impacts, and we don't know yet, what it gives. We'd need a reference with checksums first, so this can be verified on some systems with users from the community, to raise level of trust.

That said, I like the sharing idea, I see it like steganography. Also it is similiar to the seeds we have in use. What makes your approach different from the existing solutions? What improves their security or handling? Can you elaborate a bit?

A bit pushy? Sorry about that. I saw the views come in and no comment, so I figured someone must have something to say about this.

And regarding the "big project", it's just something I've been thinking and worked on long and are a bit excited to finally open up to the public. It suits better in a new post and I'm trying to finish the last necessary touches with it. Maybe I should have waited to mention it. I'm just excited about it and hope it will do well.

I don't recommend downloading software/libraries from untrusted sources either. I thought the links could help getting a view into the binaries, but sure. I highly recommend reading the source code and build yourself to make sure it's not doing anything fonky. Since it's written in Go, building yourself is really not that difficult. One of the good things with Go.

I'm not sure exactly how one would go on about showing that the binary can be trusted. Someone trusted needs to examine and build it and provide the hash of the file I suppose.

How it differs? Well, it's not much different to other solutions I suppose besides generating readable words and being a binary to easily run locally through the command line. I suppose one thing that could increase the security is to also provide your own wordlist. That way, this is also needed to get the secret back. You can do that as it is right now using the --dictionary parameter. Also, note that this is the first version I did. I had in mind also adding a simple webserver (since it's easy to do in Go), and I could add a GUI interface to it too. That way you would have both the GUI or command line way of doing things. And who knows down the road what else could be made with this to improve it. And I suppose using words helps a bit to make sure there is no typo mistake in the share (provided you don't print this on a printer of course). If you for example have "bid aroumd aware blouse artwork", you could guess it's suppose to be "around" instead of "aroumd".