When you work with technology, sometimes you need to share or manage private information.
And you want to make sure it’s shared securely.
Perhaps you had to test something quickly, but didn’t need to maintain the password.
Or, maybe you had a sensitive message, private link, or password you wanted to share with one person.
And since it’s temporary or a one-time thing, you don’t want to save in it your password manager.
I’ve had that happen to me over the years with my clients. Usually when we’re on a phone call.
In the past, I recommended One-Time Secret, a free online site anyone can use to transfer or share sensitive information safely.
One-Time Secret allowed you to send a secret, set an expiration, and add an optional passphrase.
Except my friend Eric Mann discovered One-Time Secret sends your secret and passphrase to their servers in plaintext.
Yikes!
Which is why Mann created his own end-to-end encrypted secret service, Project Swordfish. Read on to learn more about his service and how it works.
Project Swordfish
Created by Eric Mann, the free Project Swordfish service lets you send secret text, private links, or messages safely and securely.
No need to set up an account. The online service allows you to add a passphrase if you choose.
Why Use Project Swordfish?
When you use email to send passwords or messages, copies of the info are maintained in different places.
Which means the info you send in email isn’t secure.
Project Swordfish offers a service that is:
- Free
- Anonymous
- End-to-end encrypted
Want to review the code? Project Swordfish is open-sourced and available on GitHub.
What You Need to Know
Mann explained his process and background about Project Swordfish in his end-to-end encrypted secret sharing post.
Key points from his post:
- The project is hosted on AWS with CloudFront
- No analytics are gathered for the site
- The password derives two separate keys
- All data bound to your secret automatically expires and is purged after 24 hours
How Project Swordfish Works
To share a secret
-
Visit Project Swordfish
-
Enter your secret
-
Enter your passphrase
-
Select Encrypt your secret
-
In the confirmation message, you’ll find your secret ID, passphrase, and link to retrieve your secret
-
Share the link with the person who want to share your secret (perhaps you’ll send the link via email)
-
Share the passphrase in a different system than you shared the secret (If you shared the link in email, use text or some other system)
To receive the secret, a person visits the link, which automatically adds the Secret ID. The person needs to enter the passphrase and submit the info to have the secret displayed.
Wrapping Up
Using an encrypted end-to-end service to share secrets keeps your info safe from systems that track you online.
While a password manager is the recommended method for maintaining information safely, sometimes you’ll want a service like Project Swordfish for those one-time transactions of secrets.
