←back to thread

14 points redactsure | 4 comments | | HN request time: 0.343s | source

Hi HN, I'm releasing my round one public demo of a new browser security system I've been developing.

There's a real Bitcoin private key (worth $20) in plaintext at app.redactsure.com. You can copy it, paste it, delete it, move it around - full control. But you can't see the actual characters or extract them.

The challenge: Break the protection and take the Bitcoin. First person wins, challenge ends.

Details: - Requires email verification (prevents abuse, no account needed) - 15 minute time limit per session - Currently US only for the demo (latency) - Verify the Bitcoin is real: https://redactsure.com/bitcoinchallenge

Technical approach: - Cloud-hosted browser with real time NER model - Webpages are unmodified - Think of it as selective invisibility for sensitive data. You can interact with it normally, just can't see or extract it

Looking for feedback on edge cases in the hiding/protection algorithm. Happy to answer questions about the implementation.

1. cikito2131 ◴[] No.45017520[source]
i took the coins (temp email cikito2131@evoxury.com) went to the tools site you linked, main page and to the tool that makes pictures from text. pasted into textbox and it wasn't hidden. Spent more time figuring out how to do the wallet stuff
replies(3): >>45017639 #>>45018572 #>>45019168 #
2. redactsure ◴[] No.45017639[source]
lol that's dumb of me. I figured one of the websites would have a vulnerability like that. Images should be hidden but clearly not!

Anyways. Thanks for the feedback! I'll be back when I add a patch.

3. redactsure ◴[] No.45018572[source]
bug was literally 1 line of code.

I might be back up today if you want another shot.

I had no idea evil tester website had so many tools throughout it!

4. chistev ◴[] No.45019168[source]
Smart people exist.