{"id":47001243,"title":"Show HN: Kurpod – an encrypted OSS \"container file\" you can name vacation.jpg","points":1,"user":"Tsarp","time":1770979288,"time_ago":"6 hours ago","type":"link","content":"

I built Kurpod: a self-hosted file vault that stores many files inside a single encrypted blob you can name like an innocent file (e.g., “vacation.jpg”).

The twist: the same blob supports two passwords:\n - Password #1 unlocks a decoy volume (harmless files)\n - Password #2 unlocks a hidden volume (the real stuff)

Diagram:\n my_vacation.jpg (really an encrypted blob)

    ├─ pw1 → standard volume (decoy)\n\n    └─ pw2 → hidden volume (real)\n

\nImportant: this is filename disguise, not steganography / real file-format mimicry. If someone runs `file`, it won’t look like a JPEG.

Crypto primitives: Argon2id for KDF + XChaCha20-Poly1305 for encryption.

Quick start (Docker):\n docker run -p 3000:3000 -e BLOB_DIR=/data -v ./data:/data ghcr.io/srv1n/kurpod-server:latest\n open http://localhost:3000

Demo video:\n https://github.com/user-attachments/assets/d47b10cf-c38e-47e...

It’s an early release (expect bugs / not audited). I’d love feedback on:

  1) threat model: what this protects well vs. where it’s weak\n\n  2) plausible-deniability ergonomics: what user mistakes would ruin the “decoy” story?\n\n  3) file format / crypto review: anything obviously dumb or dangerous?

","url":"https://github.com/srv1n/kurpod","domain":"github.com","comments":[{"id":47002155,"level":0,"time":1770987149,"time_ago":"4 hours ago","content":"[deleted]","deleted":true,"comments":[]}],"comments_count":1}

Show HN: Kurpod – an encrypted OSS "container file" you can name vacation.jpg