Request: Add `start_time` and `end_time` in `page.meta`

[joapuiib]

Hello,
I'm developing a mkdocs site for my teaching materials and I want to post an exam in the site, using this plugin to password protect it.

It works great so far, and I have been able to customize it nicely but, I would love to be able to set a start_time and end_time in page.meta so the decryption only works in that time range for a specific page.

I am trying things in my fork, but I would like to know what would be your approach to this.

For now, I've thought of storing those values somewhere in the page HTML and then, check if the current time is between both values in javascript. I know this is not a secure way to prevent decryption outside this time range, since it could be easily hacked on the console, but I can't think of anything else.

If Issues is not a good place to place this request, maybe Dicussions could be enabled on the repository.

Thanks in advance!

[unverbuggt]

Hi,

first I'd suggest to look into mix-encrypted-and-normal-content, If you haven't already. It allows us to execute some javascript in the "teaser" div, like fill in username/password for us and press enter to decrypt (delete "teaser" and show "protected") the content on certain conditions.

Or you modified one of the templates to do similar things. Which is, as you already mentioned, not a very secure way, because everyone who can view the page source and knows some basic javascript could check the conditions and easily modify system date and time to fulfill the conditions. One could try to obfuscate the page source by minifying, but there are pretty good automatic formatters out there, which makes this useless.

We need to find a way to derive a constant password from the start_time and end_time and the current time without telling the start and end time...

Lucky for you, I'm currently working on a program that derives a password from GPS coordinates (without revealing latitude and longitude). I want the page to be only able to decrypt, when the user is at a certain location (+/-25 m). So we could use a similar method here.

//generate password from time range

//get timestamps (seconds since 1970-01-01)
//Note: I think all timestamps are in UTC!
let start_time = Math.floor(Date.parse('2024-09-25 13:05:23') / 1000);
let end_time = Math.floor(Date.parse('2024-09-29 06:05:23') / 1000);
let now_time = Math.floor(Date.now() / 1000);
//duration is used to quantisize
let duration = end_time - start_time; 
//we divide the now_time by the duration
let qtime = Math.floor(now_time / duration);
//and see where we land
let now_time_q = qtime * duration;
//calculate the correction
let ctime = start_time - now_time_q;
console.log('duration: '+duration);
console.log('time correction: '+ctime);
console.log('secret password (now): '+qtime);

We use duration and ctime as constants in our decryption page, they cannot be used to recalculate start_time and end_time. But we need them in order to produce the same password in that time range.

//now we test if we get the same password
qtime = Math.floor((start_time-ctime) / duration);
console.log('secret password (start_time): '+qtime);
qtime = Math.floor((end_time-1-ctime) / duration); //had to substact 1 second to cheat
console.log('secret password (end_time): '+qtime);

the output is as follows:

duration: 320400
time correction: -14077
secret password (now): 5391
secret password (start_time): 5391
secret password (end_time): 5391

But, to be clear, this sadly doesn't lead to a high entropy password and could easily brute forced. Even if you add a longer fixed password to the generated one and run a hash algorithm over it, it wouldn't help that much. You could, however, increase the kdf_pow, but some browsers might deny decryption if it takes too much cpu usage.

But if one of your students goes the extra mile to reverse engineer all this successfully he might deserve a bonus grade...

I don't think this can be added as a feature for the plugin, as there exists no 100% watertight solution to the problem. But I hope these thoughts and example program will help you.

[unverbuggt]

But I'm thinking of adding a couple of custom snippets and hacks to the project (like the fixes folder). So If you found a solution, just post it here and I'll add it.

[joapuiib]

I'm trying to understand this, but my knowledge on encryption and generating passwords is very limited.

We need to find a way to derive a constant password from the start_time and end_time and the current time without telling the start and end time...

I don't get this. The students know the start_time and end_time, I just want to configure the plugin so it won't decrypt the content if outside that time range.

[joapuiib]

I've been able to modify the source code to implement this in an easy way.

Basically, I've added a <div id="mkdocs-encrypted-config"> with a dictionary of config options, which includes start_time and end_time. The dictionary is encrypted with the same key as the content page.

In the decryption process, I decrypt the config and I check if the current time is between that time range. If so, I let the page be decrypted.

The code is available at: https://github.com/joapuiib/mkdocs-encryptcontent-plugin/tree/feature/time-range

This doesn't provide any kind of security. It's easy to bypass with JS if you know the password of the page, but I think this is enough for me at the moment.

If anyone wants to try and improve it, any help is welcome.

@unverbuggt Do you want me to close the issue? I think this discussion could be held at Discussions if there's no plan to add a similar feature in the plugin.

[unverbuggt]

I tried to describe a way to form a password from a time range without exposing the start and stop time (only the duration), but as stated, the entropy we get from this is very low.

But if the time range is known to the user, then I'd suggest to modify the html template like this:

• Add one or two custom hidden input fields with start and stop time as inline html to the Markdown page. Follow the guide to Mix encrypted and normal content
• Modify the html template and set visibility of password field and button to false.
• Add custom Javascript to the html template and read the hidden input fields and change visibility if in range.

You may close the issue and start a discussion thread (I've just enabled it).