Live data from Hacker News

Show HN: Flashpaper – Self-destructing secret sharing with no database

flashpaper.app

11–18 of 18 posts

Re: Show HN: Flashpaper – Self-destructing secret sharing with no database

#11

How does this compare with other pastebins like privatebin? https://privatebin.info/

Good comparison! PrivateBin is great.

Basically, same browser encryption idea with two differences. They store encrypted data on the server's disk until expiry (which can be longer than Flashpaper) while Flashpaper is RAM-only, information nerver reach disk and burn at read or 24 hr max .

and Flashpaper has the AI agent side (API/MCP, claim-once dead-drop)

Re: Show HN: Flashpaper – Self-destructing secret sharing with no database

#13
See the problem with generating apps like this is that you have no idea what secret sharing even is and it's pretty clear you didn't even bother to research anything. This has so many holes, and secret sharing schemes NEVER send the secret over the network. The secret is the encryption key, not the payload itself, you're conflating the two. You have to send the payload, but you negotiate a secret, not send one in plaintext. And yes, you're sending the password in plaintext, as far as snoopability goes. Don't roll your own crypto. So if you ever use this to send an api key, you should still invalidate the key and change it afterwards. If you don't want to.... well it's your own money on the line.

edit: That's also not what zero knowledge means

Re: Show HN: Flashpaper – Self-destructing secret sharing with no database

#14
post #7

It’s worth thinking through threat assessment and security posture carefully at the design and production phase. First, I’ll say that it’s cool you’re working on security stuff! It’s a hard discipline, but interesting. Next I’ll say that this needs work. Here’s what you have right now: 1. Data is encrypted in browser and sent to the server. (I didn’t check who makes this key, let’s assume it is a fair and safely crea…

[dead]

Re: Show HN: Flashpaper – Self-destructing secret sharing with no database

#15
post #7

It’s worth thinking through threat assessment and security posture carefully at the design and production phase. First, I’ll say that it’s cool you’re working on security stuff! It’s a hard discipline, but interesting. Next I’ll say that this needs work. Here’s what you have right now: 1. Data is encrypted in browser and sent to the server. (I didn’t check who makes this key, let’s assume it is a fair and safely crea…

sorry for late reply. I actually replied but it was flag spammed; i think. Already try to reply again but it is still killed. Just emailed the mod.

Overall, really appreciate your inputs. will look at what u recommend. !

Re: Show HN: Flashpaper – Self-destructing secret sharing with no database

#16

See the problem with generating apps like this is that you have no idea what secret sharing even is and it's pretty clear you didn't even bother to research anything. This has so many holes, and secret sharing schemes NEVER send the secret over the network. The secret is the encryption key, not the payload itself, you're conflating the two. You have to send the payload, but you negotiate a secret, not send one in pla…

[dead]

Re: Show HN: Flashpaper – Self-destructing secret sharing with no database

#18
post #12

Neat! I made one of these also: https://flashpaper.me

We think of the same name ! LOL

I took the name from an internal tool at Slack where I worked. Similar concept, not sure if theirs encrypted in-browser. I notice your URL format stores the secret after a # which won't be logged on the server side, good work there.
Post reply on HN