41–50 of 80 posts
DO NOT USE THIS SITE: 1. Create Note with the contents alert(1); 2. Go to link 3. this site is a massive security flaw.
To clarify, why is being able to display an alert a massive security flaw in this context?
First of all, this is a cool idea. I always love to see something private and encrypted. But I found some concerns and ideas about your project (and I think you may can fix these): 0. This has XSS vulnerability. If attacker writes down this memo: do_the_evil_things() and passes to people, they might be unknowingly attacked(get tracked by attacker their IP/Browser fingerprint, mine cryptocurrencies for attacker, etc..…
Edit: I spent some time thinking about it and might as well document it here if someone finds it interesting. For context, my application does client side encryption with keys stored only in the browser. The catastrophic case would be if the frontend application is modified to extract those keys. That's why I don't necessarily trust a hosted option (which typically needs control of the SSL certificate as well). Instead I would like to serve the client from a server under my control.
One solution is to use Github Actions and have it automatically deploy via ssh. This doesn't really increase my attack surface, since the code is already at Github anyway. So if this platform is compromised / warranted they could modify my application to their liking.
A second solution would be to use any CI service and restrict the capabilities of the ssh key in the `authorized_keys` to only trigger a fixed command without actually being able to log in. The command would pull the code / image and deploy. This way a compromised key could only be used to trigger a new deployment of authentic code, not inject malicious code.
Impact: Someone reads a private note on a shared computer, how long will it remain visible in history?
Browser: Chrome 95
Earlier quoted context omitted.
To clarify, why is being able to display an alert a massive security flaw in this context?
It's not the ability to display alerts that is concerning, but rather, the ability to run untrusted Javascript. This was a proof of concept that showed that it has a serious XSS vulnerability
Very cool, but the FAQ doesn’t address the questions people will ask: open source is fine, but what guarantee do we have that the source code matches the deployed code? Or that the deployment is done in a secure environment?
> what guarantee do we have that the source code matches the deployed code? What is the answer to this question in general? Genuinely asking, I never considered this but it seems like a real concern for any OSS.
Earlier quoted context omitted.
For an app that exists solely on the client it’s easy to provide a md5 hash that can be verified. This was and still is a popular solution if you torrent to make sure you’re getting what the original seeder intended. The same philosophy applies here. For back end apps it’s inherently not possible.
Please do not use md5 in 2021. At least use something like sha256.
> On clicking the link and opening your note, it is deleted instantly and completely from our database. Gone forever. I worry about using such services when it comes to sending the note links over email or chat platforms, where the messaging platform may crawl the link and have the content destroyed before the human user has had a chance to see it. Has anyone encountered this on other secret sharing platforms? Using…
> However [alternatives'] pages are laden with ads, have a poor UI, and you can't know for sure if they really are actually encrypting / deleting anything.
There has been a private zero-knowledge pastebin for years: zerobin, forked into privatebin now (https://zerobin.net/). In fact the original is almost 10-years old but hasn't displayed a single ad, has been open source the whole time, has had time to iron out a lot of bugs and has a better UX than this: it doesn't need cookies to work.
In terms of security, zerobin encrypts/decrypts everything in the browser. The server has no knowledge of the content. In contrast, burnernote receives the content _and_ the password in cleartext and encrypts/hashes them.
Unfortunately, as long as there's a server you will have to trust it. In both cases you have to rely on something other than code and HTTPS to know if your content actually remains private or not
DO NOT USE THIS SITE: 1. Create Note with the contents alert(1); 2. Go to link 3. this site is a massive security flaw.