61–70 of 75 posts
I’m more interested in how you handle the encryption keys. Specifically, how does a user share a document with another? You mentioned that the “share group” has its own private key; where is this stored?
Earlier quoted context omitted.
Hey there - this doesn't sound good (and definitely not our intention). We ported over some contacts here and there from different marketing migrations, but always made sure to hide out any unsubs or things like that. I just looked in our DB for the email address in your HN profile and I'm not seeing it anywhere, so I'm assuming it's a different email address. Ironically, could you email me the email address to patri…
It was probably my school email (which still works). Either way, the emails stopped in 2016. So no worries, it’s not worth looking into, but I sincerely appreciate your responding. Good luck with the business. (Porting contacts between lists seems dangerous btw. IANAL but pretty sure subscribing to one list does not count as opting-in to another.)
On that front we automatically just don't touch any of the unsubs for the new system, so was worried that was messed up. Doesn't look like it though. Not a lawyer either, but from my understanding it's the same list even if you change marketing automation/email products. GDPR is making this fun, too. :)
Is anyone else seeing this? It needs a bit more polish before I could use it for encrypted collaborative editing.
Like others, I also like the novel service workers solution (mitigation might be more accurate) to client side code integrity. I’m more interested in how you handle the encryption keys. Specifically, how does a user share a document with another? You mentioned that the “share group” has its own private key; where is this stored?
I just tried using this app with one of my friends and I found that editing in real time between two people wasn't working as intended. When someone else wrote text, the text I wrote (in a separate paragraph) would disappear. Is anyone else seeing this? It needs a bit more polish before I could use it for encrypted collaborative editing.
Earlier quoted context omitted.
- When you create a collaboration link, it contains an encryption key. (You can additionally also set a password.) All messages sent to the server by collaborators are then encrypted with those. The collaboration algorithm is currently quite simple, and paragraphs are locked when editing them. In the future we'd like to use a P2P algorithm, e.g. using Y.js. [1] - When you sign up, the page downloads a file on your PC…
It is clever that you put the encryption key after the hash sign ("#") component of the collaboration URL, so it never touches your servers.
Earlier quoted context omitted.
It is clever that you put the encryption key after the hash sign ("#") component of the collaboration URL, so it never touches your servers.
Don't trust it as a security measure though - it's very easy to read the hash data in JS and then submit it to the server.
Like others, I also like the novel service workers solution (mitigation might be more accurate) to client side code integrity. I’m more interested in how you handle the encryption keys. Specifically, how does a user share a document with another? You mentioned that the “share group” has its own private key; where is this stored?
The encryption key is in the share link, and also stored encrypted in all collaborating users' accounts (if they have one - an account is not required to collaborate).
It’s pretty clever, I like it. Definitely not the holy grail of client side browser-based multiparty encryption, but you’ve found some innovative techniques. Bravo, good luck with it.
Earlier quoted context omitted.
The encryption key is in the share link, and also stored encrypted in all collaborating users' accounts (if they have one - an account is not required to collaborate).
So the user is responsible for securely transmitting the share URL? i.e. Secrets are shared out-of-band? It’s pretty clever, I like it. Definitely not the holy grail of client side browser-based multiparty encryption, but you’ve found some innovative techniques. Bravo, good luck with it.