Is there a open source alternative to this? Something I could deploy on my own server?
Airborn: Create and edit files online, securely
71–75 of 75 posts
Re: Airborn: Create and edit files online, securely
#72Earlier quoted context omitted.
Very true. You probably still need to trust that the developers' Github accounts aren't compromised. I was looking at their repo[0] for this Service Worker verification, and their "So what's the problem this solves?" section confuses me, as it doesn't explain the how. :/ [0] https://github.com/airbornio/signed-web-apps
While a hacker gaining access to the developers' GitHub account would be bad, they would still have to actually push the malicious code to GitHub before they can serve it from airborn.io. So, if people pay attention to pushes to GitHub, this attack could still be detected (but not prevented). For prevention, one possibility would be to require all commits to have been on GitHub for at least 24h or so. Then, the devs…
This is pretty revolutionary. Servers sending bad code is one of the biggest set-backs to JS crypto being useful.
Re: Airborn: Create and edit files online, securely
#73Earlier quoted context omitted.
> When you lose your password, we send you your password recovery key and you can decrypt your password with it. Having the password recovery keys, can you decrypt user passwords? Does that matter in this scenario?
No, because the password encrypted with the password recovery key is never sent to the server. It's encrypted and downloaded entirely on the client.
then, if i format the pc or my hd breaks I can't do anything?
Re: Airborn: Create and edit files online, securely
#74Earlier quoted context omitted.
That's because the Web is not secure in precisely that way. But how would you know an app developer wasn't compromised and signed the next version with a backdoor also?
The Service Worker doesn't simply check a signature from the developer, it checks the source code against the version on GitHub. So, to know whether it contains a backdoor, read the code on GitHub.
It's similar to the keybase.io identity model (using popular services as defacto authories). It might be overkill but it could be nice to supplement that with a check of the repo mirrored on e.g. Bitbucket and Gitlab.
Re: Airborn: Create and edit files online, securely
#75Earlier quoted context omitted.
The Service Worker doesn't simply check a signature from the developer, it checks the source code against the version on GitHub. So, to know whether it contains a backdoor, read the code on GitHub.
It's similar to the keybase.io identity model (using popular services as defacto authories). It might be overkill but it could be nice to supplement that with a check of the repo mirrored on e.g. Bitbucket and Gitlab.
Yes, definitely. GitLab's API is very similar to GitHub's, except that it doesn't support CORS. If that's fixed it should be pretty simple to add support for GitLab.