Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Etebase – An open source and end-to-end encrypted Firebase alternative

etebase.com

Post reply on HN
Print view View original

21–30 of 82 posts

Re: Show HN: Etebase – An open source and end-to-end encrypted Firebase alternative

#21

Post by tasn »

mnahkies wrote: post #17
tasn wrote: post #4

Earlier quoted context omitted.

Thanks. :) As said in the other comment, our mission is to encrypt everything, and this is the next step towards that! It's actually something that we've been planning since forever, but it's so nice to finally have it out!

Looks like an awesome product. Is the item metadata encrypted as well, or just the content? Do you have any documentation explaining the encryption process in detail?

Everything is encrypted. We are working on a full spec, it's not yet complete, but some of it is already there: https://docs.etebase.com/protocol-specs/introduction

We hope to get all of it done in the few days. Fingers crossed. :)

Re: Show HN: Etebase – An open source and end-to-end encrypted Firebase alternative

#24

Post by alexh1 »

LoSboccacc wrote: post #22

interesting how can user share data with each other?

I see in another comment that users have a key pair generated for them. What you can do is fetch other users public keys and encrypt data to them, or better yet, generate a symmetric key for a project and encrypt that to trusted users.

It's how we did it for Portabella (https://portabella.io) anyway but that's not based on Etebase/Etesync, just another e2ee tool

Re: Show HN: Etebase – An open source and end-to-end encrypted Firebase alternative

#25

Post by tasn »

ignoramous wrote: post #23

This looks great and has a very comprehensive set of libraries. Nice bit of competition for https://userbase.com/ (though their focus is mostly "Serverless" and the Web).

Thanks!

As for userbase: I think our and their scopes are very different. They are more of an easy way to store data that happens to use some encryption, not a comprehensive end-to-end encryption toolkit. They don't do sharing, integrity management, data de-duplication, and lot of other things that are needed for more serious applications. In addition, they don't have libraries for anything other than JS.

Re: Show HN: Etebase – An open source and end-to-end encrypted Firebase alternative

#26

Post by tasn »

LoSboccacc wrote: post #22

interesting how can user share data with each other?

As said in a sibling comment, we currently use public-key encryption and verifying keys. However, we plan on adding support for SPAKE2+ (like e.g. Magic wormhole) among other methods, to make it even easier!

See the relevant section of the docs: https://docs.etebase.com/guides/collection_sharing

Re: Show HN: Etebase – An open source and end-to-end encrypted Firebase alternative

#27

Post by tasn »

alexh1 wrote: post #24
LoSboccacc wrote: post #22

interesting how can user share data with each other?

I see in another comment that users have a key pair generated for them. What you can do is fetch other users public keys and encrypt data to them, or better yet, generate a symmetric key for a project and encrypt that to trusted users. It's how we did it for Portabella ( https://portabella.io ) anyway but that's not based on Etebase/Etesync, just another e2ee tool

Always great to see more end-to-end encrypted applications!

Looks very cool, I'd love to chat if you are willing, my email is tom @ etebase, could you please drop me a line?

Re: Show HN: Etebase – An open source and end-to-end encrypted Firebase alternative

#28

Post by tasn »

fabrice_d wrote: post #20
tasn wrote: post #18

Earlier quoted context omitted.

We are working on providing a formal spec, but the gist of it is already documented here: https://docs.etebase.com/protocol-specs/authentication A secure encryption key is derived from the user's password using a random salt an Argon2id, though the data is encrypted with a randomly generated key. Keys are generated for each "layer" of the account (so one for the account, one for collections, and etc), so each part ca…

What about switching devices? Is the password enough (I guess not since it's salted)?

The salt is kept on the server, so you can just fetch it again when switching devices.

However, on the long term, we plan on considering passwords more of a backup feature, and instead move to a model where you just authorise your devices from running devices (though can always fallback to passwords).

Re: Show HN: Etebase – An open source and end-to-end encrypted Firebase alternative

#30

Post by tasn »

TruthWillHurt wrote: post #29

How is a self-hosted database suppose to be an alternative to a cloud hosted managed service?

You don't have to self-host Etebase, you can also use the hosted version on etebase.com if you wish. However, what we are offering here is an alternative to the Firebase APIs, rather than the fact that it's cloud hosted.
Post reply on HN