Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: I made a free, ad-free and open source tool for sharing private notes

burnernote.com

Post reply on HN
Print view View original

11–20 of 80 posts

Re: Show HN: I made a free, ad-free and open source tool for sharing private notes

#11

Post by woodruffw »

woodruffw wrote: post #9

AES-CBC for quick and dirty encryption can be a red flag: the scheme needs to include an encrypt-then-MAC phase or it'll be vulnerable to padding oracle attacks. I tried to do a quick scan of the code[1] to determine whether it does that, but I couldn't locate it, possibly because my PHP comprehension is terrible. [1]: https://github.com/GigaMick/burnernote

Update: As far as I can tell, this is the encryption encrypoint[1]. It does seem to be vulnerable to a padding oracle attack, unless the `$request->note` parameter is something much more complicated than it appears to be (i.e., it appears to be the plaintext).

It's always great to see people experiment with encryption (and burn-after-use schemes are very cool!) but, absent of further information, I think it's actively dangerous to encourage people to use this.

Edit: It might also be a stretch to call this a "burn-after-use" scheme: there's no affirmative proof of a note's destruction on the server side. It seems to just update the database to mark the note as empty and deleted[2].

[1]: https://github.com/GigaMick/burnernote/blob/6c01eddfc5195b15...

[2]: https://github.com/GigaMick/burnernote/blob/6c01eddfc5195b15...

Re: Show HN: I made a free, ad-free and open source tool for sharing private notes

#12

Post by AnonC »

> On clicking the link and opening your note, it is deleted instantly and completely from our database. Gone forever.

I worry about using such services when it comes to sending the note links over email or chat platforms, where the messaging platform may crawl the link and have the content destroyed before the human user has had a chance to see it. Has anyone encountered this on other secret sharing platforms? Using a password that’s not part of the link would prevent from that happening, but I see that it’s optional in this solution.

Re: Show HN: I made a free, ad-free and open source tool for sharing private notes

#14

Post by woodruffw »

woodruffw wrote: post #11
woodruffw wrote: post #9

AES-CBC for quick and dirty encryption can be a red flag: the scheme needs to include an encrypt-then-MAC phase or it'll be vulnerable to padding oracle attacks. I tried to do a quick scan of the code[1] to determine whether it does that, but I couldn't locate it, possibly because my PHP comprehension is terrible. [1]: https://github.com/GigaMick/burnernote

Update: As far as I can tell, this is the encryption encrypoint[1]. It does seem to be vulnerable to a padding oracle attack, unless the `$request->note` parameter is something much more complicated than it appears to be (i.e., it appears to be the plaintext). It's always great to see people experiment with encryption (and burn-after-use schemes are very cool!) but, absent of further information, I think it's activel…

Another update: it looks like it uses Laravel's encryption API under the hood, which does indeed perform encrypt-then-MAC[1]. So this is probably not vulnerable to a padding oracle attack. But that wasn't obvious from the description, and it gave me a decent fright :-)

[1]: https://laravel.com/docs/8.x/encryption#encrypting-a-value

Re: Show HN: I made a free, ad-free and open source tool for sharing private notes

#15

Post by rntksi »

Nice gigamick.

This has a problem though, when you paste that link in a chat window (e.g. WhatsApp, Telegram, Discord, ...), the app tries to get a link preview.

This has the side effect of also expiring the note.

I think it's best to implement a feature to detect whether it's a human opening the link or a bot.

Re: Show HN: I made a free, ad-free and open source tool for sharing private notes

#16

Post by [deleted] »

mmh0000 wrote: post #6

FYI if I post 1MB of data it explodes and dumps a full stack trace. May not be something you want exposed. SQLSTATE[22001]: String data, right truncated: 1406 Data too long for column 'note' at row 1 (SQL: insert into `notes` (`note`, `password`, `user_id`, `token`, `updated_at`, `created_at`) values ...SNIP...

[deleted]

Re: Show HN: I made a free, ad-free and open source tool for sharing private notes

#18

Post by snerbles »

rntksi wrote: post #15

Nice gigamick. This has a problem though, when you paste that link in a chat window (e.g. WhatsApp, Telegram, Discord, ...), the app tries to get a link preview. This has the side effect of also expiring the note. I think it's best to implement a feature to detect whether it's a human opening the link or a bot.

Can confirm this happens with Matrix/Element.

Amusingly, the brief contents of the note are visible in the preview along with "This note has now been permanently deleted".

Post reply on HN