DO NOT USE THIS SITE: 1. Create Note with the contents alert(1); 2. Go to link 3. this site is a massive security flaw.
This is exactly why I posted here. Thank you so much for this feedback. Will fix and let you know.
Show HN: I made a free, ad-free and open source tool for sharing private notes
31–40 of 80 posts
Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#32First of all, this is a cool idea. I always love to see something private and encrypted. But I found some concerns and ideas about your project (and I think you may can fix these): 0. This has XSS vulnerability. If attacker writes down this memo: do_the_evil_things() and passes to people, they might be unknowingly attacked(get tracked by attacker their IP/Browser fingerprint, mine cryptocurrencies for attacker, etc..…
This is good! As I said in another post, the reason I posted this here was to get feedback and improve. All of these points are excellent and I will address them and get back to you.
Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#33FYI if I post 1MB of data it explodes and dumps a full stack trace. May not be something you want exposed. SQLSTATE[22001]: String data, right truncated: 1406 Data too long for column 'note' at row 1 (SQL: insert into `notes` (`note`, `password`, `user_id`, `token`, `updated_at`, `created_at`) values ...SNIP...
Amazing feedback - which is exactly my reason for posting here. I'll address and get back to you.
Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#34> On clicking the link and opening your note, it is deleted instantly and completely from our database. Gone forever. I worry about using such services when it comes to sending the note links over email or chat platforms, where the messaging platform may crawl the link and have the content destroyed before the human user has had a chance to see it. Has anyone encountered this on other secret sharing platforms? Using…
Great feedback. Thank you. TBH I have never seen this happen in all my years of using services like these but its defo a worthwhile consideration.
Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#35Nice gigamick. This has a problem though, when you paste that link in a chat window (e.g. WhatsApp, Telegram, Discord, ...), the app tries to get a link preview. This has the side effect of also expiring the note. I think it's best to implement a feature to detect whether it's a human opening the link or a bot.
Can confirm this happens with Matrix/Element. Amusingly, the brief contents of the note are visible in the preview along with "This note has now been permanently deleted".
haha ok this is something I will remedy. As stated in other replies, the reason for posting here was to get feedback and improve the product (I just put to together over the weekend there)
Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#36Very cool, but the FAQ doesn’t address the questions people will ask: open source is fine, but what guarantee do we have that the source code matches the deployed code? Or that the deployment is done in a secure environment?
> what guarantee do we have that the source code matches the deployed code? What is the answer to this question in general? Genuinely asking, I never considered this but it seems like a real concern for any OSS.
Yeah I wondered this myself and my colleagues at the day job and myself were kinda stumped. How does any OSS prove that the repo linked is what is actually deployed?
Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#37DO NOT USE THIS SITE: 1. Create Note with the contents alert(1); 2. Go to link 3. this site is a massive security flaw.
To clarify, why is being able to display an alert a massive security flaw in this context?
Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#38DO NOT USE THIS SITE: 1. Create Note with the contents alert(1); 2. Go to link 3. this site is a massive security flaw.
To clarify, why is being able to display an alert a massive security flaw in this context?
The alert itself is harmless, but demonstrates that arbitrary javascript - which could certainly not be harmless - can be injected into the page.
Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#39Very zeitgeisty :), I've created something similar a while ago (https://tmp.page), the idea was to have expiring web pages, with a nice API. Our FEs are quite similar, yours is nicer tough :).
Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#40First of all, this is a cool idea. I always love to see something private and encrypted. But I found some concerns and ideas about your project (and I think you may can fix these): 0. This has XSS vulnerability. If attacker writes down this memo: do_the_evil_things() and passes to people, they might be unknowingly attacked(get tracked by attacker their IP/Browser fingerprint, mine cryptocurrencies for attacker, etc..…
This is good! As I said in another post, the reason I posted this here was to get feedback and improve. All of these points are excellent and I will address them and get back to you.
If you would like to get into client side encryption, you could take a look here:
https://pilabor.com/blog/2021/05/js-gcm-encrypt-dotnet-decry...
Notes:
- This is symmetric encryption via AES-GCM, but asymmetric should work similar
- In-browser randomness (for key generation) is somewhat questionable, so try to read more about this topic
- This is meant as an intro to the topic - real security takes much more, like thinking about secure key storage, backup/recovery keys, etc.