61–70 of 80 posts
Earlier quoted context omitted.
Thanks for the pointer! Zerobin (PrivateBin) seems a much better implementation.
Zerobin certainly is cool but for me the UI is really dated looking and in my opinion not at all minimalist. I have client side encryption coming to Burnernote very soon.
> On clicking the link and opening your note, it is deleted instantly and completely from our database. Gone forever. I worry about using such services when it comes to sending the note links over email or chat platforms, where the messaging platform may crawl the link and have the content destroyed before the human user has had a chance to see it. Has anyone encountered this on other secret sharing platforms? Using…
Problem resolved :-)
Nice gigamick. This has a problem though, when you paste that link in a chat window (e.g. WhatsApp, Telegram, Discord, ...), the app tries to get a link preview. This has the side effect of also expiring the note. I think it's best to implement a feature to detect whether it's a human opening the link or a bot.
Earlier quoted context omitted.
> what guarantee do we have that the source code matches the deployed code? What is the answer to this question in general? Genuinely asking, I never considered this but it seems like a real concern for any OSS.
I don't know that there is an answer, but I'd think the FAQ should at least mention the concern.
DO NOT USE THIS SITE: 1. Create Note with the contents alert(1); 2. Go to link 3. this site is a massive security flaw.
Very cool, but the FAQ doesn’t address the questions people will ask: open source is fine, but what guarantee do we have that the source code matches the deployed code? Or that the deployment is done in a secure environment?
You have to implement the encryption logic client side. But then now the client has to verify the JavaScript they receive upon visiting the URL matches what is published in the open repository. I’m not sure what convenient method exists to do this for the client. You’d have to compare hashes and idk how that could be done in a easy and trustworthy manor.
Earlier quoted context omitted.
Update: As far as I can tell, this is the encryption encrypoint[1]. It does seem to be vulnerable to a padding oracle attack, unless the `$request->note` parameter is something much more complicated than it appears to be (i.e., it appears to be the plaintext). It's always great to see people experiment with encryption (and burn-after-use schemes are very cool!) but, absent of further information, I think it's activel…
Another update: it looks like it uses Laravel's encryption API under the hood, which does indeed perform encrypt-then-MAC[1]. So this is probably not vulnerable to a padding oracle attack. But that wasn't obvious from the description, and it gave me a decent fright :-) [1]: https://laravel.com/docs/8.x/encryption#encrypting-a-value
Very zeitgeisty :), I've created something similar a while ago ( https://tmp.page ), the idea was to have expiring web pages, with a nice API. Our FEs are quite similar, yours is nicer tough :).