Earlier quoted context omitted.
> Yeah. It's called a web server and it's been around for ages, try it out some time come on, now.
What?
[deleted]
Should notes be end-to-end encrypted?
41–50 of 151 posts
Re: Should notes be end-to-end encrypted?
#42Co-founder of Supernotes, Tobias, here! I thought I'd try to tackle some of most common questions in one go.
To start Supernotes is very different from many other note-taking apps – we are focusing on the social aspect of sharing knowledge with your friends via markdown notecards [1], rather than local-first note-taking apps of which there are many to choose from if that is what you prefer. As a small team of two, trying to do both ease-of-sharing and end-to-end encryption (E2EE) right is a mammoth task, so we wanted to do one right, the social side of things.
E2EE has become a buzzword for marketing for the last few years, but what's most concerning is how misunderstood it is. That's one of the main reasons why we decided to publish this article as we regularly received support interactions from customers mis-understanding encryption, with some asking whether we have "end-to-end encryption in transit" and "two factor encryption".
This article is here to help the average (less tech savvy than HN) user better understand how encryption works so they can make a more informed choice whether Supernotes is right for them. We are not saying there are no reasons to use end-to-end encryption — there are a lot and other people have explained the obvious benefits quite well! The question is whether the increased effort and friction are worth it for your use case.
If you want to quickly jot down and share your recipes, restaurant recommendations and startup ideas with your friends then Supernotes is for you. If you'd like to write down passwords, trade secrets, or your deepest darkest desires then we suggest using an alternative.
Re: Should notes be end-to-end encrypted?
#43Earlier quoted context omitted.
> One other major downside of end-to-end encryption: everything has to be done client-side, and the server becomes very close to a dumb pipe and block storage. That sounds like a feature...
It tries to be, but in practice as I say you mostly just end up with the worst of both worlds, because of perverse incentives (the software provider wants to charge a monthly figure and doesn’t want their server to be fungible). Anyway, it’s still much more commonly a limitation than an advantage. Perhaps the most obvious example: I want to be able to search through 10GB of emails without needing to download them all…
I know I'm biased because I'm working on an E2EE todo/planning app[1], but over the years I've become convinced that E2EE apps are the future.
All the syncing code you have to write anyway if you want your app to work offline. Despite all the buzz about big data, most individuals and most companies generate only a modest amount of data. Even when you have a long tail of archived data (e.g. emails that go back 10 years) the key benefit is in having all recent data with you, available offline, and end-to-end encrypted.
Self-hosting is a lot more difficult in practice than in theory. Somebody has to make backups, maintain a server architecture with redundancy, apply security patches, etc. For hobby purposes you can get away with just not doing any of that, but for businesses and people who don't want to tinker with their own servers outsourcing all this makes a ton of sense.
I don't agree with your claims that traffic is expensive. In any case, downloading data once and syncing subsequent deltas is still a lot more data efficient than roundtripping JSON for every user action.
Re: Should notes be end-to-end encrypted?
#44> Should Your Notes Be End-to-End Encrypted? Yes. That's why I use Joplin (which is free and open source btw) and not some proprietary freemium app that to explains me that I don't necessary need E2E encryption for my notes.
Do you have something that allows you to publish that as well? Use case - I want to keep some notes for myself e2e on my laptop & phone but every now and then I'd like to publish a few of them under a pseudonym anonymously on the internet.
Hit the Share button in Joplin and select your blogging app of choice.
Note-taking and publishing are different enough to deserve being separate apps, especially when the notes can contain private material.
Re: Should notes be end-to-end encrypted?
#45Pretty sure this is a clickbait ad
Re: Should notes be end-to-end encrypted?
#46Co-founder of Supernotes, Tobias, here! I thought I'd try to tackle some of most common questions in one go. To start Supernotes is very different from many other note-taking apps – we are focusing on the social aspect of sharing knowledge with your friends via markdown notecards [1], rather than local-first note-taking apps of which there are many to choose from if that is what you prefer. As a small team of two, tr…
I'm not sure that social sharing of knowledge is what I want from a "notes" app. That sounds more like a text-based social media app.
Re: Should notes be end-to-end encrypted?
#47> > Our team will never read or access your note content, unless we have received your express permission during a customer support interaction What a relief! I'd take it at their word then, trusting random employees at a random corporation, in a world where even police officers routinely get caught snooping at private data unrelated to their work (e.g. girlfriends and such). /s
At this point, why even trust random corporation when they claim to be doing end to end encryption with some proprietary client?
Re: Should notes be end-to-end encrypted?
#48Great explanation of end-to-end encryption, followed by "but we're too lazy to do that." Not going to ever touch Supernotes now.
Author here! If you 100% need E2EE for your notes then not using Supernotes is actually our recommendation as well. But as I tried to show in the post, it's hard to do and arguably even harder to prove that it has been done correctly. And E2EE not done correctly might as well not be done at all. And yep, partly it is that don't have the time to dedicate to this. There are so many other features that I think would bet…
I don't think touting no E2EE is going to get you more users. Fine, don't do it, but I'm pretty sure the people who want E2EE (myself included) are likely very convinced it's what they need and will act accordingly. And those who don't care for E2EE won't care whether you offer it or not.
Irrecoverable data loss is a real pain in the ass that needs to be dealt with but it's the only way to achieve true privacy. Knowing you can't decrypt my data whether by your own will or coerced by your government (which may or may not care about privacy now or in the future) or at the whim of a North Korean hacker, keeps my mind at ease. Why on earth would I give that up? Google has Keep, Apple has Notes, they do a pretty decent job as far as basic notes app go. Sorry if this sounds like putting you down, I'm sure you put a great deal of work into your app and you seem passionate about it and I'm sure it's great. But because the table stakes in the notes games are high, you need to go above and beyond what your competitors offer. Not just great UX, but pushing _every_ boundary in the space, including by offering privacy. I feel like in 2022, privacy is non-negotiable. Make it optional if you feel you must, or don't, but don't suggest skipping E2EE is in any way a virtue.
Re: Should notes be end-to-end encrypted?
#49Pretty sure this is a clickbait ad
An ad maybe, it's clearly written by a company that has a note keeping app and they mention their app a few times.
But I don't see how this is clickbait. The title asks if your notes should be encrypted, and the article does a pretty good job at explaining different kinds of encryption, what the company uses and why, seems like the opposite of clickbait to me.
Re: Should notes be end-to-end encrypted?
#50Earlier quoted context omitted.
Google Photos whole premise is that they analyze, categorize, scan, and classify the photos for you. They find similar faces, put your photos on the Maps timeline, etc. If you don't want Google to do that, there's no point in using Google Photos. The entire benefit disappears.
How about the ease of use and storage?
I'm sure ease of use would decrease if they introduce E2EE