61–70 of 151 posts
Great explanation of end-to-end encryption, followed by "but we're too lazy to do that." Not going to ever touch Supernotes now.
If you knew how hard it was to write E2EE you would be more respectful of others honesty.
I read the article but I'm not sure what the objective was in the end. It seem a way to lengthy education course on E2EE. Almost like you're trying to convince someone of something you think they don't need. That usually ends badly in my experience.
But if any of our users feel like they need E2EE for their notes, we'd like to steer them towards a platform better suited because that's not our priority. We've typically done the same thing when small businesses come our way and ask if Supernotes would be a good fit for their team: we tell them the team use-case is not our priority at the moment, so if that is a priority for them they would probably be better served by a shared workspace tool like Notion.
> In the end, trust is Still Required™ This entire section is FUD. Trust is "Still Required™" - unfortunately HN doesn't support underlines so I can't get accross the full obnoxiousness of the original formatting - therefore having your data in someone elses database is no worse then using an app that someone might add a backdoor to?
One other major downside of end-to-end encryption: everything has to be done client-side, and the server becomes very close to a dumb pipe and block storage. (The only parts the server can do anything with are those that aren’t encrypted, so the explicit goal of E2EE is to reduce the server to a dumb pipe and block storage.) Got ten gigabytes of stuff you want to search through? Without E2EE, the server can implement…
This kind of pendulum like, tick-tocking back and forth between things like fat clients/thin-clients, dumb termials/PCs, centralized vs. decentralized (well, cloud-based [i.e., someone else's computer]) applications, and so on, are part-and-parcel of computing that goes as far back as possible. This is just another "tock" in that cycle.
Technology happens in leaps and bounds and not at all uniformly, so this is a natural result. I personally am for the best of both worlds in whatever makes the most sense, but definitely skew towards privacy, security, and user-authority.
Great explanation of end-to-end encryption, followed by "but we're too lazy to do that." Not going to ever touch Supernotes now.
Author here! If you 100% need E2EE for your notes then not using Supernotes is actually our recommendation as well. But as I tried to show in the post, it's hard to do and arguably even harder to prove that it has been done correctly. And E2EE not done correctly might as well not be done at all. And yep, partly it is that don't have the time to dedicate to this. There are so many other features that I think would bet…
Earlier quoted context omitted.
I don't think touting no E2EE is going to get you more users. Fine, don't do it, but I'm pretty sure the people who want E2EE (myself included) are likely very convinced it's what they need and will act accordingly. And those who don't care for E2EE won't care whether you offer it or not. Irrecoverable data loss is a real pain in the ass that needs to be dealt with but it's the only way to achieve true privacy. Knowi…
Implementing E2EE encryption safely is difficult. If it's not your core competenancy, should you really expect them to do that? If you don't know what you're asking for. If you're not a paying customer and you are not willing to buy the product, what causes you to think they'll do what you think they should do on arbitrary principles (that you might still not buy the product even if they implemented it) rather than p…
People tend to exchange and discuss ideas on HN and this is no different.
I did not enjoy the attitude displayed in this article. Yes, notes, often containing the most sensitive material of our lives should be encrypted at every stage of the lifecycle.
Standard Notes is a note taking app that provides end-to-end encryption: https://standardnotes.com/
Looking for a replacement that handles write-write conflicts better.
> Our team will never read or access your note content, unless we have received your express permission during a customer support interaction Either naive or dishonest. Can't tell which is worse. The reason end to end encryption exists is to cover the cases which you can't plan for. For example a rogue employee reading the notes of their partner.
Or for that matter someone who isn't an employee at all. Unless they're claiming they have figured out absolutely perfect security such that they can never be hacked or compromised. Or isn't an employee/manager right now , because the thing about companies is that they tend to grow and die, management changes over time, they get bought, etc. That's the human condition, we don't live forever. Really it's just a LUDICR…
Exactly. The perception I have is that when you subscribe to a non-E2EE service, you're not subscribing to a service. You're actually placing a small bet on the service to: always keep all serverside components up-to-date, proactively monitor for vulnerabilities, proactively implement security controls at the company and technology level, always hire the absolute best engineers, etc.
The problem is that every startup and every company always starts like this. Everyone has the best of intentions. Then the tech debt accumulates, the VC funding dries up, and time goes on. When the service is going to shut down, after being acquired, after being sold, or after being successful, will the serverside security still be perfect?
You have two options: don't store anything sensitive in these services, or assume perfection. I definitely won't bet on the latter.