Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Working on a Zero-Knowledge Daily Journaling App

jumblejournal.org

Post reply on HN
Print view View original

81–90 of 112 posts

Re: Show HN: Working on a Zero-Knowledge Daily Journaling App

#82

Post by tony_codes »

jcutrell wrote: post #64

If I can offer some unsolicited feedback: - This space is very crowded - to consider this app, I need to know a differentiator much sooner. Is it the streak? Is it the zero-knowledge? What makes this different from the 20 other options? It seems like the value prop here is "this is a simple journal that tracks whether you wrote today or not, and that is zero knowledge." If there's more, it's missing from the marketin…

Thanks a lot, this is really useful feedback. I completely agree the landing page branding needs some work. I've recently done some workshops to get some clarity on target audience and will try to tighten this up.

Currently the app is light on features so indeed it does not differentiate well, but we will build out a retrospective flow which is unique and helps users find actionable insights from past entries, and explore their best ideas on specific topics over time.

Re: Show HN: Working on a Zero-Knowledge Daily Journaling App

#83

Post by tony_codes »

ICodeSometimes wrote: post #73

looks very slick! are you planning to do the typical SAAS route with this? or is it actually free forever?

It would go the SAAS route if enough people find it useful; if there are consistent users I can't afford to make it free forever unfortunately

Re: Show HN: Working on a Zero-Knowledge Daily Journaling App

#84

Post by tony_codes »

jrm4 wrote: post #55

What about this necessitates "on the internet?" Just do it offline, there's your zero-knowledge.

one benefit of online is privacy. I've talked to many people that really don't like having a physical journal laying around with personal information that a partner might read. But yeah, I get there are workaround to that problem and not everyone has this kind of privacy issue

Re: Show HN: Working on a Zero-Knowledge Daily Journaling App

#86

Post by tony_codes »

addandsubtract wrote: post #15

On desktop, I can only scroll the middle section of the site. If I hover anywhere on the side margin and try to scroll, nothing happens. (Firefox, macOS)

just deployed a fix for this; if you see this and happen to check let me know if it's better :)

Re: Show HN: Working on a Zero-Knowledge Daily Journaling App

#87

Post by tony_codes »

anned20 wrote: post #71
addandsubtract wrote: post #15

On desktop, I can only scroll the middle section of the site. If I hover anywhere on the side margin and try to scroll, nothing happens. (Firefox, macOS)

Came here to say this, it really messed with my mind for a second. I'm using Brave on macOS, so it's not browser related.

just deployed a fix for this; if you see this and happen to check let me know if it's better :)

Re: Show HN: Working on a Zero-Knowledge Daily Journaling App

#88

Post by tony_codes »

Semaphor wrote: post #51

For the love of anything, please stop messing with the scrollbar. Not only (as two others mentioned) does scrolling only work on part of the screen, it also moves at a completely different speed than what I have set up, and hides the scrollbar. Browser can scroll and handle scrolling well. Let them do it.

Sorry for that; I'm a backend engineer; still learning some of the frontend best practices. I just deployed a fix for this; if you see this and happen to check let me know if it's better :)

Re: Show HN: Working on a Zero-Knowledge Daily Journaling App

#90

Post by tony_codes »

ThePhysicist wrote: post #31
tony_codes wrote: post #22

Earlier quoted context omitted.

yes agree, thanks! The white paper is here https://docs.google.com/document/d/1T0SEj5WrymfyzNDD8rNGKQ2O... need to add to landing page

SHA-256 is not suited to derive key material from weak input data, you should use PBKDF2 or another key derivation function for that. The authentication method also seems pretty wonky, that's not how to do zero-knowledge password verification, you should look at methods like PAKE for that. As usual, just don't roll your own crypto if you don't know what you're doing.

Thanks for the feedback! The hash is actually used to derive an actual key using PBKDF2 -- the library used is https://cryptojs.gitbook.io/docs/

Also, I'm interested if you see an attack vector on the authentication method. One thing to note is that even if an attacker can authenticate successfully they still have no access to the user private data without brute forcing the master password.

Post reply on HN