Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Working on a Zero-Knowledge Daily Journaling App

jumblejournal.org

Post reply on HN
Print view View original

101–110 of 112 posts

Re: Show HN: Working on a Zero-Knowledge Daily Journaling App

#101

Post by tony_codes »

jrm4 wrote: post #98
tony_codes wrote: post #84

Earlier quoted context omitted.

one benefit of online is privacy. I've talked to many people that really don't like having a physical journal laying around with personal information that a partner might read. But yeah, I get there are workaround to that problem and not everyone has this kind of privacy issue

No. No it is not. I'm sorry, this is just objectively wrong, and I don't mean to pick on you personally, but I do think it needs to be said. Without online, it's in the hands of ONE party. Online, it's in the hands of that same party and at least one more. Objectively less private.

You are right, I get what you are saying. But I guess I'm speaking more from a user perspective. Some people have told me they can't write down private things in a physical journal; as someone they are living with can easily pick it up and read it. In theory, a digital copy can be secured with more confidence than a physical copy ... for example by encrypting things with a key that you're confident only you have access to. I think I should have said that one benefit of "digital" is the potential for increased security ... online is clearly not the case.

Re: Show HN: Working on a Zero-Knowledge Daily Journaling App

#102

Post by tony_codes »

jrm4 wrote: post #98
tony_codes wrote: post #84

Earlier quoted context omitted.

one benefit of online is privacy. I've talked to many people that really don't like having a physical journal laying around with personal information that a partner might read. But yeah, I get there are workaround to that problem and not everyone has this kind of privacy issue

No. No it is not. I'm sorry, this is just objectively wrong, and I don't mean to pick on you personally, but I do think it needs to be said. Without online, it's in the hands of ONE party. Online, it's in the hands of that same party and at least one more. Objectively less private.

and it's completely ok, I love hacker news because it's one of the more honest places on the internet.

Re: Show HN: Working on a Zero-Knowledge Daily Journaling App

#103

Post by tony_codes »

JohnFen wrote: post #96
tony_codes wrote: post #84

Earlier quoted context omitted.

one benefit of online is privacy. I've talked to many people that really don't like having a physical journal laying around with personal information that a partner might read. But yeah, I get there are workaround to that problem and not everyone has this kind of privacy issue

"Privacy" and "online" don't go well together, though. Talking about "zero-knowledge" doesn't really address the issue, because there is no way of knowing if the author is being honest, or if they've implemented it correctly.

Maybe zero-knowledge should be open sourced, built from source by users as a desktop app (so they can lock to a version), and each version should be stamped (hash of specific version signed) by trusted 3rd party penetration testing agency -- it does limit the reach of the product though

Re: Show HN: Working on a Zero-Knowledge Daily Journaling App

#104

Post by JohnFen »

tony_codes wrote: post #103
JohnFen wrote: post #96

Earlier quoted context omitted.

"Privacy" and "online" don't go well together, though. Talking about "zero-knowledge" doesn't really address the issue, because there is no way of knowing if the author is being honest, or if they've implemented it correctly.

Maybe zero-knowledge should be open sourced, built from source by users as a desktop app (so they can lock to a version), and each version should be stamped (hash of specific version signed) by trusted 3rd party penetration testing agency -- it does limit the reach of the product though

It's a tough problem. An application like this is all about convenience. Having to vet the source and build it yourself brings a lot of inconvenience.

It's probably just an issue of the right target market. People like me aren't it, but people who are less concerned about such things may very well be. A zero-knowledge implementation is still a great idea to protect them, even if they don't really appreciate the protection they're getting.

By the way, I realize my comments have been critical, so let me say the other side: good work! I wish you all the success in the world. Building and releasing something is a major accomplishment, and anything you make won't be right for everyone. That's not a fault with your product. That's just the fact that different people have different needs.

Re: Show HN: Working on a Zero-Knowledge Daily Journaling App

#105

Post by baby »

tony_codes wrote: post #100
baby wrote: post #99

Earlier quoted context omitted.

But zero knowledge cryptography has nothing to do with that. Sorry I was a bit harsh, I guess I got tripped by the misuse there.

it's ok, it's hacker news so I expected honesty which I appreciate. But What would you call an authentication mechanism which never passes the decryption key off the browser? It's an improvement over systems that handle the keys themselves on the server side.

I'm not sure, I would call that encrypted storage perhaps? Or client-side encryption

Re: Show HN: Working on a Zero-Knowledge Daily Journaling App

#106

Post by tony_codes »

JohnFen wrote: post #104
tony_codes wrote: post #103

Earlier quoted context omitted.

Maybe zero-knowledge should be open sourced, built from source by users as a desktop app (so they can lock to a version), and each version should be stamped (hash of specific version signed) by trusted 3rd party penetration testing agency -- it does limit the reach of the product though

It's a tough problem. An application like this is all about convenience. Having to vet the source and build it yourself brings a lot of inconvenience. It's probably just an issue of the right target market. People like me aren't it, but people who are less concerned about such things may very well be. A zero-knowledge implementation is still a great idea to protect them, even if they don't really appreciate the prote…

Thanks a lot for the encouragement; but also I really appreciate the honest feedback, it wouldn't be hacker news if people stopped being honest, it's why we all love the conversations here.

I agree the primary appeal (and thus market) of this app is not technical, but of course it's still important that the technical aspects are vetted and secure.

Re: Show HN: Working on a Zero-Knowledge Daily Journaling App

#107

Post by tony_codes »

baby wrote: post #105
tony_codes wrote: post #100

Earlier quoted context omitted.

it's ok, it's hacker news so I expected honesty which I appreciate. But What would you call an authentication mechanism which never passes the decryption key off the browser? It's an improvement over systems that handle the keys themselves on the server side.

I'm not sure, I would call that encrypted storage perhaps? Or client-side encryption

yeah, perhaps client-side encryption or User encryption ownership or something along those lines. To me, "encrypted storage" doesn't sound like anything different that what is done with normal authentication methods.
Post reply on HN