ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data
1–10 of 75 posts
Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data
#2Interesting project. If you're the developer - I would like to see the ability to view the encrypted message without viewing the page source.
Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data
#3I'm not sure that is true. If the link automatically decrypts the paste then you could use server logs to get the plaintext of the document.
Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data
#4I'm not sure how this is any different than a pastebin service over https. The data is encrypted in teh browser meaning that someone won't be able to snoop (if that's a concern for some reason) but there is nothing stopping the server admins from seeing your data as long as the server is storing the encrypted data and the decryption keys. Am I missing something?
Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data
#5I'm not sure how this is any different than a pastebin service over https. The data is encrypted in teh browser meaning that someone won't be able to snoop (if that's a concern for some reason) but there is nothing stopping the server admins from seeing your data as long as the server is storing the encrypted data and the decryption keys. Am I missing something?
you are missing something, read their project page which states:
"The key is never transmitted to the server, which therefore cannot decrypt data."
but it does seem like the resulting queries could be stored in the servers logs, as the key needs to be part of the request? edit: no it doesn't, I needed to read more :) the key is the anchor part of the URL. neat!
Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data
#6I'm not sure that is true. If the link automatically decrypts the paste then you could use server logs to get the plaintext of the document.
From my understanding, the link contains 2 parts -- paste ID, and decryption key _following_ a "#". Assuming the latter isn't going into the server logs (I believe the fragment identifier isn't sent in headers at all, unless there's JS on the page to tell the server about it), the actual decryption seems to be taking place via javascript (as well as the encryption to begin with), and therefore the encryption key has no reason to be sent to the server at any point.
Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data
#7Interesting. I'll still stick with KDE paste for their api, but seems promising
Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data
#8I'm not sure that is true. If the link automatically decrypts the paste then you could use server logs to get the plaintext of the document.
see: http://sebsauvage.net/wiki/doku.php?id=php:zerobin
the "pasting" and "opening" sections cover this
Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data
#9The problem is always that we have to TRUST the server's claims about all this. I think the web should be enhanced with httpc
Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data
#10I'm not sure how this is any different than a pastebin service over https. The data is encrypted in teh browser meaning that someone won't be able to snoop (if that's a concern for some reason) but there is nothing stopping the server admins from seeing your data as long as the server is storing the encrypted data and the decryption keys. Am I missing something?
The server doesn't store the decryption keys. However, the server does serve the crypto code which makes any perceived security boundary between the server and client bogus.
Cool trick though.