[deleted]
ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data
21–30 of 75 posts
Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data
#22I'd like to see some improvements like making the ciphertext directly readable (and writeable) so that we can copy and paste the text into (and out of) true client-side decryption that doesn't rely on code served from the same server. This is one of those cases where it's highly secure in theory, but in practice may not be secure if the server is compromised.
Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data
#23This is so ingenious that it baffles me how no one thought of it before.
Needs an alternative way of unlocking. A short link and then a passphrase generating key.
Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data
#24It's not really true that (due to the data being encrypted client side) your data is safe even if someone were to gain control of the server. It's something often claimed by these "Host Proof" style services. As long as you are downloading the client side code from the server, someone just needs to make a small change to the javascript and they get access to your data. Only if you can trust the code, and then make ce…
Would browser-hosted JS solve the problem?
Not if the HTML hosting any of the JS is under attacker control.
Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data
#25It's not really true that (due to the data being encrypted client side) your data is safe even if someone were to gain control of the server. It's something often claimed by these "Host Proof" style services. As long as you are downloading the client side code from the server, someone just needs to make a small change to the javascript and they get access to your data. Only if you can trust the code, and then make ce…
It's a pedantic note, but I agree they should clarify on their project page that in the event of server compromise only your past data is secure and only if no one accesses past data post-compromise. As usual, encrypt offline with your own unshared private key if you really want it to stay private. I agree with the comment at the top though that the primary utility is the legal predicament it presents.
Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data
#26The genius of this is the realization that browsers do not send the named anchor (technically "fragment identifier"[1]) to the server. Using the named anchor as the cryptographic key enables users to pass around simple URLs to encrypted data. Data is stored on the server, but the server never has access to the complete URL with the key, so it cannot decrypt it. As others have pointed out, this doesn't protect the dat…
Interesting... but bafflingly, doesn't the URL shortener service they provide totally defeat this?
They allow you to shorten the URL by using another service. But now snipurl.com has your URL fragment and can read your stuff!
Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data
#27The genius of this is the realization that browsers do not send the named anchor (technically "fragment identifier"[1]) to the server. Using the named anchor as the cryptographic key enables users to pass around simple URLs to encrypted data. Data is stored on the server, but the server never has access to the complete URL with the key, so it cannot decrypt it. As others have pointed out, this doesn't protect the dat…
Interesting... but bafflingly, doesn't the URL shortener service they provide totally defeat this? http://snipurl.com/230jiso They allow you to shorten the URL by using another service. But now snipurl.com has your URL fragment and can read your stuff!
No, because the goal isn't to protect the user's data from being "leaked", it's to protect the user from the hosting site (zerobin) being forced to take down their posts.
Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data
#28The problem is always that we have to TRUST the server's claims about all this. I think the web should be enhanced with httpc http://news.ycombinator.com/item?id=2024164
You could save a local copy of the html and javascript to make sure you're using the same code every time. You'd probably have to make a few tiny changes (absolute/relative URLs, etc), though.
Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data
#29So, the same thing as https://ezcrypt.it/ ?
Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data
#30The problem is always that we have to TRUST the server's claims about all this. I think the web should be enhanced with httpc http://news.ycombinator.com/item?id=2024164
You could save a local copy of the html and javascript to make sure you're using the same code every time. You'd probably have to make a few tiny changes (absolute/relative URLs, etc), though.
Or you could just use PGP.