Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data

sebsauvage.net

Post reply on HN
Print view View original

31–40 of 75 posts

Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data

#31

Post by kcima »

chubot wrote: post #26
kcima wrote: post #18

The genius of this is the realization that browsers do not send the named anchor (technically "fragment identifier"[1]) to the server. Using the named anchor as the cryptographic key enables users to pass around simple URLs to encrypted data. Data is stored on the server, but the server never has access to the complete URL with the key, so it cannot decrypt it. As others have pointed out, this doesn't protect the dat…

Interesting... but bafflingly, doesn't the URL shortener service they provide totally defeat this? http://snipurl.com/230jiso They allow you to shorten the URL by using another service. But now snipurl.com has your URL fragment and can read your stuff!

True, but this isn't where you are going to store your credit card information. My guess is that this is a defense against those who want to control the Internet through legislation.

Imagine a world where SOPA had passed, and everyone who ran a website was legally responsible for everything that their users did.

In that scenario, one way for website operators to protect themselves is to make it impossible to know what their users are doing.

The 3rd party URL shorting service is not storing or associated with the encrypted data and is also not responsible for it.

So this may not be about private data so much as it is about protecting the freedom of information.

Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data

#32

Post by eiji »

Phrases like "Kittens will die if you abuse this service" make me uncomfortable. Just replace it with "Privacy & Terms comming soon".

I continue to read unprofessional things like that in the startup environment. I'd say leave the humor to your customers. Just my opinion. People always talk about "scaling". A phrase like that does not.

Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data

#33

Post by marshray »

ComputerGuru wrote: post #27
chubot wrote: post #26

Earlier quoted context omitted.

Interesting... but bafflingly, doesn't the URL shortener service they provide totally defeat this? http://snipurl.com/230jiso They allow you to shorten the URL by using another service. But now snipurl.com has your URL fragment and can read your stuff!

No, because the goal isn't to protect the user's data from being "leaked", it's to protect the user from the hosting site (zerobin) being forced to take down their posts.

So what happens when Zerobin or SnipURL is ordered to take down "all posts from the same client IP address as the post with the shortened URL of ..."?

Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data

#34

Post by muyuu »

Jach wrote: post #25
johtso wrote: post #11

It's not really true that (due to the data being encrypted client side) your data is safe even if someone were to gain control of the server. It's something often claimed by these "Host Proof" style services. As long as you are downloading the client side code from the server, someone just needs to make a small change to the javascript and they get access to your data. Only if you can trust the code, and then make ce…

It's a pedantic note, but I agree they should clarify on their project page that in the event of server compromise only your past data is secure and only if no one accesses past data post-compromise. As usual, encrypt offline with your own unshared private key if you really want it to stay private. I agree with the comment at the top though that the primary utility is the legal predicament it presents.

Computers with dotjs or greasemonkey could also sneakily get your stuff, being all the compromising code invisible in network traffic and even inspecting the page source. Something to consider if using an untrusted computer (and not just keyloggers and the like).

Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data

#35

Post by dhx »

I don't see ZeroBin fulfilling any useful purpose for the following two reasons:

1) The encryption and decryption features do not provide data confidentiality to users because the encryption/decryption environment is not controlled by the end users. The host retains complete control over the algorithms used and the input and handling of keys and plaintext. Users would need to verify that the client-side environment is safe to use on every single page load.

2) The host will still be legally required to block access to encrypted messages once someone sends them a URL containing the key. Furthermore, the host will still be liable to produce log files identifying users. Extensive case law exists in multiple countries to support these two statements.

Similar comments were made in the HN discussion of CrypTweet[1].

[1] https://news.ycombinator.com/item?id=3611453

Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data

#37

Post by billpg »

ComputerGuru wrote: post #27
chubot wrote: post #26

Earlier quoted context omitted.

Interesting... but bafflingly, doesn't the URL shortener service they provide totally defeat this? http://snipurl.com/230jiso They allow you to shorten the URL by using another service. But now snipurl.com has your URL fragment and can read your stuff!

No, because the goal isn't to protect the user's data from being "leaked", it's to protect the user from the hosting site (zerobin) being forced to take down their posts.

Quoth the project page; "Admins can still remove a document upon injunction or infringement notice… but have no way to tell if the same document has been posted again."

Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data

#38

Post by a3_nm »

DanWaterworth wrote: post #36

"kittens will die if you abuse this service" means "we have no reasonable method to stop you abusing this service".

They probably have the same methods as any other pastebin: block IPs which send an unreasonable quantity of data.

Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data

#40

Post by kcima »

marshray wrote: post #33
ComputerGuru wrote: post #27

Earlier quoted context omitted.

No, because the goal isn't to protect the user's data from being "leaked", it's to protect the user from the hosting site (zerobin) being forced to take down their posts.

So what happens when Zerobin or SnipURL is ordered to take down "all posts from the same client IP address as the post with the shortened URL of ..."?

Don't log IPs? End user IP's are mostly dynamic anyway.
Post reply on HN