Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data

sebsauvage.net

Post reply on HN
Print view View original

61–70 of 75 posts

Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data

#61

Post by sukuriant »

Hm. I ran this with Fiddler running; and I saw exactly what they claimed. I received a cypher text and the client rendered it.

More importantly, I noticed another query before it: GET /qsml.aspx?query=http%3A%2F%2Fsebsauvage.net%2Fpaste%2F%3F9f9ee11adc3a2093%2312WGK1zDE5Nqpz8mwVa%2BA%2BQQ8%2F12zJqHb5935uRvWdw

Bing was searching for my link on the internet in case it wasn't a URL. Knowing this, couldn't someone demand Google give them someone's search history to sebsauvage.net; and, if whole URIs are returned, the anchor tag will also be provided?

This doesn't seem completely private. The webserver may not know what's in your text; but your search providers will; or will have the knowledge to be able to.

Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data

#62

Post by andrewcooke »

would there be any use for a "n of m" version? you'd somehow generate m urls, and any n of them would allow you to recover the secret. i guess instead of urls they would be separate parameters, but otherwise it should be doable, right? can't think of any uses, though...

Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data

#63

Post by emily37 »

andrewcooke wrote: post #62

would there be any use for a "n of m" version? you'd somehow generate m urls, and any n of them would allow you to recover the secret. i guess instead of urls they would be separate parameters, but otherwise it should be doable, right? can't think of any uses, though...

This would be easy to implement via a secret sharing scheme, where shares of the secret are maybe stored in local storage until enough of them are collected in the browser to recover the encryption key. But I can't really think of a compelling use case either.

Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data

#64

Post by strictfp »

kcima wrote: post #31
chubot wrote: post #26

Earlier quoted context omitted.

Interesting... but bafflingly, doesn't the URL shortener service they provide totally defeat this? http://snipurl.com/230jiso They allow you to shorten the URL by using another service. But now snipurl.com has your URL fragment and can read your stuff!

True, but this isn't where you are going to store your credit card information. My guess is that this is a defense against those who want to control the Internet through legislation. Imagine a world where SOPA had passed, and everyone who ran a website was legally responsible for everything that their users did. In that scenario, one way for website operators to protect themselves is to make it impossible to know wha…

You can't hack the law. All the legislators have to do is to make it mandatory for the site owners to be able to search through site contents.

Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data

#66

Post by bincat »

projectmeshnet wrote: post #60

So it's basicly https://ezcrypt.it/ with longer urls, a url shortener which breaks any measure of confidentiality, a less polished UI (which is kind of sad since it is basicly a rip anyway), and broken SSL, which, for all it's faults, will still help to protect the integrity of the javascript which is critical to the security. yaaaaawn

But ezcrypt.it's source doesn't seem to be released, which would be nice.

Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data

#67

Post by Natsu »

kcima wrote: post #18

The genius of this is the realization that browsers do not send the named anchor (technically "fragment identifier"[1]) to the server. Using the named anchor as the cryptographic key enables users to pass around simple URLs to encrypted data. Data is stored on the server, but the server never has access to the complete URL with the key, so it cannot decrypt it. As others have pointed out, this doesn't protect the dat…

> It appears the purpose of this is to reduce the liability of whoever is running the server. Perfect for magnet links and such.

PasteBin itself is a DMCA notice magnet already for some very litigious people, as I know from having read through more public DMCA notices than most people would bother reading through. So if you're worried about legal liability, consult a lawyer to make sure that your technical solution would actually help you in court.

There's something called "willful blindness" that you might want to understand if you plan to run a PasteBin clone where people could be expected to post magnet links to pirate content. You could also do worse than to have a lawyer explain your DMCA obligations to you, too. If people start posting pirated stuff to your site, you're going to want to be very clear about them, lest you find out that you technically don't have DMCA safe harbor because you flubbed one of the requirements.

Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data

#69

Post by dexen »

toomuchtodo wrote: post #56
kcima wrote: post #40

Earlier quoted context omitted.

Don't log IPs? End user IP's are mostly dynamic anyway.

And run the entire server out of memory. 64GB of ram is cheap on servers now; you boot from a write-protected flash drive, and everything is done in memory. If you power the box down, anything stored in ram is lost.

> If you power the box down, anything stored in ram is lost.

That's the theory of ideal RAM, but in practice RAM is not ideally volatile. Cf.: http://en.wikipedia.org/wiki/Cold_boot_attack

Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data

#70

Post by projectmeshnet »

bincat wrote: post #66
projectmeshnet wrote: post #60

So it's basicly https://ezcrypt.it/ with longer urls, a url shortener which breaks any measure of confidentiality, a less polished UI (which is kind of sad since it is basicly a rip anyway), and broken SSL, which, for all it's faults, will still help to protect the integrity of the javascript which is critical to the security. yaaaaawn

But ezcrypt.it's source doesn't seem to be released, which would be nice.

It will be up shortly. https://github.com/novaking/ezcrypt
Post reply on HN