ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data • Hacker News Board

Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data

#71

Post by finnh » Sat, Apr 14, 2012, 6:29 PM UTC

Interesting. This is similar to an idea I've had for a privacy-sensitive version of Facebook ("Faceless"?) that uses public key encryption at the client to prevent the servers from being able to read anything posted.

When you post new content to your friend list, your client uses your private key & your friends' public keys to post a separate encrypted copy of the content for each friend. Thus only they (and you) can read the content.

Note before people point out all the flaws in this idea =)... I'm aware that this would have problems on the key management side of things, plus one-encrypted-post-per-friend would get computationally (and bandwidth) intensive as your friend list (or "circle") increased in size. I'm also not convinced people actually want this - Facebook has made it abundantly clear that most people don't care about online privacy.

I would use it, though!

Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data

#72

Post by ygjb » Sun, Apr 15, 2012, 7:57 AM UTC

strictfp wrote: post #64

kcima wrote: post #31

Earlier quoted context omitted.

True, but this isn't where you are going to store your credit card information. My guess is that this is a defense against those who want to control the Internet through legislation. Imagine a world where SOPA had passed, and everyone who ran a website was legally responsible for everything that their users did. In that scenario, one way for website operators to protect themselves is to make it impossible to know wha…

You can't hack the law. All the legislators have to do is to make it mandatory for the site owners to be able to search through site contents.

It would be pretty easy to build a tool to route around that type of law. I create a service that encrypts blobs of data (encryptmyblo.bs), and uses a (publicly defined somewhere) postMessage API to communicate that blob to and from a key value store provided by a third party. I have my friend set up a key value store service provider that stores and retrieves blobs (storemyblo.bs), including the facility to search for stored blobs of data based on binary strings.

Because the services exchange those KVPs via a postMessage API, neither service is actually communicating with one another directly or have a formal association. The user is effectively (via the browser) moving the data from one service to another. Since EncryptMyBlo.bs doesn't store any data, and StoreMyBlo.bs doesn't have visibility into the data, neither service would be in violation of those requirements.

Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data

#73

Post by strictfp » Sun, Apr 15, 2012, 11:05 AM UTC

ygjb wrote: post #72

strictfp wrote: post #64

Earlier quoted context omitted.

You can't hack the law. All the legislators have to do is to make it mandatory for the site owners to be able to search through site contents.

It would be pretty easy to build a tool to route around that type of law. I create a service that encrypts blobs of data (encryptmyblo.bs), and uses a (publicly defined somewhere) postMessage API to communicate that blob to and from a key value store provided by a third party. I have my friend set up a key value store service provider that stores and retrieves blobs (storemyblo.bs), including the facility to search f…

It would also be pretty easy to make encryption illegal.

Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data

#74

Post by toomuchtodo » Tue, Apr 17, 2012, 11:24 PM UTC

dexen wrote: post #69

toomuchtodo wrote: post #56

Earlier quoted context omitted.

And run the entire server out of memory. 64GB of ram is cheap on servers now; you boot from a write-protected flash drive, and everything is done in memory. If you power the box down, anything stored in ram is lost.

> If you power the box down, anything stored in ram is lost. That's the theory of ideal RAM, but in practice RAM is not ideally volatile. Cf.: http://en.wikipedia.org/wiki/Cold_boot_attack

I believe that in almost all cases, the LEO tasked with seizing equipment in an operation are going to be ill-equipped to execute this attack. Now, if its the CIA or NSA after you, you have other problems.

Re: ZeroBin, opensource Pastebin where the server has zero knowledge of pasted data

#75

Post by bincat » Sun, Apr 22, 2012, 7:14 PM UTC

projectmeshnet wrote: post #70

bincat wrote: post #66

Earlier quoted context omitted.

But ezcrypt.it's source doesn't seem to be released, which would be nice.

It will be up shortly. https://github.com/novaking/ezcrypt

Hi, I've noticed that ezcrypt has started out started out on github but hasn't gotten past the first readme. Can anything be done to help it be fully published?