Evernote doesn't really care about security
markpercival.us
Evernote doesn't really care about security
1–10 of 64 posts
Re: Evernote doesn't really care about security
#2I thought SSL was enabled on Evernote for all customers now? Maybe its time to consider not using Evernote.
Re: Evernote doesn't really care about security
#3While I love Evernote as much as anyone on hacker news, Mark does make very good points about the state of security within the application. It seems that with respect to today's security breach that the company has done quite well with their response. One can only hope that this focuses their development on addressing these topics (i.e. encryption of notes is a joke) as much as it has raised concerns about the security features they offer.
Re: Evernote doesn't really care about security
#4I thought SSL was enabled on Evernote for all customers now? Maybe its time to consider not using Evernote.
As stated in the post, "they fixed this some time ago, but..." -- As in, it used to be a premium feature, and while that has changed, it may still say a lot about their priorities.
Re: Evernote doesn't really care about security
#5The RC2 thing from the disclosure is really, really weird. It makes Evernote the only app built in the last 10 years that I am aware of to build on RC2. I wonder whether it's a mistake, and they're actually using RC4 with truncated keys or something.
Re: Evernote doesn't really care about security
#6[deleted]
Re: Evernote doesn't really care about security
#7[deleted]
Re: Evernote doesn't really care about security
#8The RC2 thing from the disclosure is really, really weird. It makes Evernote the only app built in the last 10 years that I am aware of to build on RC2. I wonder whether it's a mistake, and they're actually using RC4 with truncated keys or something.
Confirmed here too.
https://support.evernote.com/link/portal/16051/16058/Article...
Re: Evernote doesn't really care about security
#9Only half the points are valid. SSL is a selling point, because it takes a lot of work to setup completely. Lots of websites (including high-profile ones like Outlook.com) have mixed content errors at one place or another, or appear to but don't fully support SSL. The fact that they "used to" use it as a selling point says enough too.
SSL signin should not be enforced. HTTP should give a big warning, but SSL is not fully supported in all clients.
Re: Evernote doesn't really care about security
#10> Give it a shot. Send someone a link to the non-SSL sign in and it won’t flip them over to SSL. It will also accept your credentials via non-SSL POST. So fire up SSLStrip and head down to your local coffee shop.
If you are in a position to execute a MITM, it doesn't matter whether they flip people to HTTPS or not. If the site forced HTTPS you could still rewrite the redirect and proxy the HTTPS to HTTP (the secure connection being between your proxy server and Evernote's). Only strict transport security would solve this, if the browser supports it and the user has accessed evernote before.