I wonder how feasible it would be to add a plugin to the Evernote application to tie in with GnuPG through gpgme.
Evernote doesn't really care about security
21–30 of 64 posts
Re: Evernote doesn't really care about security
#22Mark, it would be helpful if you would disclose if you are a paying customer or not, and if not if having additional security options would convert you into a paying customer.
The reasoning is pretty simple, people want security but they don't want to pay for it. And while we can debate the argument as to whether or not security is part of a MVP or not, I would not be offended if there were additional security capabilities to paid users but not free users.
Re: Evernote doesn't really care about security
#23What're the alternatives to Evernote? e.g. decent document tagging, excellent search and preferably OCR.
Google drive
Re: Evernote doesn't really care about security
#24Mark, it would be helpful if you would disclose if you are a paying customer or not, and if not if having additional security options would convert you into a paying customer. The reasoning is pretty simple, people want security but they don't want to pay for it. And while we can debate the argument as to whether or not security is part of a MVP or not, I would not be offended if there were additional security capabi…
Fuck your logic; Facebook is free, then why the hell do you expect it to be secure? Because any service whether free or not, that has YOUR personal information is supposed to keep it secure. And your (possibly dumbfuck) argument that paying customers should get more security than free users is like saying it's ok to kill people who have no insurance for themselves, but not ok to kill the ones who have taken insurance.
Re: Evernote doesn't really care about security
#25What're the alternatives to Evernote? e.g. decent document tagging, excellent search and preferably OCR.
Google drive
Google Drive/Docs has surprisingly poor search capabilities compared to the native Evernote client. Almost everything about Docs is sluggish and clunky compared to Evernote's lightweight simplicity.
Re: Evernote doesn't really care about security
#26Mark, it would be helpful if you would disclose if you are a paying customer or not, and if not if having additional security options would convert you into a paying customer. The reasoning is pretty simple, people want security but they don't want to pay for it. And while we can debate the argument as to whether or not security is part of a MVP or not, I would not be offended if there were additional security capabi…
Fuck your logic; Facebook is free, then why the hell do you expect it to be secure? Because any service whether free or not, that has YOUR personal information is supposed to keep it secure. And your (possibly dumbfuck) argument that paying customers should get more security than free users is like saying it's ok to kill people who have no insurance for themselves, but not ok to kill the ones who have taken insurance…
Are you angry about this?
Re: Evernote doesn't really care about security
#27Is there a way to download your Evernote data? Not to say that I find this an opportunity to bash Evernote, but I am terribly disappointed that a service that advertised you to keep really personal stuff, even your tax info on their servers just got hacked.
I think I'm going back to creating .txt files on my desktop which no one else has access to (physcially and programatically), which despite having no encryption or whatsoever is still secure than having them on a third party server that could get hacked like this, because they advertise one thing and do exactly the opposite.
Re: Evernote doesn't really care about security
#28Earlier quoted context omitted.
"For Evernote's consumer product, the current encryption algorithms are chosen more for exportability under the Commerce Department rather than strength, since our software permits the encryption of arbitrary user data with no escrow." I guess Evernote's been around for a while, but wasn't it way back in 2010 that the BIS allowed simple self service registration and annual self classification of almost all "mass mark…
Addressing US regs doesn't necessarily mean you are compliant with assorted international regs. Crypto, export, and service availability can be tricky things.
International regulations are pretty insane. For example, France requires you to submit your software to them for review that's supposed to take up to 2 weeks. This isn't just for product releases, it includes everything, including patches.
Apple, MS and Google can get away with it because they have large legal teams that help them with all the various rules and regulations. For smaller companies, it's simply too massive to bother taking more than an off-the-shelf solution.
Re: Evernote doesn't really care about security
#29"If you encrypt text within a note, we derive a 64-bit RC2 key from your passphrase and use this to encrypt the text. This is the longest symmetric key length permitted by US Export restrictions without going through a complex process to gain export approval."
Is this still true? Weren't US cryptography export restrictions relaxed in 2000? (See e.g. http://www.rsa.com/rsalabs/node.asp?id=2327)
Re: Evernote doesn't really care about security
#30Mark, it would be helpful if you would disclose if you are a paying customer or not, and if not if having additional security options would convert you into a paying customer. The reasoning is pretty simple, people want security but they don't want to pay for it. And while we can debate the argument as to whether or not security is part of a MVP or not, I would not be offended if there were additional security capabi…
I think this could work for some things but definitely not others. You're riding a razor-thin line between security (essential) and convenience/peace-of-mind (not terribly essential), with potential ethical implications.
"Authenticate with your voice using our voice recognizer app," for example, could be pretty superfluous, since it's about convenience.
"Keep your password safe by not storing it in plaintext" should definitely be part of the core offering, no matter the price point.
"Use our app through a custom VPN" could be offered for pay, since offering that service costs the provider something.
"Use our app through SSL -- paying customers only!" should again be a core product, especially since it does not cost anything extra.
"Pay us 5¢ and we won't share your internal data with advertisors" etc etc -- you can certainly see where this is going