Live data from Hacker News

Laverna – Store your notes anonymously and encrypted

laverna.cc

21–30 of 40 posts

Re: Laverna – Store your notes anonymously and encrypted

#23
post #12

"Laverna is webapp written on JavaScript which means it requires no installation and no registration." "None of us can get access to your personal data because we are using IndexedDB and localStorage. In fact all your information will be stored only on client side." So does this mean that clearing cookies in Chrome will delete all your information?

In other words, it's about as secure as a mailbox.

Re: Laverna – Store your notes anonymously and encrypted

#24

I've been looking for a replacement for Evernote for a while. So far I've tried wikis, bluenote, vim + git + markdown. The most important feature keeping me with Evernote is the ability to drag and drop images.

You might like the open source Zim: http://zim-wiki.org/ It's completely replaced Evernote for me. You can drag and drop images from a browser or the file system.

That looks like a Tomboy clone? Interesting..

Re: Laverna – Store your notes anonymously and encrypted

#25
post #15

I've been looking for a self hosted open source version of Evernote. I was excited when I first saw this but this isn't it. Storing all data locally defeats half the purpose. You can't even create notes on your phone and view them on your PC. Add to that, this seems to be only for text notes, which makes sense, since localStorage has a data limit of about 2MB.

For an offline file based evernote alternative, take a look on http://tagspaces.org

Re: Laverna – Store your notes anonymously and encrypted

#27
post #15

I've been looking for a self hosted open source version of Evernote. I was excited when I first saw this but this isn't it. Storing all data locally defeats half the purpose. You can't even create notes on your phone and view them on your PC. Add to that, this seems to be only for text notes, which makes sense, since localStorage has a data limit of about 2MB.

Try https://turtl.it

It offers a hosted option (the default) or an open-source server you can run internally if you want more control of your data (or don't want to pay). Disclosure: I'm building it.

Note that Turtl uses IndexedDB to store everything (encrypted) locally, but also syncs to the server. This means if you wipe your local storage, your profile will be re-downloaded back to the client (only un-synced changes will be lost).

Mobile versions are on the way.

Re: Laverna – Store your notes anonymously and encrypted

#28
The web is not a secure medium for this kind of application.*

This is because all the encryption features they tout depend implicitly on content (HTML and JavaScript) the server sends you every time you use the application. Because you receive this content anew on every usage, there's no way to verify what you're getting. Today it might be fine, but tomorrow it might contain a key logger or subtle cryptographic flaws.

You also can't depend on the community for help verifying this content, because it can be distributed selectively. The mass of users might get benign content while interesting targets get backdoored software.

* It might be safe to distribute something like this as an installable sandboxed web application. I'm actually not 100% certain. But the no-install-just-browse-to-this-url model is definitely insecure.

Re: Laverna – Store your notes anonymously and encrypted

#29
post #12

"Laverna is webapp written on JavaScript which means it requires no installation and no registration." "None of us can get access to your personal data because we are using IndexedDB and localStorage. In fact all your information will be stored only on client side." So does this mean that clearing cookies in Chrome will delete all your information?

I believe so although I do see Dropbox support in their settings so I'm guessing you can have your data sent to your own Dropbox for more long-term storage.

Re: Laverna – Store your notes anonymously and encrypted

#30
post #28

The web is not a secure medium for this kind of application.* This is because all the encryption features they tout depend implicitly on content (HTML and JavaScript) the server sends you every time you use the application. Because you receive this content anew on every usage, there's no way to verify what you're getting. Today it might be fine, but tomorrow it might contain a key logger or subtle cryptographic flaws…

The best way is a browser extension, but even that has its pitfalls (firefox especially since there's no real sandboxing).

It's never a good idea to do crypto over a website.

Post reply on HN