Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Laverna – Store your notes anonymously and encrypted

laverna.cc

Post reply on HN
Print view View original

31–40 of 40 posts

Re: Laverna – Store your notes anonymously and encrypted

#31

Post by thinkling »

sdevlin wrote: post #28

The web is not a secure medium for this kind of application.* This is because all the encryption features they tout depend implicitly on content (HTML and JavaScript) the server sends you every time you use the application. Because you receive this content anew on every usage, there's no way to verify what you're getting. Today it might be fine, but tomorrow it might contain a key logger or subtle cryptographic flaws…

Yes, I think those risks can be eliminated with some elbow grease since there's no need to load this app off a live server.

Instead, one would download a specific version as a tarball with a verifiable checksum that indicates the source is equivalent to the version audited by the community on GitHub. The app is then loaded & run locally.

In addition, you could control network access if you wrap it in its own OS-native custom browser app and use a firewall that controls outgoing connections. (Like LittleSnitch on OS X.) That is, create a thin shell around WebKit uniquely for use with this web app, and control its network access.

(I think the two measures are redundant, but hey, if you're going to be paranoid...)

Re: Laverna – Store your notes anonymously and encrypted

#32

Post by sdevlin »

orthecreedence wrote: post #30
sdevlin wrote: post #28

The web is not a secure medium for this kind of application.* This is because all the encryption features they tout depend implicitly on content (HTML and JavaScript) the server sends you every time you use the application. Because you receive this content anew on every usage, there's no way to verify what you're getting. Today it might be fine, but tomorrow it might contain a key logger or subtle cryptographic flaws…

The best way is a browser extension, but even that has its pitfalls (firefox especially since there's no real sandboxing). It's never a good idea to do crypto over a website.

> The best way is a browser extension, but even that has its pitfalls (firefox especially since there's no real sandboxing).

I would be greatly interested if you could expand on some of the pitfalls of browser extensions and how they differ among browsers. Thanks in advance!

Re: Laverna – Store your notes anonymously and encrypted

#33

Post by orthecreedence »

sdevlin wrote: post #32
orthecreedence wrote: post #30

Earlier quoted context omitted.

The best way is a browser extension, but even that has its pitfalls (firefox especially since there's no real sandboxing). It's never a good idea to do crypto over a website.

> The best way is a browser extension, but even that has its pitfalls (firefox especially since there's no real sandboxing). I would be greatly interested if you could expand on some of the pitfalls of browser extensions and how they differ among browsers. Thanks in advance!

I think the general pitfalls of a browser extension is that you're essentially trusting that the browser, which is acting almost as an OS in terms of separating the memory contents of different extensions, to work correctly. The idea is if you have an extension doing crypto, an extension that is syncing data with google has no way of reading the data from the crypto extension. You also have to make sure the same applies for websites as well...extensions should be able to grab data from sites, but not vice versa. Without this kind of perfect separation, your crypto extension is really just a sitting duck and none of the data in it is safe.

As far as how they differ among browsers, Chrome (and I suppose Opera, now as well) does a good job sandboxing one extension from another, and from stopping websites gaining access to running extensions. Is it perfect? I can't really answer that.

One problem with Chrome extensions is that unless you want your users to have to download the .crx file, and drag and drop it into their browser, you have to use the Chrome webstore. This is especially retarded because in order to upload your extension to the Chrome webstore, they either need your private key you signed the extension with, or they generate a private key for you. This means that your private key is not private and extension signing is a complete joke. So if you're releasing an extension for the security-literate, it makes sense to create a .crx file, sign it yourself with your own PGP key, and offer it as a separate download that they have to drag+drop into Chrome. The chrome webstore is not a secure means of distribution.

Firefox, on the other hand, is more forgiving with installations but has no real sandboxing. This means it's possible for one extension to read another's data. Plans to introduce threading (and I think as a consequence of threading, sandboxing as well) are in the works, but it's still going to be a while until Firefox gives extensions the same protections Chrome does.

Really, if you can, it's best to do crypto in a native app where the sandboxing is done for you by the operating system and you don't have to rely on a browser. Node-webkit is a great way to do this since it merges the two worlds nicely (at least for desktop).

Re: Laverna – Store your notes anonymously and encrypted

#34

Post by sdevlin »

orthecreedence wrote: post #33
sdevlin wrote: post #32

Earlier quoted context omitted.

> The best way is a browser extension, but even that has its pitfalls (firefox especially since there's no real sandboxing). I would be greatly interested if you could expand on some of the pitfalls of browser extensions and how they differ among browsers. Thanks in advance!

I think the general pitfalls of a browser extension is that you're essentially trusting that the browser, which is acting almost as an OS in terms of separating the memory contents of different extensions, to work correctly. The idea is if you have an extension doing crypto, an extension that is syncing data with google has no way of reading the data from the crypto extension. You also have to make sure the same appl…

Thanks for the great reply!

I didn't realize the Chrome web store requires your private key. That's insane.

Re: Laverna – Store your notes anonymously and encrypted

#35

Post by adrusi »

orthecreedence wrote: post #27
adrusi wrote: post #15

I've been looking for a self hosted open source version of Evernote. I was excited when I first saw this but this isn't it. Storing all data locally defeats half the purpose. You can't even create notes on your phone and view them on your PC. Add to that, this seems to be only for text notes, which makes sense, since localStorage has a data limit of about 2MB.

Try https://turtl.it It offers a hosted option (the default) or an open-source server you can run internally if you want more control of your data (or don't want to pay). Disclosure: I'm building it. Note that Turtl uses IndexedDB to store everything (encrypted) locally, but also syncs to the server. This means if you wipe your local storage, your profile will be re-downloaded back to the client (only un-synced chang…

Looks interesting, I'll try using it for a week or so and see where it takes me.

Bit of advise however: The front page of the website doesn't really describe it very well. There's barely any screenshots (and the ones that exist are hidden for two thirds of the time), and there's not much of a description of the actual application. There's descriptions of what features it has over your competitors, but not really anything about what the core product is. Honestly, if I saw the website outside of the context of this comment thread, I probably would have passed it by.

All in all it looks like a good alternative to Google Keep which I can feel good about using. Best of luck!

Re: Laverna – Store your notes anonymously and encrypted

#36

Post by orthecreedence »

adrusi wrote: post #35
orthecreedence wrote: post #27

Earlier quoted context omitted.

Try https://turtl.it It offers a hosted option (the default) or an open-source server you can run internally if you want more control of your data (or don't want to pay). Disclosure: I'm building it. Note that Turtl uses IndexedDB to store everything (encrypted) locally, but also syncs to the server. This means if you wipe your local storage, your profile will be re-downloaded back to the client (only un-synced chang…

Looks interesting, I'll try using it for a week or so and see where it takes me. Bit of advise however: The front page of the website doesn't really describe it very well. There's barely any screenshots (and the ones that exist are hidden for two thirds of the time), and there's not much of a description of the actual application. There's descriptions of what features it has over your competitors, but not really anyt…

That's incredibly useful feedback. Thanks for taking the time to mention that.

I think one thing I'm definitely missing are use cases, which would help people understand that product better. I'll see what I can do about making the screenshots more obvious as well.

I've been toying with the idea of creating a demo with pre-populated content and letting people play around with it on the site. Would that be something you'd try out as a passerby who happened to land on the site?

Re: Laverna – Store your notes anonymously and encrypted

#38

Post by frabbit »

As regards replacing Evernote, there is already the very capable and stable Zotero[1], which provides source to roll your own server[2]. It integrates well with LibreOffice and LaTeX/BibTeX.

It does nothing to address the anonymous or secure aspects however.

1. https://www.zotero.org/ 2. https://www.zotero.org/support/dev/dataserver_setup

Re: Laverna – Store your notes anonymously and encrypted

#39

Post by adrusi »

orthecreedence wrote: post #36
adrusi wrote: post #35

Earlier quoted context omitted.

Looks interesting, I'll try using it for a week or so and see where it takes me. Bit of advise however: The front page of the website doesn't really describe it very well. There's barely any screenshots (and the ones that exist are hidden for two thirds of the time), and there's not much of a description of the actual application. There's descriptions of what features it has over your competitors, but not really anyt…

That's incredibly useful feedback. Thanks for taking the time to mention that. I think one thing I'm definitely missing are use cases, which would help people understand that product better. I'll see what I can do about making the screenshots more obvious as well. I've been toying with the idea of creating a demo with pre-populated content and letting people play around with it on the site. Would that be something yo…

I tend to treat such demos as nothing more than glorified screenshots. For example, Mailpile has a demo similar to what you described and I spent maybe 10 seconds in it clicking on a couple buttons. That said, I'm sure it is very useful to some other people. I'd recommend getting in touch with some of the Mailpile guys or anyone else who can relay their experiences about how useful it is.

Re: Laverna – Store your notes anonymously and encrypted

#40

Post by sciencerobot »

sasvari wrote: post #8
sciencerobot wrote: post #5

I've been looking for a replacement for Evernote for a while. So far I've tried wikis, bluenote, vim + git + markdown. The most important feature keeping me with Evernote is the ability to drag and drop images.

vim + git + markdown This, actually using vimwiki, is my setup for both my private knowledge management/kind of diary system and my lab notebook at work for quite some time now. Works flawlessly. See [0] for a pretty nice setup. Doesn't solve your image issue, but for text-only it's a pretty nice solution if you're comfortably living in vim anyway. [0] https://news.ycombinator.com/item?id=4822796

Thanks. I'm doing something similar with Gollum [0].

[0] https://github.com/gollum/gollum

Post reply on HN