Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ZeroKit for Realm: Easy End-To-End Encryption

news.realm.io

Post reply on HN
Print view View original

11–12 of 12 posts

Re: ZeroKit for Realm: Easy End-To-End Encryption

#11

Post by porcellus »

Shank wrote: post #2

> If you’re building an app dealing with highly sensitive data, we definitely recommend you check out ZeroKit and give it a try! ZeroKit's website says they offer "hack proof encryption" and a $50k prize with a quote from The Next Web about "1,000 hackers" failing to break it. If I'm handling highly sensitive data, I'd prefer any service I'm using to do that have multiple third party security audits on a source code…

Hi, a ZeroKit developer here. We agree, third-party audits are crucial. We’re working on this, so stay tuned.

Re: ZeroKit for Realm: Easy End-To-End Encryption

#12

Post by marknadal »

porcellus wrote: post #10
marknadal wrote: post #3

From my reading so far, it sounds like ZeroKit's stores the private keys? Am I mistaken? Because if so, this is definitely not end-to-end encryption because ZeroKit is a middleman that can be attacked to gain access to keys. Edit: It says ZeroKit doesn't have access to the password, so asking for clarification here - is ZeroKit running entirely on the client then? Or do passwords ever get sent to the server (even if…

Hi, one of the devs here working on ZeroKit. We encrypt everything on the client, so the it is end-to-end encrypted. We only store the private keys on our servers in an encrypted form. The server only provides ACL (so users don't get access to encrypted data they shouldn't, even if they wouldn't be able to decrypt it), checks the password using SRP-6a and provides OpenId Connect that realm uses to authenticate the us…

Thanks for the more info.
Post reply on HN