Twinkle Notes: Cross-platform encrypted notes app • Hacker News Board

Re: Twinkle Notes: Cross-platform encrypted notes app

#11

Post by jlongster » Wed, Feb 05, 2020, 5:36 PM UTC

wolfhumble wrote: post #6

jlongster wrote: post #3

Earlier quoted context omitted.

I develop an app like this ( https://actualbudget.com/ ) and I'll give you my reasons. Those kinds of syncing work will files, and treat each individual file as a blob. Apps don't work this way. Apps need databases and fine-grained change tracking. You absolutely don't want to make a change in two places on two separate devices and then have a sync conflict. If you throw the sqlite db file on dropbox, that's exactly…

If you don't mind, what type of database does 'Actualbudget' use? Thx!

Internally it just uses sqlite, and there's a syncing layer on top of it. I gave a talk about it here: https://www.dotconferences.com/2019/12/james-long-crdts-for-...

Re: Twinkle Notes: Cross-platform encrypted notes app

#12

Post by CiPHPerCoder » Wed, Feb 05, 2020, 5:57 PM UTC

> end-to-end encrypted

https://github.com/twinkle-labs/twinkle-notes/blob/45206f9d6...

For AES in CBC mode, IVs have two requirements:

1. They must never repeat.

2. They must be unpredictable.

Generating them from a SHA256 hash of some low-entropy data is not a good practice.

https://paragonie.com/blog/2016/05/how-generate-secure-rando...

Furthermore, not authenticating your ciphertext means padding oracle attacks can be launched against the app.

https://robertheaton.com/2013/07/29/padding-oracle-attack/

Re: Twinkle Notes: Cross-platform encrypted notes app

#13

Post by paulcarroty » Wed, Feb 05, 2020, 6:02 PM UTC

I prefer to write notes directly in VSCodium ans sync them to private git repository. Very useful. https://github.com/patleeman/VSNotes.git

Re: Twinkle Notes: Cross-platform encrypted notes app

#14

Post by muhammadusman » Wed, Feb 05, 2020, 6:11 PM UTC

paulcarroty wrote: post #13

I prefer to write notes directly in VSCodium ans sync them to private git repository. Very useful. https://github.com/patleeman/VSNotes.git

thanks for sharing this, trying it now :)

Re: Twinkle Notes: Cross-platform encrypted notes app

#15

Post by wtmt » Wed, Feb 05, 2020, 6:14 PM UTC

A few questions and observations:

* If I choose to use this notes app on multiple devices, and am careful enough to be the only person using it and complete any note taking on one device at a time (closing the app properly), I should be able to store and sync the sqlite database on any cloud storage service and wouldn't need the paid sync option, correct? In other words, the sync option makes multiple clients opening and making updates in the same time period a non-issue?

* The costing seems a bit weird when one digs in, because it defaults to counting in one GB increments even though the unit is stated as GBm and compared to things like KWh in the explanation. Even if you store only a few bytes of notes (or a few KBs), the documentation says that you'd still pay a minimum of 1GBm. So that works out to a $7.176 a year if you don't cross 1GB in storage used.

* Since this is open source with AGPL, anyone could fork it to support a custom sync mechanism that allows to store the database on cloud storage/sync services, but would have to make the source available if they distribute the app to others.

Re: Twinkle Notes: Cross-platform encrypted notes app

#16

Post by vzaliva » Wed, Feb 05, 2020, 7:00 PM UTC

I was in search of a good cross-platform notes app. Like Evernote, but preferably free with the open data format. I concluded that for me, personally, emacs org-mode with notes files stored in the Dropbox folder turns out to be an optimal solution. YMMV.

Re: Twinkle Notes: Cross-platform encrypted notes app

#17

Post by kebman » Wed, Feb 05, 2020, 7:30 PM UTC

CiPHPerCoder wrote: post #12

> end-to-end encrypted https://github.com/twinkle-labs/twinkle-notes/blob/45206f9d6... For AES in CBC mode, IVs have two requirements: 1. They must never repeat. 2. They must be unpredictable. Generating them from a SHA256 hash of some low-entropy data is not a good practice. https://paragonie.com/blog/2016/05/how-generate-secure-rando... Furthermore, not authenticating your ciphertext means padding oracle attacks ca…

What do you think about NaCl for a project like this?

Re: Twinkle Notes: Cross-platform encrypted notes app

#18

Post by jayaram » Wed, Feb 05, 2020, 7:37 PM UTC

vzaliva wrote: post #16

I was in search of a good cross-platform notes app. Like Evernote, but preferably free with the open data format. I concluded that for me, personally, emacs org-mode with notes files stored in the Dropbox folder turns out to be an optimal solution. YMMV.

After spending a lot of time testing out different apps, I ended up doing the same. Also orgzly for android works pretty well with org files stored on dropbox!

Re: Twinkle Notes: Cross-platform encrypted notes app

#19

Post by CiPHPerCoder » Wed, Feb 05, 2020, 7:49 PM UTC

kebman wrote: post #17

CiPHPerCoder wrote: post #12

> end-to-end encrypted https://github.com/twinkle-labs/twinkle-notes/blob/45206f9d6... For AES in CBC mode, IVs have two requirements: 1. They must never repeat. 2. They must be unpredictable. Generating them from a SHA256 hash of some low-entropy data is not a good practice. https://paragonie.com/blog/2016/05/how-generate-secure-rando... Furthermore, not authenticating your ciphertext means padding oracle attacks ca…

What do you think about NaCl for a project like this?