111–120 of 151 posts
Earlier quoted context omitted.
The photographs can be retrieved as needed while still being encrypted and not impeding text search.
How do you propose searching the content of your photographs and diagrams? ("Show me notes with gardening photos")
The important part: > Our app, Supernotes, is not E2EE That should have been at the top, and saved me two minutes. If someone develops a usable, cross platform, e2ee notes app with collab/sharing features, I'll gladly pay good money to use it.
Bigger question for me. Why use and popularize a 3rd party stored personal notes app at all? I'm well aware that this is how a lot of people do this sort of trading convenience for genuine security. But we (well, maybe not people here) could put more effort into solutions that don't require a money making middleman, since the tech is here to solve this problem without it.
I have more than one device and I'd like to be able to take notes on one and have them viewable/editable on the others. With E2EE, I don't have to trade this convenience for security.
Earlier quoted context omitted.
How do you propose searching the content of your photographs and diagrams? ("Show me notes with gardening photos")
What scheme would you use for searching the content of your photographs that requires the full photograph blob to be available for search ?
Earlier quoted context omitted.
What scheme would you use for searching the content of your photographs that requires the full photograph blob to be available for search ?
I might imagine a pipeline where a full photograph blob is downloaded and decrypted on your device, normalized, run through something like image2vec + ocr + metadata extraction, and the result stored in an index. At that point, of course, you could garbage collect the original blob - at least until your app releases an major update version requiring a reindexing of blobs.
Bigger question for me. Why use and popularize a 3rd party stored personal notes app at all? I'm well aware that this is how a lot of people do this sort of trading convenience for genuine security. But we (well, maybe not people here) could put more effort into solutions that don't require a money making middleman, since the tech is here to solve this problem without it.
Why use and popularize a 3rd party stored personal notes app at all? I'm well aware that this is how a lot of people do this sort of trading convenience for genuine security. I have more than one device and I'd like to be able to take notes on one and have them viewable/editable on the others. With E2EE, I don't have to trade this convenience for security.
One other major downside of end-to-end encryption: everything has to be done client-side, and the server becomes very close to a dumb pipe and block storage. (The only parts the server can do anything with are those that aren’t encrypted, so the explicit goal of E2EE is to reduce the server to a dumb pipe and block storage.) Got ten gigabytes of stuff you want to search through? Without E2EE, the server can implement…
> if the software is served over the Web or to any platform with automatic updates, E2EE is fundimentallu broken; and, first-party end-to-end encryption is snake oil. This statement, and this way or extremist thinking is the classic no true soctsman fallacy. Taken to the extreme it goes back to trusting trust, and not everyone is a cryptographer who wants to verify the encryption is strong and implimented correctly.…
Yes, if the organization itself decided to compromise its own scheme, E2EE cannot stop that... but again. That creates evidence and paper trails. The kinds of people with the power to do this want plausible deniability; the last thing they want is mathematical proof that they screwed their own customers on purpose. Same with that rogue employee: they don't want to be known as the guy who signed spyware.
[0] Yes, including sideloading-friendly ones. If your rogue update isn't signed it will trip a bunch of scary warnings at install time.
Earlier quoted context omitted.
Why use and popularize a 3rd party stored personal notes app at all? I'm well aware that this is how a lot of people do this sort of trading convenience for genuine security. I have more than one device and I'd like to be able to take notes on one and have them viewable/editable on the others. With E2EE, I don't have to trade this convenience for security.
But with an app that doesn't use a 3rd party, you don't have to much worry about E2EE at all, as I understand it. E.g. Syncthing + Markor.
I'd still want E2EE for that since if someone breaks the syncing service they'd have access to all of my notes.
Earlier quoted context omitted.
> if the software is served over the Web or to any platform with automatic updates, E2EE is fundimentallu broken; and, first-party end-to-end encryption is snake oil. This statement, and this way or extremist thinking is the classic no true soctsman fallacy. Taken to the extreme it goes back to trusting trust, and not everyone is a cryptographer who wants to verify the encryption is strong and implimented correctly.…
First party E2EE has some value even under a "trusting trust" scenario: it lets service operators keep rogue employees from accessing your data. To compromise your data requires pushing a software update, which on pretty much every platform[0] creates a paper trail of cryptographic signatures leading back to the company's signing keys. If someone finds out about user data being stolen through a modified version of th…