Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Should notes be end-to-end encrypted?

supernotes.app

Post reply on HN
Print view View original

141–150 of 151 posts

Re: Should notes be end-to-end encrypted?

#141

Post by samsquire »

adastra22 wrote: post #128
samsquire wrote: post #61

Earlier quoted context omitted.

Why do you say that in such a tone as if to inflict spite? If you knew how hard it was to write E2EE you would be more respectful of others honesty.

I'm a professional cryptographer who has implemented E2EE.

Did your implementation pass independent review?

In this thread you call people lazy and effectively claim they should roll their own E2EE crypto. And you write off using others non security software.

What if they aren't professional cryptographers? Would you still recommend that to?

Re: Should notes be end-to-end encrypted?

#142

Post by teleforce »

chrismorgan wrote: post #9

One other major downside of end-to-end encryption: everything has to be done client-side, and the server becomes very close to a dumb pipe and block storage. (The only parts the server can do anything with are those that aren’t encrypted, so the explicit goal of E2EE is to reduce the server to a dumb pipe and block storage.) Got ten gigabytes of stuff you want to search through? Without E2EE, the server can implement…

Personally I firmly believe that in the near future local-first software is going to be the main paradigm of Internet based applications, and end-to-end encryption will be its second nature [1].

From the seminal paper, "Local-first apps, on the other hand, have better privacy and security built in at the core. Your local devices store only your own data, avoiding the centralized cloud database holding everybody’s data. Local-first apps can use end-to-end encryption so that any servers that store a copy of your files only hold encrypted data that they cannot read".

[1] Local-first software: You own your data, in spite of the cloud:

https://www.inkandswitch.com/local-first/

Re: Should notes be end-to-end encrypted?

#143

Post by adastra22 »

samsquire wrote: post #141
adastra22 wrote: post #128

Earlier quoted context omitted.

I'm a professional cryptographer who has implemented E2EE.

Did your implementation pass independent review? In this thread you call people lazy and effectively claim they should roll their own E2EE crypto. And you write off using others non security software. What if they aren't professional cryptographers? Would you still recommend that to?

Where did I say they should roll their own crypto? There are well regarded off the shelf solutions for this problem.

Re: Should notes be end-to-end encrypted?

#144

Post by fomine3 »

eadmund wrote: post #54
chrismorgan wrote: post #22

Earlier quoted context omitted.

It tries to be, but in practice as I say you mostly just end up with the worst of both worlds, because of perverse incentives (the software provider wants to charge a monthly figure and doesn’t want their server to be fungible). Anyway, it’s still much more commonly a limitation than an advantage. Perhaps the most obvious example: I want to be able to search through 10GB of emails without needing to download them all…

> the software provider wants to charge a monthly figure and doesn’t want their server to be fungible Sounds like yet another reason to use free software and pay services for their actual services, like storage. > I want to be able to search through 10GB of emails without needing to download them all (or a not-much-lighter index), because downloading it takes a long time, costs a fair bit (traffic isn’t generally), a…

10GB could be nothing for mobile/desktop, but very much for webapps unless pre-downloaded.

Re: Should notes be end-to-end encrypted?

#145

Post by yunohn »

woojoo666 wrote: post #133
yunohn wrote: post #55

Earlier quoted context omitted.

It is possible, but it isn’t very feasible right now. Maybe in the future?

The top-level comment should at least acknowledge that it's possible. We shouldn't just put up our hands and say "it"s impossible/impractical to have E2EE data without overloading our clients", we should be pushing companies to prioritize research into techniques like encrypted search, so that the "future" can come sooner

I mean it’s like Crypto enthusiasts claiming their coins are green because they can theoretically run on renewables, when the reality is that the majority of miners use fossil fuel sources, and either way the energy is wasted.

Similarly, unless we desire E2EE for everything, it’s both algorithmically and computationally more feasible to stick to centralised unencrypted formats.

Re: Should notes be end-to-end encrypted?

#146

Post by dorasmith011 »

Welcome. BE NOT TROUBLED anymore. you’re at the right place. Nothing like having trustworthy hackers. have you lost money before or bitcoins and are looking for a hacker to get your money back? You should contact Albert Gonzalez Wizard right away it’s very affordable and we give guarantee to our clients. Our hacking services are as follows: -hack into any nkind of phone _Increase Credit Scores _western union, bitcoin and money gram hacking _criminal records deletion _Hacking of phones(that of your spouse, boss, friends, and see whatever is being discussed behind your back) _Security system hacking...and so much more. Contact THEM now and get whatever you want at info@albertgonzalezwizard.online / albertgonzalezwizard@gmail.com Whatassp Number: +31685248506 Telegram Number: +31685248506

Re: Should notes be end-to-end encrypted?

#147

Post by dorasmith011 »

Last year was a bad year for me, I lost all my savings to AutoBinarySignals, I invested over $15,000.00, When it got to the time where I wanted to withdraw my money, I was denied access, i called them and they were unreachable. I emailed them and I got a reply asking me to deposit more money for me to be able to withdraw my money, I disagreed and they threatened me. After weeks of trying to get my money and also getting the assistant of a lawyer, I was still unable to get my funds. a friend referred me to [ info@albertgonzalezwizard.online or whatsapp +31685248506 Telegramm: +31685248506 ] a certified Binary option recovery expert who guided me on steps to take to recover my funds. I have recovered all my money in weeks and I still find it hard to believe.

Re: Should notes be end-to-end encrypted?

#148

Post by brnt »

chrismorgan wrote: post #9

One other major downside of end-to-end encryption: everything has to be done client-side, and the server becomes very close to a dumb pipe and block storage. (The only parts the server can do anything with are those that aren’t encrypted, so the explicit goal of E2EE is to reduce the server to a dumb pipe and block storage.) Got ten gigabytes of stuff you want to search through? Without E2EE, the server can implement…

Remove the (implicit) third party server from your argument and it looks like your objection disappears.

I see no need to involve others in storing my notes.

Re: Should notes be end-to-end encrypted?

#149

Post by candiodari »

chrismorgan wrote: post #9

One other major downside of end-to-end encryption: everything has to be done client-side, and the server becomes very close to a dumb pipe and block storage. (The only parts the server can do anything with are those that aren’t encrypted, so the explicit goal of E2EE is to reduce the server to a dumb pipe and block storage.) Got ten gigabytes of stuff you want to search through? Without E2EE, the server can implement…

Well this is what the TPM is supposed to solve. You want to trust the developer (after all if your client app is compromised, end-to-end encryption won't save you), but you don't want to trust the server, and physical access to the server doesn't get you any access to the data.

Re: Should notes be end-to-end encrypted?

#150

Post by woojoo666 »

samsquire wrote: post #140
woojoo666 wrote: post #134

Earlier quoted context omitted.

Wow this is like an extreme version of "working in the open". If you don't mind me asking, do you have any private notes? Like maybe your workout notes or something? If so, what proportion of your notes would you say you keep private?

When I'm at working for or at a company I either use the company or client provided Wiki such as Confluence or knowledge base software. This is private to the company. For quick notes I use notepad++ and VS Code. If I were to join a project going forward I would create a journal directory in the repository and each day I would create a new document. I would move common reference commands and information to a separate…

Wow I would imagine most people are the opposite, with more private than public notes. Very cool, thanks for the detailed response
Post reply on HN