Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notion leaks email addresses of all editors of any public page

twitter.com

Post reply on HN
Print view View original

141–150 of 162 posts

Re: Notion leaks email addresses of all editors of any public page

#141

Post by requilence »

amazingamazing wrote: post #5

I've been toying around an architecture that sets things up such that the data for each user is actually stored with each user and only materialized on demand, such that many data leaks would yield little since the server doesn't actually store most of the user data. I mention this since this sorts of leaks are inevitable as long as people are fallible. I feel the correct solution is to not store user data to begin w…

Disclosure: I work at Anytype. This is the architectural bet we took, so I'll answer your four problems directly.

Premise: treat it as certain that the server will eventually be compromised, subpoenaed, or misconfigured. So the server must hold nothing that can be decrypted or linked to a specific user's content. Users hold their own encryption keys, the server stores ciphertext, and there is no UUID→identity mapping at the sync layer. Sync runs over any-sync, which is peer-to-peer-capable; intermediate nodes see ciphertext.

On your four problems:

1. O(x*y) joins - pushed to the client, because the server can't decrypt enough to do them.

2. Offline members - eventual-consistency sync and CRDT.

3. Client-side theft - if an attacker has the user's keys, they have the data. Intentional: no server-side gate to break means no server-side gate to exfiltrate at scale. We're considering optional 2FA at the infrastructure layer as an additional barrier to data retrieval.

4. Unwanted modifications - content is signed with user keys and validated on read.

Real cost is on the product side: no server-side AI over your notes, no server-side full-text search, slower cold-start, and harder to build product analytics (no access to user data). Granular ACLs are also harder — permissions are enforced by key possession, so revoking access often requires key rotation rather than a permission-flag change.

But the exact bug this post is about (a server endpoint that maps a public UUID to an email) is structurally impossible in this model, because there's no such mapping on our servers to misuse.

any-sync and our data format (any-block) are MIT, if you want to poke at how it works: https://github.com/anyproto

Re: Notion leaks email addresses of all editors of any public page

#142

Post by O4epegb »

I reported this and several other issues with public pages almost six years ago. Some of them were fixed after many years - but they're very slow to handle it. I never received any bug bounty or anything.

Here's a Reddit post just as confirmation: https://www.reddit.com/r/Notion/comments/hqyxid/possible_sec.... I also reported it privately two months prior, of course.

Re: Notion leaks email addresses of all editors of any public page

#143

Post by amelius »

amelius wrote: post #9
estimator7292 wrote: post #4

Earlier quoted context omitted.

The problem is that they don't "need" to. There's no consequences for not caring, and no incentive to care. We need laws and a competent government to force these companies to care by levying significant fines or jail time for executives depending on severity. Not fines like 0.00002 cents per exposed customers, existential fines like 1% of annual revinue for each exposed customer. If you fuck up bad enough, your comp…

If the government wants me to take copyright and IP laws seriously, then they need to take my personal information seriously too.

Yes, it makes sense as both are about the value we give to information.

Re: Notion leaks email addresses of all editors of any public page

#144

Post by unconed »

lioeters wrote: post #31

Recently I checked back on Notion after a year or so of not seeing it. I was going to recommend it to someone as an example of hypertext, but I see now it calls itself an "AI workplace that works for you" and "Your AI everything app". This company means nothing now, seriously what happened.

After making one of the least worst rich editors out there on the web, they needed to keep their developers and designers busy (while not having time to fix privacy bugs).

Like every other AI tool it mainly seems to exist to produce productivity porn. Summarize the meetings nobody could be bothered to summarize. Write the docs nobody can be bothered to read or write. Communicate as an end, not a means, because the company your work for has transitioned into the dead-weight phase.

Re: Notion leaks email addresses of all editors of any public page

#145

Post by reactordev »

varenc wrote: post #123
reactordev wrote: post #81

Earlier quoted context omitted.

This is a rendering artifact, nothing more. If you can tokenize and protect PII on your platform, you can protect PII on your public pages. if (metadata.is_public) Simple fix.

But a user's email isn't always forbidden. The API endpoint which turns UUIDs into a user email presumably also has use cases where you do want to expose the user email. For example, when seeing a list of people you've already invited via email to collaborate with, or listing users within your organization, etc. So a user's email isn't always forbidden PII, it depends on the context. The trouble is the UUID->email en…

A users email should always be forbidden…

It is not a public marker, it’s PII.

Re: Notion leaks email addresses of all editors of any public page

#146

Post by cldwalker »

zaggle wrote: post #58
freedomben wrote: post #35

Earlier quoted context omitted.

For a personal knowledge base? I would stay far away from anything proprietary for personal notes. I love logseq though I'm increasingly worried it's abandonware

Logseq was captured by VC a long time ago. They switched from open files to a database, their synching product is closed source (not selfhostable), and they have built-in telemetry.

The latest sync is self-hostable - https://github.com/logseq/logseq/pull/12315

Re: Notion leaks email addresses of all editors of any public page

#147

Post by sysguest »

markdown wrote: post #115
csallen wrote: post #72

Earlier quoted context omitted.

The whole point of that comment is that it's not that easy. There are potential side effects and consequences that are difficult to architect around.

Except it is. If you can't easily architect around it, then don't do what you're trying to do. "Oh I needed to disclose user data in order to make more money" isn't an acceptable excuse.

> Oh I needed to disclose user data in order to make more money

hmm maybe they should've paywalled?

Re: Notion leaks email addresses of all editors of any public page

#148

Post by chinathrow »

csallen wrote: post #72
chinathrow wrote: post #69

Earlier quoted context omitted.

Of course they can fix it, come on. They can easily withold information they put out intenionally.

The whole point of that comment is that it's not that easy. There are potential side effects and consequences that are difficult to architect around.

The fix IS easy. The side effects need to be dealt with accordingly. Why do you defend shit like this?

Re: Notion leaks email addresses of all editors of any public page

#149

Post by chinathrow »

csallen wrote: post #127
markdown wrote: post #115

Earlier quoted context omitted.

Except it is. If you can't easily architect around it, then don't do what you're trying to do. "Oh I needed to disclose user data in order to make more money" isn't an acceptable excuse.

No one's talking about excuses.

Looks like everyone does talk about excuses though.

Re: Notion leaks email addresses of all editors of any public page

#150

Post by linsomniac »

linsomniac wrote: post #112
linsomniac wrote: post #34

Very timely. I literally ran a Claude prompt "compare and contrast Notion vs Obsidian" and flipped over to HN while it was thinking, and this comes up. Thanks HN!

Thanks for the pointers everyone, there were quite a few that weren't on my radar. My use-case isn't a "personal knowledge graph", I'm building an ADU and so I'm looking for a lot of components: todo lists, inspiration boards, costing/spreadsheets, ordering lists, documents. Notion looks to be pretty capable in that regard, so the knowledge graph options really fell short (Logseq, Obsidian, Joplin, Trilium, Craft). T…

FYI: I spent around 30-45 minutes trying Anynote, trying to match what they were showing in the introduction video (a todo list of tasks, where each task was a list), but it looks like creating a new space results in standard objects like "Task" needing to be recreated; the new Space had like 2 standard objects included. So I switched over to Notion and in I was just trying to get a list of building supplies, one of which was the doors I wanted to use, to have a page where I could put a link to the product page for the doors I found.

Anynote looks promising, if I could understand why I didn't have what look to be the "standard objects" in a new space.

Post reply on HN