21–30 of 151 posts
This entire section is FUD. Trust is "Still Required™" - unfortunately HN doesn't support underlines so I can't get accross the full obnoxiousness of the original formatting - therefore having your data in someone elses database is no worse then using an app that someone might add a backdoor to?
One other major downside of end-to-end encryption: everything has to be done client-side, and the server becomes very close to a dumb pipe and block storage. (The only parts the server can do anything with are those that aren’t encrypted, so the explicit goal of E2EE is to reduce the server to a dumb pipe and block storage.) Got ten gigabytes of stuff you want to search through? Without E2EE, the server can implement…
> One other major downside of end-to-end encryption: everything has to be done client-side, and the server becomes very close to a dumb pipe and block storage. That sounds like a feature...
Anyway, it’s still much more commonly a limitation than an advantage. Perhaps the most obvious example: I want to be able to search through 10GB of emails without needing to download them all (or a not-much-lighter index), because downloading it takes a long time, costs a fair bit (traffic isn’t generally), and requires that I have that much spare space on whatever device I’m using at the time.
The fact of the matter is that E2EE in all its forms is consistently inconvenient—and double racheting makes it even worse than earlier non-key-cycling techniques. In some situations it may be worth the inconvenience, but I wish there was more acknowledgement of the fact that it’s seriously not the ideal goal, and I wish the innovation would head in the direction of proper and deliberately thorough decentralisation instead, because if you run your own server, you don’t need E2EE: its purpose disappears completely, leaving only the inconvenience. (Reduce it instead to just encryption at rest and transport encryption, which are still useful and entirely sufficient.)
My preference is to not need to care about what I'm pasting into my notes app. As I use the app on mobile, desktop OS and store not only organized content there, but also random thoughts, incl. sensitive content. That's I prefer to have it E2EE and use standardnotes.com (no affiliation, I'm just a happy customer)
Last I knew standard notes hid 2FA behind the paywall. Basic security should not be a pay feature. If they're willing to hang non-paying potential customers out to dry what other questionable security choices are they making? I tried to reason this out with them back when they had a discourse site or forum, I don't recall which it was, and was told, I'm paraphrasing, we're not going to do that and don't ever ask agai…
Hmm, here is someone who would have loved E2E for his emails (and images in the cloud): Google refuses to reinstate account after man took medical images of son’s groin https://news.ycombinator.com/item?id=32560361 Given the tendency of large corporations to look into our private stuff, even on personal mobile devices (Hi Apple), encryption seems to be the only remedy. That is the reason why I store my (encrypted) no…
If you don't want Google to do that, there's no point in using Google Photos. The entire benefit disappears.
> Should Your Notes Be End-to-End Encrypted? Yes. That's why I use Joplin (which is free and open source btw) and not some proprietary freemium app that to explains me that I don't necessary need E2E encryption for my notes.
Do you have something that allows you to publish that as well? Use case - I want to keep some notes for myself e2e on my laptop & phone but every now and then I'd like to publish a few of them under a pseudonym anonymously on the internet.
> Should Your Notes Be End-to-End Encrypted? Yes. That's why I use Joplin (which is free and open source btw) and not some proprietary freemium app that to explains me that I don't necessary need E2E encryption for my notes.
Do you have something that allows you to publish that as well? Use case - I want to keep some notes for myself e2e on my laptop & phone but every now and then I'd like to publish a few of them under a pseudonym anonymously on the internet.
I really don't like every app reimplementing secure block storage and exchange or whatever.
> Our team will never read or access your note content, unless we have received your express permission during a customer support interaction Either naive or dishonest. Can't tell which is worse. The reason end to end encryption exists is to cover the cases which you can't plan for. For example a rogue employee reading the notes of their partner.
Really it's just a LUDICROUS statement to make. This isn't the 1980s, we know how tech works. We've seen tech companies around long enough for heroes to become villains and even heroes again, to watch all stages of lots of lifecycles happen over and over again, all the good and perverse incentives that can take place. To watch, well, decades. Just raw time. Even without centuries as in some industries, some basics are pretty clear at this point and one of them is that absolutely nobody can claim that data they have access too will "never be used" in one way or another given the pace of change and uncertainties of finances and even law.
Notes tend to be things where people put in sensitive stuff, if only for scratch purposes. It's just inevitable, humans are humans. Or put in stuff they don't think is sensitive but who they're wrong, even security agencies can screw stuff like that up. A notes are a tiny amount of data by today's standards, handling everything client-side is not a big ask. So yeah, kind of a wow.
Edit: another top conversation on HN literally right this instant is "“10% error rate is okay“ – Leaked EU Commission document regarding Chat Control"[0]. What happens when the law is changed such that all notes must be constantly scanned by AI for signs of criminal activity?
----