Earlier quoted context omitted.
"One-way encryption" is a peculiar choice of phrase.
[deleted]
How is it an oxymoron?
Evernote hacked
31–40 of 220 posts
Re: Evernote hacked
#32Earlier quoted context omitted.
They wouldn't be able to do this on the server side. However their native iOS, Mac, Windows clients could just create&update the search index locally and sync the encrypted version. With HTML5 localStorage this also works in Web Apps. Of course there's a tradeoff, but for me that's easily worth it.
The "tradeoff" seems to be "make the server into a dumb store for encrypted data." At which point, you don't have Evernote (an API for fuzzy-matching clippings punted into it from various devices), you have Evernote (a set of fat client programs each of which must maintain an entire copy of the dataset--notably, stored necessarily alongside its own decryption key on the client side, increasing attack surface --and do…
The "tradeoff" seems to be "make the server into a
dumb store for encrypted data." At which point, you
don't have Evernote (an API for fuzzy-matching
clippings punted into it from various devices),
you have Evernote (a set of fat client programs)
plus a POSS (Plain Old Storage Service, like S3.)
In fact, the workflow sounds like it would have more
in common with editing a Word document over SMB than
with making web requests.
Otherwise, yeah most Web Apps are nothing more than editing stuff over the network and visualizing it differently.
The #1 competitor or a SaaS isn't some other SaaS but rather Word/Excel: http://www.startupcfo.ca/2011/05/the-1-competitor-for-saas-v...
Edit: Also there's no reason to believe the client-side store wouldn't be encrypted. That'd be exceedingly stupid.
Re: Evernote hacked
#33Earlier quoted context omitted.
"One-way encryption" is a peculiar choice of phrase.
No, it is an accurate choice of phase. The passwords are "hashed" which is literally one-way encryption, since the encryption is lossy - the information to reverse it literally doesn't exist in the output. The only way to "break" correctly working hashes is to encrypt tons of passwords (+salt) and see if the lossy output is identical to the output you got from the previously hashed password. Which is a very time cons…
People are going to argue with you semantically, but you'll all generally be in agreement (except 3DES is a block cipher, not a hash function).
Re: Evernote hacked
#34Earlier quoted context omitted.
"One-way encryption" is a peculiar choice of phrase.
Meh, it's a PR person who probably had it explained 10 minutes before. They explicitly state that they are hashed and salted, so I'm not super concerned.
Someone should write a boilerplate "we've been hacked" blog post with parameters for the kind of hashing and factors of authentication used, and what they know - or don't know - was compromised.
I can't blame companies for not having one such on hand to begin with, but I'm sure they'd appreciate that someone with the unfortunate experience crafted a draft for them in stressful times like these.
Re: Evernote hacked
#35The following blog post is also being sent to all Evernote users as an email communication. Evernote’s Operations & Security team has discovered and blocked suspicious activity on the Evernote network that appears to have been a coordinated attempt to access secure areas of the Evernote Service. As a precaution to protect your data, we have decided to implement a password reset. Please read below for details and inst…
> Please create a new password by signing into your account on evernote.com(https://www.evernote.com/Login.action).
and
> Never click on ‘reset password’ requests in emails
Is sure to confuse a lot of people.
Re: Evernote hacked
#36The following blog post is also being sent to all Evernote users as an email communication. Evernote’s Operations & Security team has discovered and blocked suspicious activity on the Evernote network that appears to have been a coordinated attempt to access secure areas of the Evernote Service. As a precaution to protect your data, we have decided to implement a password reset. Please read below for details and inst…
Even though this information was accessed, the passwords stored by Evernote are protected by one-way encryption. (In technical terms, they are hashed and salted.(http://en.wikipedia.org/wiki/Salt_(cryptography) ))
That's great. But to really reassure people they would do best to reveal the algorithm. After all, DES-based password hashes are both 'hashed and salted' but are easily broken with JtR.
Re: Evernote hacked
#37The following blog post is also being sent to all Evernote users as an email communication. Evernote’s Operations & Security team has discovered and blocked suspicious activity on the Evernote network that appears to have been a coordinated attempt to access secure areas of the Evernote Service. As a precaution to protect your data, we have decided to implement a password reset. Please read below for details and inst…
I haven't received such an email, wonder why.
Anyway Evernotes android client wasn't very good and it was far too slow to start.
And now the have been hacked. Anybody know a good alternative?
Re: Evernote hacked
#38Earlier quoted context omitted.
The "tradeoff" seems to be "make the server into a dumb store for encrypted data." At which point, you don't have Evernote (an API for fuzzy-matching clippings punted into it from various devices), you have Evernote (a set of fat client programs each of which must maintain an entire copy of the dataset--notably, stored necessarily alongside its own decryption key on the client side, increasing attack surface --and do…
The "tradeoff" seems to be "make the server into a dumb store for encrypted data." At which point, you don't have Evernote (an API for fuzzy-matching clippings punted into it from various devices), you have Evernote (a set of fat client programs) plus a POSS (Plain Old Storage Service, like S3.) In fact, the workflow sounds like it would have more in common with editing a Word document over SMB than with making web r…
I don't think you got quite what I'm trying to say--the whole point of Evernote is that all your data is "there", and the collated index for finding this or that is "there", and so any individual piece of data doesn't need to be on this device or that device. When you insert a new piece of data, all you need is that piece of data. You send it off to Evernote, and they stick it into your database. Then, later--still without any local state--you search the server to find out if anything you've sent in matches some arbitrarily-complex query--and if there are results, then you temporarily download [the newest version of] them from the server. The collation itself--not the storage, not the UX, but the ability to immediately put something into device X and then find it using device Y--is what you're paying them for.
Without that, what you have is a OneNote notebook stored in your Dropbox.
> Edit: Also there's no reason to believe the client-side store wouldn't be encrypted. That'd be exceedingly stupid.
It's encrypted with a key that's stored on the client, which is the same as the server being encrypted with a key stored on the server: effectively about as secure as DRM (i.e. not.)
To put it another way: presuming you have a motive to gain access to just my data--with this hypothetical service, if you steal my phone, you have my data, and the key to decrypt it. Or if you steal my laptop, or my desktop, or any other device the service is synced to. Or if you hack into them. All you need after that is the passphrase I (hopefully) set to unlock my encryption key--and for a single target, social engineering (or lead-pipe cryptanalysis) can get that right quick.
Meanwhile, there is only one thing people can do to steal my Evernote data: hack into Evernote's servers. If you just want my data, that's a whole lot more effort than it's worth, compared to just palming my phone.
[Now, if you want a bunch of random people's data, this is where using passphrase-locked + per-account-salted encryption-keys server-side is actually relevant to security. If it takes O(N) time to crack N accounts, there's much less incentive to do it than if it's O(1).]
Re: Evernote hacked
#39The following blog post is also being sent to all Evernote users as an email communication. Evernote’s Operations & Security team has discovered and blocked suspicious activity on the Evernote network that appears to have been a coordinated attempt to access secure areas of the Evernote Service. As a precaution to protect your data, we have decided to implement a password reset. Please read below for details and inst…
Even though this information was accessed, the passwords stored by Evernote are protected by one-way encryption. (In technical terms, they are hashed and salted.( http://en.wikipedia.org/wiki/Salt_(cryptography) )) That's great. But to really reassure people they would do best to reveal the algorithm. After all, DES-based password hashes are both 'hashed and salted' but are easily broken with JtR.
Your average user has no idea what a hash nor a salt is. There's really no reason for them to include their hashing algorithm in an email like that.
Re: Evernote hacked
#40whew, i was shocked when my evernote client asked me to enter my password because i did not recieve the e-mail. It seems like this was a precautious step as nothing was 'really' hacked, or was it?
Their blog is down now, but they did say that attacker had access to usernames and encrypted password but nothing else.
And email