Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vesper 2.0 and Vesper Sync

vesperapp.co

Post reply on HN
Print view View original

31–40 of 52 posts

Re: Vesper 2.0 and Vesper Sync

#31

Post by leejoramo »

jwr wrote: post #2

Are there any Vesper users that also used Simplenote? I'd be curious to know if there is anything significantly better about Vesper, compared to Simplenote. I realize Vesper lets you add photos (cool) — are there other differences?

I primarily use Simplenote on my iPhone because it syncs with altNV on my Mac. altNV is my primary note taking tool. I have tried various combinations of replacements for both of these apps, but keep coming back to this combination.

I really love the Vesper interface. I find it much easier to use on the iPhone than any other note taking app. I also find the implementation of the tagging feature to be very easy to use to organize notes and to create work flows. If I only needed notes on my iPhone, I would choose Vesper

I could see myself moving to Vesper if the OS X version lives up to the same UI standards as iOS, embraces the keyboard, and has a good export/import story.

Re: Vesper 2.0 and Vesper Sync

#32

Post by jgruber »

Holbein wrote: post #26
jgruber wrote: post #23

Earlier quoted context omitted.

As the other posters have remarked, Brent's sync diary provides some of the concrete technical reasons why we rolled our own. Big picture, though, we consider sync so essential to Vesper's long-term success that we wanted to control it. Dropbox is fantastic. We all rely on it personally. But we don't want Vesper to rely on it. I'm sure everyone here on Hacker News has a Dropbox account, and I'll bet most Daring Fireb…

In other words, you agree that iCloud's attempt at vendor lock-in is bad for developers and consumers alike.

Not at all. I would only argue that iCloud is not a good fit for all apps, and Vesper is one of them.

Re: Vesper 2.0 and Vesper Sync

#33

Post by illicium »

ihuman wrote: post #7
LukeB_UK wrote: post #3

I have no idea what Vesper is and after looking at the website, I still have no idea.

"Vesper is a simple and elegant tool for collecting notes, ideas, things to do — anything you want to remember. Organize your notes whatever way comes naturally to you, without complications. Vesper's focus is on how it feels to use." https://itunes.apple.com/us/app/vesper-simple-elegant-notes/...

"Vesper is yet another notetaking app. Money please!"

Re: Vesper 2.0 and Vesper Sync

#34

Post by everydaything »

tptacek wrote: post #17

I admire the clarity of Gruber's writing, and I'm very happy that Vesper is honest about their capabilities w/r/t/ decrypting notes stored on their server, but "salted and hashed" was an unforced error. My guess, knowing how smart the people behind the code for this app are, is that they're not actually using "salted hashes" to store passwords, but an actual password hash (like bcrypt). Either way: the announcement w…

If it's not too big a topic, could you expand on the appropriate cryptography for this use case? How 'bout without a central server? (Not interested in web clients.)

Re: Vesper 2.0 and Vesper Sync

#35

Post by ghshephard »

It's not quite a Canary, but the privacy policy has the line, "it's theoretically possible for Q Branch to read the decrypted note text or view image data, we don't have a mechanism in place to do that."

Presumably, that line will disappear if they create such a mechanism.

I'm super, super excited about the Vesper update, and can't wait for the OS X app to role out. I use vesper as my sole note taking app on my iPhone - it really is elegant, easy to use, and requires very little cognitive overhead to hop into.

On my Laptop, it's all evernote, but, as much as I use it (2-3 hours a day, all meetings) - I've never really loved it. It's got a lot of crud, and upselling stuff that overwhelms me when I'm trying to just enter a new set of meeting notes.

Love the way the Vesper team does stuff slowly, deliberately, and beautifully. If only all software was crafted with that much deliberation. Artisanal Software.

Re: Vesper 2.0 and Vesper Sync

#36

Post by zaroth »

jgruber wrote: post #20
tptacek wrote: post #17

I admire the clarity of Gruber's writing, and I'm very happy that Vesper is honest about their capabilities w/r/t/ decrypting notes stored on their server, but "salted and hashed" was an unforced error. My guess, knowing how smart the people behind the code for this app are, is that they're not actually using "salted hashes" to store passwords, but an actual password hash (like bcrypt). Either way: the announcement w…

We hash the password using pbkdf2. The actual code looks like this: crypto.pbkdf2(text, salt, ITERATIONS, BYTES, function... ITERATIONS is 1000, and BYTES is 32. Our code is descended from the code on this page: http://www.thejoyofcode.com/Exploring_custom_identity_in_Mob...

Note, if your crypto.pbkdf2() is using SHA1 underneath, then 1,000 interations of SHA1 is very little computation for a GPU, which can do billions of SHA1 per second.

Also, asking for 32 bytes from PBKDF2-HMAC-SHA1 has some bad side-effects, particularly if you are splitting up the result. (1Password got bitten by this, and wrote up the issue here: http://blog.agilebits.com/wp-content/uploads/2013/07/playing...)

Re: Vesper 2.0 and Vesper Sync

#37

Post by kackontent »

> We’ve tried to make it as easy and simple as possible to use. Here’s how it works. First, you create a Vesper Sync account using an email address and a password. Then, your Vesper data — the text of your notes, your image attachments, your tags, everything — syncs to our cloud service. Sign in using the same account on another device, and your Vesper data will appear on that device.

> That’s it.

I don't get why it's mentioned as something special - isn't it how it usually works? Dropbox, OneNote, OneDrive, Google Drive, anything? You create account, sign in, bam you have your data synced.

Re: Vesper 2.0 and Vesper Sync

#38

Post by SeoxyS »

tptacek wrote: post #17

I admire the clarity of Gruber's writing, and I'm very happy that Vesper is honest about their capabilities w/r/t/ decrypting notes stored on their server, but "salted and hashed" was an unforced error. My guess, knowing how smart the people behind the code for this app are, is that they're not actually using "salted hashes" to store passwords, but an actual password hash (like bcrypt). Either way: the announcement w…

That's a fair complaint. The PBKDF2 answer is quite satisfactory (though I think that these days 10k iterations is warranted).

What I'm much more concerned about though is the server-side encryption of the notes[1]. Having the notes encrypted with a key that's kept on the same server, however frequently changes, adds barely any security. It gives the illusion of security: they can now truthfully say "your notes are encrypted on the server, yay!" But that's disingenuous, because the keys are stored on the same server.

A much better system would be to encrypt the notes on the device, using a key derived from the password. That way, the server can never see the plaintext of the notes, except for during login and when the password is being changed[2].

[1]: http://inessential.com/2014/04/17/vesper_sync_diary_14_keys

[2]: This is actually pretty easy to get around, by not sending the plaintext password to the server for login, but rather a different password-derived key. But if it were built that way it'd make it a little harder to update all the notes when changing passwords. But again, you could fix that by simply storing an encrypted version of a randomly generated encryption key on the service, and simply re-generating that when the password is changed, without having to chain the note ciphertexts. Kind of like how OS X full disk encryption works.

I actually touched on this by mentioning it to Brent via twitter the other day: https://twitter.com/kob/status/471152663384440832

Re: Vesper 2.0 and Vesper Sync

#39

Post by jhh »

tptacek wrote: post #17

I admire the clarity of Gruber's writing, and I'm very happy that Vesper is honest about their capabilities w/r/t/ decrypting notes stored on their server, but "salted and hashed" was an unforced error. My guess, knowing how smart the people behind the code for this app are, is that they're not actually using "salted hashes" to store passwords, but an actual password hash (like bcrypt). Either way: the announcement w…

It's incorrect that salted hashes are obsolete or quickly attackable per se. Password hashes are a subset of all hashes. Therefore they are hashes. bcrypt uses an internal salt (as it says in the first two sentences of its Wikipedia page).

Re: Vesper 2.0 and Vesper Sync

#40

Post by jwr »

leejoramo wrote: post #31
jwr wrote: post #2

Are there any Vesper users that also used Simplenote? I'd be curious to know if there is anything significantly better about Vesper, compared to Simplenote. I realize Vesper lets you add photos (cool) — are there other differences?

I primarily use Simplenote on my iPhone because it syncs with altNV on my Mac. altNV is my primary note taking tool. I have tried various combinations of replacements for both of these apps, but keep coming back to this combination. I really love the Vesper interface. I find it much easier to use on the iPhone than any other note taking app. I also find the implementation of the tagging feature to be very easy to use…

Thanks for all the answers. As a heavy Simplenote/NVAlt user, this tells me I should wait until Vesper has apps on all platforms I use (iPhone, iPad, Mac) and reevaluate then. For the moment, I'll stay with simplenote, but keep watching.
Post reply on HN