Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Evernote doesn't really care about security

markpercival.us

Post reply on HN
Print view View original

51–60 of 64 posts

Re: Evernote doesn't really care about security

#51

Post by lucb1e »

paulgb wrote: post #11
lucb1e wrote: post #9

Only half the points are valid. SSL is a selling point, because it takes a lot of work to setup completely. Lots of websites (including high-profile ones like Outlook.com) have mixed content errors at one place or another, or appear to but don't fully support SSL. The fact that they "used to" use it as a selling point says enough too. SSL signin should not be enforced. HTTP should give a big warning, but SSL is not f…

Are there clients which support evernote but would not support SSL?

If not fully supporting https counts, then Windows XP is one. That still has a rather big market share.

Re: Evernote doesn't really care about security

#52

Post by lucb1e »

Dylan16807 wrote: post #37
lucb1e wrote: post #9

Only half the points are valid. SSL is a selling point, because it takes a lot of work to setup completely. Lots of websites (including high-profile ones like Outlook.com) have mixed content errors at one place or another, or appear to but don't fully support SSL. The fact that they "used to" use it as a selling point says enough too. SSL signin should not be enforced. HTTP should give a big warning, but SSL is not f…

SSL is easy to do if you 1. force it on your servers 2. only include content from your servers It becomes almost impossible to mix insecure content at this point.

Is it also easy with hundreds or thousands of servers around the world? Perhaps it's not particularly hard, but it's also not something that's thought through and implemented overnight.

Re: Evernote doesn't really care about security

#53

Post by rane »

aschobel wrote: post #44

Co-founder of Catch here, we are sometimes compared to Evernote but Catch is a note-sharing and collaboration app. 1. Two-factor We don't offer two factor but is something we are investigating. This is mitigated somewhat by the fact that a lot of our users use Google login. 2. SSL / TLS SSL shouldn't be a paid feature. It's been included in our product for free since we launched. We try and use SSL everywhere. All pa…

> Co-founder of Catch here, we are sometimes compared to Evernote but Catch is a note-sharing and collaboration app.

Would you say Catch has something to offer over Evernote for someone who uses the latter for private & personal notes?

Re: Evernote doesn't really care about security

#54

Post by dasil003 »

epochwolf wrote: post #18
pknight wrote: post #17

Earlier quoted context omitted.

One would think there'd be proper competition because one of the major motivators is going paperless... it's kind of odd that in 2013 there still aren't a lot of easy to use solutions that can store sensitive documents (bills, tax documents etc) that require a great level of privacy and security.

I use 1Password with dropbox sync for secure notes.

I do too, but it doesn't fit the use case of going paperless. Ability to drop in PDFs and OCR images in Evernote as well as handling large data sets are essential features.

Re: Evernote doesn't really care about security

#55

Post by gwern »

sreidnw wrote: post #33
neya wrote: post #27

Is there a way to download your Evernote data? Not to say that I find this an opportunity to bash Evernote, but I am terribly disappointed that a service that advertised you to keep really personal stuff, even your tax info on their servers just got hacked. I think I'm going back to creating .txt files on my desktop which no one else has access to (physcially and programatically), which despite having no encryption o…

The desktop client has a "Export Notes" function that will export to HTML or their custom format. I use this to make a local backup occasionally.

And if you're on Linux, Nevernote can sync and then export in a format.

Re: Evernote doesn't really care about security

#56

Post by gingerlime »

mdp wrote: post #14
paulgb wrote: post #10

> Give it a shot. Send someone a link to the non-SSL sign in and it won’t flip them over to SSL. It will also accept your credentials via non-SSL POST. So fire up SSLStrip and head down to your local coffee shop. If you are in a position to execute a MITM, it doesn't matter whether they flip people to HTTPS or not. If the site forced HTTPS you could still rewrite the redirect and proxy the HTTPS to HTTP (the secure c…

Yeah, this is an entirely valid criticism. It was more of a nitpicky point that they weren't flipping to HTTPS automatically, but from a practical standpoint it's no more secure if they did since they lack HSTS. Struck it from the post.

but when you struck it out, the first impression is that it's actually not a problem, but in fact it's even a bigger problem. right?

Re: Evernote doesn't really care about security

#57

Post by Dylan16807 »

lucb1e wrote: post #52
Dylan16807 wrote: post #37

Earlier quoted context omitted.

SSL is easy to do if you 1. force it on your servers 2. only include content from your servers It becomes almost impossible to mix insecure content at this point.

Is it also easy with hundreds or thousands of servers around the world? Perhaps it's not particularly hard, but it's also not something that's thought through and implemented overnight.

If you trust your data center security it should be easy to deploy a single certificate to all production webservers. Much easier than doing the actual site configuration.

There are a lot of hard things to do when scaling, SSL isn't in the hard class.

Re: Evernote doesn't really care about security

#58

Post by neya »

newman314 wrote: post #43
neya wrote: post #27

Is there a way to download your Evernote data? Not to say that I find this an opportunity to bash Evernote, but I am terribly disappointed that a service that advertised you to keep really personal stuff, even your tax info on their servers just got hacked. I think I'm going back to creating .txt files on my desktop which no one else has access to (physcially and programatically), which despite having no encryption o…

Well, don't do that. At least stick it in truecrypt

Thanks, that's a pretty neat idea :)

Re: Evernote doesn't really care about security

#59

Post by nvr219 »

sreidnw wrote: post #33
neya wrote: post #27

Is there a way to download your Evernote data? Not to say that I find this an opportunity to bash Evernote, but I am terribly disappointed that a service that advertised you to keep really personal stuff, even your tax info on their servers just got hacked. I think I'm going back to creating .txt files on my desktop which no one else has access to (physcially and programatically), which despite having no encryption o…

The desktop client has a "Export Notes" function that will export to HTML or their custom format. I use this to make a local backup occasionally.

Note that for some reason this option is only available in the Windows client. I had to boot into Windows on my macbook to do the export a few weeks ago.

For regular backups I use time machine which includes the user data folder: https://support.evernote.com/link/portal/16051/16058/Article...

Re: Evernote doesn't really care about security

#60

Post by nvr219 »

msh wrote: post #23
AdamGibbins wrote: post #12

What're the alternatives to Evernote? e.g. decent document tagging, excellent search and preferably OCR.

Google drive

Google Drive mobile applications leave a lot to be desired. The main problem is you can't store all your notes offline -- you have to select each file individually, set "make offline", and even then they don't auto-update.
Post reply on HN