Pretty cool. What's the tech stack for this?
Laravel only, basically.
Show HN: I made a free, ad-free and open source tool for sharing private notes
71–80 of 80 posts
Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#72how do I burn the note ?
Just open the Link.
Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#73AES-CBC for quick and dirty encryption can be a red flag: the scheme needs to include an encrypt-then-MAC phase or it'll be vulnerable to padding oracle attacks. I tried to do a quick scan of the code[1] to determine whether it does that, but I couldn't locate it, possibly because my PHP comprehension is terrible. [1]: https://github.com/GigaMick/burnernote
Update: As far as I can tell, this is the encryption encrypoint[1]. It does seem to be vulnerable to a padding oracle attack, unless the `$request->note` parameter is something much more complicated than it appears to be (i.e., it appears to be the plaintext). It's always great to see people experiment with encryption (and burn-after-use schemes are very cool!) but, absent of further information, I think it's activel…
"there's no affirmative proof of a note's destruction on the server side. It seems to just update the database to mark the note as empty and deleted"
Isn't updating the note to be empty and deleted enough? It is totally zapped.
What else would you like to see here?
Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#74Earlier quoted context omitted.
haha ok this is something I will remedy. As stated in other replies, the reason for posting here was to get feedback and improve the product (I just put to together over the weekend there)
Hello, the way that privnote deals with it is by showing a page asking "Do you want to read this note and burn it?". That will solve the issue of preview apps expiring your notes.
This is what I done! I realised this morning as I was in a McDonalds drive thru queue how easy it would be to solve just by adding an "are you sure" screen.
Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#75nice project, but I prefer the approach of https://privnote.com notes are encrypted client-side before sending, click-to-read prevents scraper burn, auto-delete after 30days
I also really like privnote but I don't think a service such as this should be carrying really shitty ads.
Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#76Earlier quoted context omitted.
Update: As far as I can tell, this is the encryption encrypoint[1]. It does seem to be vulnerable to a padding oracle attack, unless the `$request->note` parameter is something much more complicated than it appears to be (i.e., it appears to be the plaintext). It's always great to see people experiment with encryption (and burn-after-use schemes are very cool!) but, absent of further information, I think it's activel…
"there's no affirmative proof of a note's destruction on the server side. It seems to just update the database to mark the note as empty and deleted" Isn't updating the note to be empty and deleted enough? It is totally zapped. What else would you like to see here?
My point was that it's a claim that's impossible to formally prove: we don't really know how to do formal proofs of destruction, at least not with the scheme you're using.
But even beyond that, there are a lot of weaknesses in this setup. I'll post a list of them in response to the other comment you left, since they'll be more relevant there.
> What else would you like to see here?
Frankly, you should either disable this service or put a big red banner on it explaining that it it (1) hasn't been audited, and (2) doesn't encrypt messages on the client side. As it is, people are going to make incorrect and potentially dangerous assumptions about the privacy of data they put on your service.
Please don't take that as a personal rebuke, because it isn't! I just don't want you to be the most recent person in a long lineage of developers to be publicly burned for teaching themselves applied cryptography.
Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#77Earlier quoted context omitted.
Another update: it looks like it uses Laravel's encryption API under the hood, which does indeed perform encrypt-then-MAC[1]. So this is probably not vulnerable to a padding oracle attack. But that wasn't obvious from the description, and it gave me a decent fright :-) [1]: https://laravel.com/docs/8.x/encryption#encrypting-a-value
So are you saying this is a good thing? You think I should highlight this?
It's a very good thing that it isn't susceptible to that particular weakness, as that would have been a disastrous one. But there are a lot of things that are left to be desired about this setup:
1. Message secrecy and the soundness of the encrypt-then-MAC protection seem to be partially, if not completely, dependent on the `APP_KEY` that you generated and are currently running the service with. For all anyone knows, that `APP_KEY` is all zeroes or comes from a bad RNG source. A better scheme wouldn't introduce a fundamental dependency on untrusted server randomness.
2. Message deletion is unsound: I have no proof that a note being "deleted" means that it's actually purged from your storage. I'm decently sure proving that is actually impossible in the general case, which is another reason why it's dangerous to have the note's encryption handled on the server side.
3. The "password" functionality seems to just be a string comparison against a DB-stored password. It's not mixed into the secret material for encryption at all. It's hashed at least, which is good, but it doesn't look like it's salted, which is bad.
Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#78I just want to say @gigamick these burn systems are powerful. You might get divorced some day. You might have a business partner subpoena your old gmail account. ALL those emails/texts will be turned over, ALL those emails/texts will get leaked. Use something like this! Make the message burn after reading.
Geeze, how much gnarly stuff are you doing?!
Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#79Nice gigamick. This has a problem though, when you paste that link in a chat window (e.g. WhatsApp, Telegram, Discord, ...), the app tries to get a link preview. This has the side effect of also expiring the note. I think it's best to implement a feature to detect whether it's a human opening the link or a bot.
This issue now resolved :-)
nice :-) liking the new "Show me the note" button gatekeeper. cheers
Re: Show HN: I made a free, ad-free and open source tool for sharing private notes
#80From the about page: > However [alternatives'] pages are laden with ads, have a poor UI, and you can't know for sure if they really are actually encrypting / deleting anything. There has been a private zero-knowledge pastebin for years: zerobin, forked into privatebin now ( https://zerobin.net/ ). In fact the original is almost 10-years old but hasn't displayed a single ad, has been open source the whole time, has ha…
This is awesome feedback and client side encryption is 100% on its way. I just put this together over the weekend and then put around places like this for feedback. Client side is coming.
One of the best things modern browsers has delivered.