Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Should notes be end-to-end encrypted?

supernotes.app

Post reply on HN
Print view View original

71–80 of 151 posts

Re: Should notes be end-to-end encrypted?

#71

Post by eduction »

chrismorgan wrote: post #9

One other major downside of end-to-end encryption: everything has to be done client-side, and the server becomes very close to a dumb pipe and block storage. (The only parts the server can do anything with are those that aren’t encrypted, so the explicit goal of E2EE is to reduce the server to a dumb pipe and block storage.) Got ten gigabytes of stuff you want to search through? Without E2EE, the server can implement…

I see this kind of pushback from engineers quite often when advocating for privacy first technologies. I think this comment is a good example of the sort of reflexive dismissal many developers have to changing how they work, from being asked to move a bit away from the dominant paradigm of the last 20-30 years (cleartext private data on servers).

1. The idea that it’s impractical to download the data. We are talking about searching text notes. 10gb? That’s nearly 7 million pages of notes. Doesn’t seem a reasonable figure. Even hundreds of megs of text would require a lot of time to acquire and even that would rarely need to be downloaded in one go (new device).

2. The idea that tech that tends to live on the server is somehow magical. Search would take “a few seconds” on a “slow” phone processor you say. Phone professors are incredibly fast these days, but in any case, since when is text search slow? I feel like many developers treat text search as a scary magical black box but it’s rather straightforward. Read about inverted indexes and consider that the servers of the mid 90s were serving at least tens of thousands of text searchers apiece with processors probably slower than what’s in your phone. There are libraries you can use locally to make text search pretty trivial. Apple supports text search (spotlight) across the data and apps on your phone. It’s not rocket science.

3. The idea that anything other than conceptually perfect encryption is useless. “first-party end-to-end encryption is snake oil” - assuming you mean crypto where the user does not handle the keys directly and a first party causes them to be generated, first party e2ee describes some of the biggest privacy wins of the last 15 years - iMessage, FaceTime, Signal, WhatsApp.

Re: Should notes be end-to-end encrypted?

#72

Post by hedora »

threeseed wrote: post #11

> Our team will never read or access your note content, unless we have received your express permission during a customer support interaction Either naive or dishonest. Can't tell which is worse. The reason end to end encryption exists is to cover the cases which you can't plan for. For example a rogue employee reading the notes of their partner.

> Our team will never read or access your note content, unless we have received your express permission during a customer support interaction

So, where is this available? Services with this security property are illegal in the US, and most other countries. (Warrants and bankruptcy courts are two reasons.)

Re: Should notes be end-to-end encrypted?

#74

Post by throwaway888abc »

jdvh wrote: post #43
chrismorgan wrote: post #22

Earlier quoted context omitted.

It tries to be, but in practice as I say you mostly just end up with the worst of both worlds, because of perverse incentives (the software provider wants to charge a monthly figure and doesn’t want their server to be fungible). Anyway, it’s still much more commonly a limitation than an advantage. Perhaps the most obvious example: I want to be able to search through 10GB of emails without needing to download them all…

I know I'm biased because I'm working on an E2EE todo/planning app[1], but over the years I've become convinced that E2EE apps are the future. All the syncing code you have to write anyway if you want your app to work offline. Despite all the buzz about big data, most individuals and most companies generate only a modest amount of data. Even when you have a long tail of archived data (e.g. emails that go back 10 year…

That's looks pretty cool. Looking forward for invite. Just signed up.

Re: Should notes be end-to-end encrypted?

#76

Post by sleepybrett »

eduction wrote: post #71
chrismorgan wrote: post #9

One other major downside of end-to-end encryption: everything has to be done client-side, and the server becomes very close to a dumb pipe and block storage. (The only parts the server can do anything with are those that aren’t encrypted, so the explicit goal of E2EE is to reduce the server to a dumb pipe and block storage.) Got ten gigabytes of stuff you want to search through? Without E2EE, the server can implement…

I see this kind of pushback from engineers quite often when advocating for privacy first technologies. I think this comment is a good example of the sort of reflexive dismissal many developers have to changing how they work, from being asked to move a bit away from the dominant paradigm of the last 20-30 years (cleartext private data on servers). 1. The idea that it’s impractical to download the data. We are talking…

I generally agree with your points but would point out that when I exported all my evernote data a few years ago it came to about 15gb, mostly because I use a lot of photographs and diagrams in my notes. I don't know anything about this note platform but if it allows multimedia embedding then the data can balloon quite rapidly.

Re: Should notes be end-to-end encrypted?

#77

Post by sodality2 »

break_the_bank wrote: post #18
maksim-m wrote: post #6

> Should Your Notes Be End-to-End Encrypted? Yes. That's why I use Joplin (which is free and open source btw) and not some proprietary freemium app that to explains me that I don't necessary need E2E encryption for my notes.

Do you have something that allows you to publish that as well? Use case - I want to keep some notes for myself e2e on my laptop & phone but every now and then I'd like to publish a few of them under a pseudonym anonymously on the internet.

Trilium Notes offers this: https://github.com/zadam/trilium/

Note: I run a paid 3rd-party synchronization service for Trilium Notes that would offer the publishing part of what you mentioned easily, without setting up a cloud server: https://trilium.cc/

Re: Should notes be end-to-end encrypted?

#78

Post by remram »

sleepybrett wrote: post #76
eduction wrote: post #71

Earlier quoted context omitted.

I see this kind of pushback from engineers quite often when advocating for privacy first technologies. I think this comment is a good example of the sort of reflexive dismissal many developers have to changing how they work, from being asked to move a bit away from the dominant paradigm of the last 20-30 years (cleartext private data on servers). 1. The idea that it’s impractical to download the data. We are talking…

I generally agree with your points but would point out that when I exported all my evernote data a few years ago it came to about 15gb, mostly because I use a lot of photographs and diagrams in my notes. I don't know anything about this note platform but if it allows multimedia embedding then the data can balloon quite rapidly.

The photographs can be retrieved as needed while still being encrypted and not impeding text search.

Re: Should notes be end-to-end encrypted?

#79

Post by remram »

puszczyk wrote: post #32
tekchip wrote: post #10

Earlier quoted context omitted.

Last I knew standard notes hid 2FA behind the paywall. Basic security should not be a pay feature. If they're willing to hang non-paying potential customers out to dry what other questionable security choices are they making? I tried to reason this out with them back when they had a discourse site or forum, I don't recall which it was, and was told, I'm paraphrasing, we're not going to do that and don't ever ask agai…

What should they charge for then?

They seem to charge $60/year for markdown (free plan only has plaintext). I wouldn't even want to evaluate it.

Re: Should notes be end-to-end encrypted?

#80

Post by lasereyes136 »

Contrary to Betteridge's law https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline... I would say the answer is maybe. Sure there are cases where it might make a big difference. Most cases it will not.

The article does seem to educate people on what different encryption models mean, which is a good thing. People should know and understand what they signup to use and how control of it could be taken from them. Take it would a grain of salt, companies have lied about E2EE so the only way to know for sure is to do the encrypting yourself and stay on top of security flaws in your encryption software.

Post reply on HN