already locked myself out lol
whoops, I can delete your account if you want to create a new one with the same login, just let me know.
Show HN: Working on a Zero-Knowledge Daily Journaling App
91–100 of 112 posts
Re: Show HN: Working on a Zero-Knowledge Daily Journaling App
#92Earlier quoted context omitted.
SHA-256 is not suited to derive key material from weak input data, you should use PBKDF2 or another key derivation function for that. The authentication method also seems pretty wonky, that's not how to do zero-knowledge password verification, you should look at methods like PAKE for that. As usual, just don't roll your own crypto if you don't know what you're doing.
Thanks for the feedback! The hash is actually used to derive an actual key using PBKDF2 -- the library used is https://cryptojs.gitbook.io/docs/ Also, I'm interested if you see an attack vector on the authentication method. One thing to note is that even if an attacker can authenticate successfully they still have no access to the user private data without brute forcing the master password.
[deleted]
Re: Show HN: Working on a Zero-Knowledge Daily Journaling App
#93> "A good writer doesn't just think, and then write down what they thought, as a sort of transcript. A good writer will almost always discover new things in the process of writing. And there is, as far as I know, no substitute for this kind of discovery." -Paul Graham What is it about writing that makes it different than thinking?
writing is a tool to help us think. Since we have limited active memory to think with, the words act like storage which helps organise thoughts and cover more ground
Re: Show HN: Working on a Zero-Knowledge Daily Journaling App
#94Zero knowledge here means client side only not zero knowledge proof, correct?
Yeah this doesnt seem to have anything to do with zero knowledge besides reusing the keywords because it’s trendy
the decryption key never leaves the browser. Maybe it's not perfect, but I'm not using the keywords because it's trendy, this project started out of an interest in more secure authentication and data security.
Re: Show HN: Working on a Zero-Knowledge Daily Journaling App
#95Why does this have to be cloud-based at all?
Re: Show HN: Working on a Zero-Knowledge Daily Journaling App
#96What about this necessitates "on the internet?" Just do it offline, there's your zero-knowledge.
one benefit of online is privacy. I've talked to many people that really don't like having a physical journal laying around with personal information that a partner might read. But yeah, I get there are workaround to that problem and not everyone has this kind of privacy issue
"Privacy" and "online" don't go well together, though. Talking about "zero-knowledge" doesn't really address the issue, because there is no way of knowing if the author is being honest, or if they've implemented it correctly.
Re: Show HN: Working on a Zero-Knowledge Daily Journaling App
#97Re: Show HN: Working on a Zero-Knowledge Daily Journaling App
#98What about this necessitates "on the internet?" Just do it offline, there's your zero-knowledge.
one benefit of online is privacy. I've talked to many people that really don't like having a physical journal laying around with personal information that a partner might read. But yeah, I get there are workaround to that problem and not everyone has this kind of privacy issue
No. No it is not. I'm sorry, this is just objectively wrong, and I don't mean to pick on you personally, but I do think it needs to be said.
Without online, it's in the hands of ONE party. Online, it's in the hands of that same party and at least one more.
Objectively less private.
Re: Show HN: Working on a Zero-Knowledge Daily Journaling App
#99Earlier quoted context omitted.
Yeah this doesnt seem to have anything to do with zero knowledge besides reusing the keywords because it’s trendy
the decryption key never leaves the browser. Maybe it's not perfect, but I'm not using the keywords because it's trendy, this project started out of an interest in more secure authentication and data security.
But zero knowledge cryptography has nothing to do with that. Sorry I was a bit harsh, I guess I got tripped by the misuse there.
Re: Show HN: Working on a Zero-Knowledge Daily Journaling App
#100Earlier quoted context omitted.
the decryption key never leaves the browser. Maybe it's not perfect, but I'm not using the keywords because it's trendy, this project started out of an interest in more secure authentication and data security.
But zero knowledge cryptography has nothing to do with that. Sorry I was a bit harsh, I guess I got tripped by the misuse there.
it's ok, it's hacker news so I expected honesty which I appreciate. But What would you call an authentication mechanism which never passes the decryption key off the browser? It's an improvement over systems that handle the keys themselves on the server side.