Hacker News Reader

Comment by dbcurtis | Hacker News Reader

> You acknowledge that if you encrypt an item after you create and add content to it, there may be a period of time in which your item’s body content is not encrypted while being stored in our database

So.... the data goes across the wire in clear-text, and is encrypted later? Ummm, sorry, no.

First off, I'm not interested in anything that stores data that I might want to encrypt "in the cloud". It goes on my own server. Full. Stop. And sending data across the wire in the clear and encrypting later? ? I mean.... ???

View on HN

> And sending data across the wire in the clear and encrypting later

As I understand it, the app uses SSL, so data is always sent over a (presumed) safe transport. I do agree that in order to meaningfully differentiate from the Google/Microsoft/Dropbox/OtherCloudFirm CanHasAllYourDataPlease-model encryption needs to happen 1) on the client 2) by default 3) For everything (including meta-data like filenames 4) should probably not be possible to turn off

Either way, I find it interesting that someone is trying to do at least some things right. It'll never be secure as a hosted solution (presumably they can (be ordered to)) backdoor the client at any time - see Lavabit) -- so I'm not sure I see the point (secure, but not actually secure?). Maybe release it under AGPL and offer a hosted version in order to a) have the client(s) be open and b) offer a solution to those that want to make the trade-off?

It would still be miles better than storing data with a provider that openly says they datamine everything.

My reading of it is that it probably has an autosave feature so if I begin typing "This is my super secret password: hunter2" and then click encrypt it may have already sent the content over the wire before I hit the encrypt button.

But that is just my reading of it, maybe the dev can correct me.

Yes, that will happen. Click "Crypto" first, then if you type content in the item, it will be encrypted from the get-go. We're working on changing this so you don't have to manually enable "Crypto" first.

This is our initial implementation and we know it's limited. Enable encryption on an item FIRST, before you add content. From then on, any data you add to that item will be encrypted by your browser before transfer. The cloud server is not encrypting the data.

You may know it is limited but the video literally says "End-to-end encryption." That's more than misleading.

Make no mistake, it is end-to-end encryption. The browser encrypts and decrypts the data, not the cloud. The version we're developing will not require the user to have to enable anything beforehand.

Reply on news.ycombinator.com