[{"data":1,"prerenderedAt":327},["ShallowReactive",2],{"project-10154565":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":27,"sentiment":28,"stance_mix":29,"scored_comments":34,"aspects":35,"strip":43,"post_text":46,"what":47,"said":87,"maker_in_thread":194,"shape":202,"grid":205,"attempts":289,"same_week":290,"maker_shows":245,"maker_hidden":320,"reader_version":321,"card":322},"10154565","Private Forms","PGP-Encrypted Webforms for Privacy-Conscious Receipients","title","Show HN: Private Forms: PGP-Encrypted Webforms for Privacy-Conscious Receipients","https:\u002F\u002Fprivateforms.com","privateforms.com","sjs382",1441131659,2015,60,41,469,2565,19,"notable","security_privacy","encrypted forms","web_app",[24,21,25,26],"pgp encryption","client-side encryption","privacy","mixed",-0.18,{"positive":30,"neutral":31,"mixed":32,"critical":33},2,11,0,10,23,{"execution":36,"privacy":38,"docs":40,"idea":41,"design":42},{"positive":37,"critical":30},1,{"positive":32,"critical":39},7,{"positive":32,"critical":32},{"positive":32,"critical":37},{"positive":32,"critical":32},[32,44,32,45,32,45,44,32,37,32,37,37,32,37,44,32,44,32,37,32,44,32,44,32,37,32,44,37,44,37,32,32,44,32,37,32,44,32,37,44],3,5,null,{"problem":48,"audience":55,"pricing":59,"motivation":65,"time_to_build":46,"stack":69,"openness":84,"stage":85,"team_size":86},{"value":49,"source":50,"evidence":51},"Lets senders submit private info via web forms encrypted to recipient's PGP key without the sender needing PGP tools","maker",[52],{"id":53,"by":11,"text":54},"10154572","Hi, HN! Founder here (on my 2nd \"startup\"). I strongly believe in the need for private communication, especially in the context of doctors-patients, clients-lawyers or…",{"value":56,"source":50,"evidence":57},"Doctors, lawyers, journalists and their clients or sources, and privacy-conscious recipients",[58],{"id":53,"by":11,"text":54},{"value":60,"source":50,"evidence":61},"Subscription plans with a 14-day trial",[62],{"id":63,"by":11,"text":64},"10157087","In response to user feedback, I've implemented a 14-day trial period for all subscription plans.",{"value":66,"source":50,"evidence":67},"Private communication is needed, but PGP places a heavy burden on senders",[68],{"id":53,"by":11,"text":54},[70,76],{"value":71,"source":50,"evidence":72},"kbpgp (Keybase's JavaScript PGP library)",[73],{"id":74,"by":11,"text":75},"10154953","I am. I'm making heavy usage of keybase.io's kbpgp: https:\u002F\u002Fkeybase.io\u002Fkbpgp",{"value":77,"source":78,"evidence":79},"jQuery, Moment, Bootstrap","commenter",[80],{"id":81,"by":82,"text":83},"10155973","bwblabs","I cannot try anything before entering my CC number (and paying, no free month or anything), nor finding any detailed information about the setup (apart from 'public\u002Fprivate key…","unknown","launched","solo",{"praise":88,"objections":100,"requests":138,"questions":160,"alternatives":179},[89,96],{"value":90,"source":78,"evidence":91},"Simple, easy to use product",[92],{"id":93,"by":94,"text":95},"10155353","nickpsecurity","You have an interesting product. I like the simplicity of it both in terms of ease-of-use and ability to make it more secure later. Are you intending to keep this thing going or…",{"value":97,"source":78,"evidence":98},"Good idea for privacy-conscious forms",[99],{"id":53,"by":11,"text":54},[101,114,121,131],{"value":102,"source":78,"evidence":103},"Client-side JavaScript still requires trusting the server to deliver honest code",[104,108,111],{"id":105,"by":106,"text":107},"10156760","MichaelGG","But the person entering form data - how do they know the JavaScript is OK? All users must trust the server to send js that'll encrypt correctly. This isn't visible to users. If…",{"id":109,"by":106,"text":110},"10158106","It does mean that users must explicitly and totally trust PF. From a customer standpoint, the product might as well encrypt on the server side (immediately discarding the…",{"id":112,"by":106,"text":113},"10157708","Forget even government attackers. The entire point of the product is to avoid trusting them. Except... you still utterly and totally trust them, as there's no way to verify what…",{"value":115,"source":78,"evidence":116},"Claims of no-trust are overstated; submissions are visible to the server before encryption if JS is compromised",[117],{"id":118,"by":119,"text":120},"10155786","bramblerose","> this way, not even we can view the form submissions That's not true. PF cannot view the submission \u002Fafter it has been submitted, assuming your javascript does what you say it…",{"value":122,"source":78,"evidence":123},"Datacenter security FAQ is confusing given client-side encryption",[124,128],{"id":125,"by":126,"text":127},"10155340","locacorten","The FAQ describes how the data center is using super-sophisticated security. Why is this necessary if the data is encrypted at the client? (perhaps I'm missing something about…",{"id":129,"by":126,"text":130},"10155472","I'm sorry but I beg to differ. Encryption is a very powerful tool -- the whole point of doing encryption at the client is that we don't care about data center security any more.…",{"value":132,"source":78,"evidence":133},"Form validation missing and example form 404s",[134],{"id":135,"by":136,"text":137},"10154734","davidcollantes","Submit with empty fields renders a 404 on the example.",[139,148,154],{"value":140,"source":78,"evidence":141},"Clarify trust model and limitations in FAQ",[142,145],{"id":143,"by":126,"text":144},"10156892","I like your answer because you're describing a new threat model: an adversary tries to subvert the encryption process. Their service does not protect against such a threat.…",{"id":146,"by":126,"text":147},"10155703","May I suggest you make this clear in the FAQ? In its current format, the FAQ makes it a big deal out of it without explaining that it's an additional security measure and that…",{"value":149,"source":78,"evidence":150},"Add form validation",[151],{"id":152,"by":136,"text":153},"10154800","Any reason why you are not validating the fields, to catch empty ones? Curious.",{"value":155,"source":50,"evidence":156},"Add warrant canary",[157],{"id":158,"by":11,"text":159},"10155823","That's an interesting (and accurate) point. An interested user could verify the source of the embedded page, and ensure that it doesn't change. This also doesn't protect the…",[161,168],{"value":162,"source":78,"evidence":163},"How do users verify keys and JavaScript are not tampered with?",[164,167],{"id":165,"by":106,"text":166},"10155523","How do users verify keys are correct and not being sent to your server?",{"id":105,"by":106,"text":107},{"value":169,"source":78,"evidence":170},"Is the project open source?",[171,175],{"id":172,"by":173,"text":174},"10154942","pipework","Are you using any open source projects? I'm deeply curious about how you're doing the encryption and am usually skeptical of in-browser cryptography, though I'd love to be able…",{"id":176,"by":177,"text":178},"10154929","daveloyall","Looks like it uses this internally: https:\u002F\u002Fgithub.com\u002Fkeybase\u002Fkbpgp Also, what's this? https:\u002F\u002Fgithub.com\u002Fkeybase\u002Fkbpgp\u002Fblob\u002Fmaster\u002FLICENSE",[180,187],{"value":181,"source":78,"evidence":182},"JotForm encrypted forms",[183],{"id":184,"by":185,"text":186},"10157193","aytekin","Another example to how good ideas come out at the same time! We have just recently released the exact same feature. Not all JotForm users use it but the users who use this…",{"value":188,"source":78,"evidence":189},"Mailvelope",[190],{"id":191,"by":192,"text":193},"10156690","bgibson","Cool. A few thoughts: 1. On the front page \"Only you have the encryption key\" could be confusing to folks new to PGP, consider instead \"Only you have the decryption key\". Then…",{"comments":195,"answered":39,"key":196},16,[197,198,199],{"id":53,"text":54},{"id":74,"text":75},{"id":200,"text":201},"10155420","I didn't build this looking to be acquired, but it would be silly not to be open minded at this early stage. Basically, I plan to continue working on this, while supplementing…",{"commenters":203,"max_depth":204,"maker_replies":195,"first_comment_mins":37,"lifespan_hours":203},15,6,[206,208,210,211,213,215,218,220,222,224,228,229,230,231,232,234,237,239,242,244,247,250,252,253,255,256,258,259,261,262,263,266,268,272,274,276,278,279,281,283,285],[53,32,32,207,11,37],"project\u002Fneutral\u002Fidea",[172,32,44,209,173,32],"maker\u002Fneutral\u002Fexecution",[74,32,32,209,11,37],[93,32,45,212,94,32],"project\u002Fpositive\u002Fexecution",[200,32,32,214,11,37],"maker\u002Fneutral\u002Fidea",[216,32,45,217,94,32],"10157221","project\u002Fpositive\u002Fnone",[165,32,44,219,106,32],"project\u002Fneutral\u002Fprivacy",[221,32,32,219,11,37],"10155559",[105,32,37,223,106,32],"project\u002Fcritical\u002Fprivacy",[225,32,32,226,227,32],"10157527","other\u002Fneutral\u002Fnone","ddoscampaign",[112,32,37,223,106,32],[118,32,37,223,119,32],[158,32,32,219,11,37],[109,32,37,223,106,32],[176,37,44,233,177,32],"project\u002Fneutral\u002Fnone",[235,37,32,236,11,37],"10155001","maker\u002Fneutral\u002Fdocs",[191,30,44,238,192,32],"project\u002Fneutral\u002Fdocs",[240,30,32,241,11,37],"10157108","project\u002Fneutral\u002Fexecution",[184,44,37,243,185,32],"project\u002Fcritical\u002Fidea",[63,245,32,246,11,37],4,"project\u002Fneutral\u002Fpricing",[248,45,44,238,249,32],"10156045","sigjuice",[251,45,32,236,11,37],"10156082",[125,204,44,219,126,32],[254,204,32,219,11,37],"10155409",[129,204,37,223,126,32],[257,204,32,219,11,37],"10155534",[146,204,44,238,126,32],[260,204,37,223,106,32],"10158144",[81,204,44,219,82,32],[143,204,37,223,126,32],[264,204,32,265,106,32],"10158120","commenter\u002Fneutral\u002Fprivacy",[267,204,32,246,11,37],"10157085",[269,39,44,270,271,32],"10154690","project\u002Fneutral\u002Fdesign","tortilla",[273,39,32,270,11,37],"10154711",[135,39,37,275,136,32],"project\u002Fcritical\u002Fexecution",[277,39,32,209,11,37],"10154791",[152,39,44,241,136,32],[280,39,32,241,11,37],"10154840",[282,39,37,275,82,32],"10156164",[284,39,32,241,11,37],"10154751",[286,287,44,207,288,32],"10156572",8,"philip1209",[],[291,296,301,306,311,316],{"id":292,"name":293,"points":294,"category":295},"10129137","Flarum",163,"web_saas",{"id":297,"name":298,"points":299,"category":300},"10143341","TubeNearYou",102,"consumer_social",{"id":302,"name":303,"points":304,"category":305},"10133832","Forms",82,"dev_tools",{"id":307,"name":308,"points":309,"category":310},"10159039","Javvy",77,"learning_science",{"id":312,"name":313,"points":314,"category":315},"10162121","instapainting.com",75,"ai",{"id":317,"name":318,"points":319,"category":295},"10145992","Hitcount.me",67,false,"v2",{"id":323,"name":5,"line":6,"ai":320,"cat":20,"year":13,"points":14,"comments":15,"rec":27,"s":28,"top":18,"kw":324,"maker":11,"domain":10,"tier":19,"attempts":32,"strip":325,"url":9,"mix":326,"praise":90,"objection":102,"sub":21},10154565,[24,21,25,26],"0305053010110130301030301031310030103013",[30,31,32,33],1793990930001]