CryptoNote
Security and privacy
encrypted messaging
SHOW HN2013
55points
41comments
#461of 1,739 in 2013
Top 27%of 2013 by points
How HN took it
RoastedHalf or more of the comments are critical
3 positive, 1 neutral or asking, 1 mixed, 11 critical, out of 16 comments about the project. Thread score -0.35.
Privacy: 0 for, 7 againstDesign: 0 for, 2 againstIdea: 1 for, 1 againstExecution: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Useful, nice UI
From 2 comments
Looks useful. I am seeing though message[pre_encryption] with my unencrypted message in the POST data?
jhorman on HNThis is neat, and the I really like the UI too. I made something similar (except the one-time view part) not too long ago just to experiment with storing the base64 encoded…
alfg on HN
Objections
Client-side JavaScript crypto is untrustworthy because the server controls the code
From 3 comments
Good on you for having a list of known weaknesses, but here's the one that really makes this completely unsafe: The server dictates what's run on the page, and thus can access…
daeken on HNBut if you need to trust the server (and you do), then the client-side encryption is 100% pointless. You might as well encrypt on the server with safe, sane, battle-hardened…
daeken on HNClient-side crypto in JS has value if and only if the following conditions are all met: 1) The application receives no HTML, CSS, Javascript, or code interpreted by plugins from…
daeken on HN
Plaintext password and message sent in POST data
From 3 comments
Looks useful. I am seeing though message[pre_encryption] with my unencrypted message in the POST data?
jhorman on HNThe password is sent in plaintext in the POST body.
effbott on HNWhy is the password stored in plain text "for now"? What is so hard about running bcrypt or pbkdf2 against the password before storing it in the database?
deepdog on HN
Requests
Hash passwords with bcrypt or pbkdf2
From 1 comment
Why is the password stored in plain text "for now"? What is so hard about running bcrypt or pbkdf2 against the password before storing it in the database?
deepdog on HN
Add warnings about untrusted crypto
From 1 comment
Good on you for having a list of known weaknesses, but here's the one that really makes this completely unsafe: The server dictates what's run on the page, and thus can access…
daeken on HN
Questions
Why is the password stored in plain text?
From 1 comment
Why is the password stored in plain text "for now"? What is so hard about running bcrypt or pbkdf2 against the password before storing it in the database?
deepdog on HN
Alternatives named
vanish.io
From 1 comment
Just use vanish.io
ryandetzel on HN
oneshar.es
From 1 comment
Also see: https://oneshar.es I created a similar web application in Django as part of a College minor project last year. Best part was implementing the AES algorithm ourselves. :D
manish_gill on HN
jot (alfg.co)
From 1 comment
This is neat, and the I really like the UI too. I made something similar (except the one-time view part) not too long ago just to experiment with storing the base64 encoded…
alfg on HN