3 ms·
I'm sorry but I beg to differ. Encryption is a very powerful tool -- the whole point of doing encryption at the client is that we don't care about data center s
by locacorten 11y ago
I'm sorry but I beg to differ. Encryption is a very powerful tool -- the whole point of doing encryption at the client is that we don't care about data center security any more. As long as the data isn't lost, my data remains confidential. NSA, KGB, the Chinese hackers can't read my data. Period.
If you start telling me that I'm paying for security measures that have no effect on your service security guarantees, I think you're selling snake-oil.
At this point, I'm very reluctant to trust my data to your service.
- sjs382 11y agoYou aren't paying for it. It's provided my my server provider, DigitalOcean.
- locacorten 11y agoMay I suggest you make this clear in the FAQ? In its current format, the FAQ makes it a big deal out of it without explaining that it's an additional security measure and that client-side encryption alone is sufficient to protect the data.
- MichaelGG 11y agoThe client side crypto is only as strong as the server side security. If, as an example, I get DigitalOcean to reset the password on the VM (or any other way to access the web servers) then I can simply add another line to the JS to post the plaintext data to a server of my choice. Game over. You should use PF if you trust them not to be compromised (hacked or be malicious) and not to backdoor the software. It shouldn't hinge on the client side crypto.