4 ms·

This is important! Thanks for asking! For non-technical users, we offer the ability to generate a key pair for you. But for more advanced (or more privacy-con

by sjs382 11y ago

This is important! Thanks for asking! For non-technical users, we offer the ability to generate a key pair for you. But for more advanced (or more privacy-conscious) users, we offer the ability to upload your public key (which is used to encrypt the form data). As far as decryption goes, form data is stored in our backend and you can decrypt it via the web app if you trust that we don't upload your private keys. We don't upload them—they're all stored in your browser's localstorage—but if you want to use the web app, you still have to trust us (if you're unable to verify that we don't upload them). The nice thing though, is that you don't need to use our web app to decrypt the messages—you can use any PGP-enabled email app, or the command line. We send all encrypted forms to you, via email, so you can choose how to decrypt them using your private keys. So, you can use PrivateForms in a way that you don't need to trust us at all. It's all "host-proof" in the way described here: https://www.passpack.com/blog/2008/03/host-proof-hosting/ https://www.passpack.com/blog/2008/03/host-proof-hosting/

MichaelGG 11y ago
But the person entering form data - how do they know the JavaScript is OK? All users must trust the server to send js that'll encrypt correctly. This isn't visible to users. If you server is compromised, there is no way for users to tell, right? What actual reduction in trust is there for users with this system, versus one where the encryption happens on the server? The only benefit I see is possibly some sort of legal thing or against an attacker that only has read access to server memory. What am I missing?
- ddoscampaign 11y ago
  If Snowden or IS uses this service, it's still possible for governments to take you to court Lavabit-style (minus SSL private key) (or Mega or PirateBay) and get a court order to shut you down unless you have colo/VPS hosting in Iceland, Sweden or similar jurisdiction and private DNS registration with a registrar independent from most corporate/diplomatic pressures (definitely not name.com, maybe what piratebay uses: https://www.binero.se https://www.binero.se or similar with less inflammatory/infamous clients). Privacy as a service/app cannot be sustainably delivered without being distributed, like TahoeLAFS or i2p. Company-run, centralized service/apps are SPOFs because they're at massive risk of being shutdown or blocked by friendly/unfriendly governments, at their whims, by whomever happens to be in power. The instant email option is partly distributed but the bigger risk is being in the US means US courts, FBI, local police, etc. can grab your provider's servers. name.com is also subject to both Irish and American laws. Unfortunately, most founders of privacy apps are business naïve and unable to manage their attack surface, making them easy prey to non-technical but more business-savvy folks. This resistance is further compounded by the sunk costs-bias, because what's done is seen as an immovable foundation which can never be torn down and, therefore, it must be worthwhile in the face of overwhelming contradictory evidence (e.g., 1950's lifestyle worship leads to cognitive dissonance with climate change). In reality, a venture should be a viewed as a never-ending collection experiments, where the assumptions may be turn out to be terrible to excellent (hopefully nearer to this) and trends/disruptions may move out from under it all. Good luck and I hope it makes a lot of money before it gets shutdown by Hillary or the Great Firewall of China.
  - MichaelGG 11y ago
    Forget even government attackers. The entire point of the product is to avoid trusting them. Except... you still utterly and totally trust them, as there's no way to verify what the form is actually doing.

by sjs382 11y ago

MichaelGG 11y ago

But the person entering form data - how do they know the JavaScript is OK? All users must trust the server to send js that'll encrypt correctly. This isn't visible to users. If you server is compromised, there is no way for users to tell, right? What actual reduction in trust is there for users with this system, versus one where the encryption happens on the server? The only benefit I see is possibly some sort of legal thing or against an attacker that only has read access to server memory. What am I missing?

ddoscampaign 11y ago
If Snowden or IS uses this service, it's still possible for governments to take you to court Lavabit-style (minus SSL private key) (or Mega or PirateBay) and get a court order to shut you down unless you have colo/VPS hosting in Iceland, Sweden or similar jurisdiction and private DNS registration with a registrar independent from most corporate/diplomatic pressures (definitely not name.com, maybe what piratebay uses: https://www.binero.se https://www.binero.se or similar with less inflammatory/infamous clients). Privacy as a service/app cannot be sustainably delivered without being distributed, like TahoeLAFS or i2p. Company-run, centralized service/apps are SPOFs because they're at massive risk of being shutdown or blocked by friendly/unfriendly governments, at their whims, by whomever happens to be in power. The instant email option is partly distributed but the bigger risk is being in the US means US courts, FBI, local police, etc. can grab your provider's servers. name.com is also subject to both Irish and American laws. Unfortunately, most founders of privacy apps are business naïve and unable to manage their attack surface, making them easy prey to non-technical but more business-savvy folks. This resistance is further compounded by the sunk costs-bias, because what's done is seen as an immovable foundation which can never be torn down and, therefore, it must be worthwhile in the face of overwhelming contradictory evidence (e.g., 1950's lifestyle worship leads to cognitive dissonance with climate change). In reality, a venture should be a viewed as a never-ending collection experiments, where the assumptions may be turn out to be terrible to excellent (hopefully nearer to this) and trends/disruptions may move out from under it all. Good luck and I hope it makes a lot of money before it gets shutdown by Hillary or the Great Firewall of China.
- MichaelGG 11y ago
  Forget even government attackers. The entire point of the product is to avoid trusting them. Except... you still utterly and totally trust them, as there's no way to verify what the form is actually doing.