3 ms·
What you found are just bugs. But their main point is indeed security - compared to say simplenote. Here everything is indeed encrypted and they have no way of
by golanggeek 10y ago
What you found are just bugs. But their main point is indeed security - compared to say simplenote. Here everything is indeed encrypted and they have no way of reading our data
- pvg 10y agoAre they just bugs? encryptText(text, key) { var keyData = CryptoJS.enc.Hex.parse(key); var ivData = CryptoJS.enc.Hex.parse(""); var encrypted = CryptoJS.AES.encrypt(text, keyData, { iv: ivData, mode: CryptoJS.mode.CBC [...] The basic encryption operation seems to be AES CBC with a constant, reused IV.
- mobitar 10y agoItems are encrypted with random keys. No two items are ever encrypted with same key. Thus no need for IV, and makes implementations across platforms simpler.
- pvg 10y agoIs there actually any description of how you're encrypting, how you manage and distribute keys, why you believe this is secure, why you're not using an authenticated mode, etc? "Thus no need for IV" when your desktop client just pulls a minified blob from somewhere is not particularly reassuring.
- mobitar 10y agoYes, it's all here: http://standardfile.org/#encryption http://standardfile.org/#encryption
- dotancohen 10y ago> What you found are just bugs. Most security issues are. Unless you have an extensive background in application security, especially on the stack that you are using (Electron, etc), then don't advertise security as a feature. Let someone else who knows how to crack 'secure' apps decide if your app is secure or not. As Bruce Schneier famously quipped, anyone can invent a security system that he himself cannot break.