4 ms·

Two things: 1. Don't just use cryptography, understand how Zero Knowledge encryption works. These 1 minute animated explainer videos do a good job: http://gun.

Two things: 1. Don't just use cryptography, understand how Zero Knowledge encryption works. These 1 minute animated explainer videos do a good job: http://gun.js.org/explainers/data/security.html http://gun.js.org/explainers/data/security.html 2. We used the URL hash method they mention in the cryptpad article to create a beautifully simple P2P payment system (direct bank to bank deposits, no fees), completely end-to-end encrypted: checkard.com It works and is a lot easier than people may think / expect to build!

dredmorbius 10y ago
I haven't bothered with the video, but the website is not only wrong but grossly ungrammatical. "Most websites you use today have fake security. When you log onto their service, your password gets sent up to their proprietary servers. There they check to see if it is correct and grant you access to YOUR data." "Sure, their servers might be in a top secret location. But the problem is that they know your password. Which means any bad actor, like a rogue employee, a hacker, or a government agency can snoop on your data without you knowing." This manages to both mis-state how good password practices (hashes and salts) work[1], or what their ultimate failure mode is: your data are still sitting on someone else's server unencrypted. The password, however well hashed or salted, isn't proof against a warrant, hack, insider actions, or poor media disposal. But given the elementary errors in the text, I'm pretty confident the video is not worth watching. ________________________________ Notes: 1. See e.g., https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet
- marknadal 10y ago
  We talk about hashes and salt in another episode. You can't cover everything in 1 minute, especially when you want a 5 year old to be able to understand as well. The text is the transcript, which is intentionally conversational not a formal essay. Maybe it is a good idea for us to change it though. If your philosophy in life is to ignore learning ideas because you are offended by a grammar error, then you are probably right to skip out, the video isn't targeted at people like that.
  - dredmorbius 10y ago
    Grammar is an honest signal. It's not surefire, but the scope of errors here portends quite poorly for the material. Given issues of the modern Web, including the absolute deluge of information, finding credible and worthwhile sources is itself a challenge. Communication -- writing or otherwise -- should be done for the benefit of the reader or audience. To borrow from another item on HN presently (concerning writing manuals).

dredmorbius 10y ago

I haven't bothered with the video, but the website is not only wrong but grossly ungrammatical. "Most websites you use today have fake security. When you log onto their service, your password gets sent up to their proprietary servers. There they check to see if it is correct and grant you access to YOUR data." "Sure, their servers might be in a top secret location. But the problem is that they know your password. Which means any bad actor, like a rogue employee, a hacker, or a government agency can snoop on your data without you knowing." This manages to both mis-state how good password practices (hashes and salts) work[1], or what their ultimate failure mode is: your data are still sitting on someone else's server unencrypted. The password, however well hashed or salted, isn't proof against a warrant, hack, insider actions, or poor media disposal. But given the elementary errors in the text, I'm pretty confident the video is not worth watching. ________________________________ Notes: 1. See e.g., https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet

marknadal 10y ago
We talk about hashes and salt in another episode. You can't cover everything in 1 minute, especially when you want a 5 year old to be able to understand as well. The text is the transcript, which is intentionally conversational not a formal essay. Maybe it is a good idea for us to change it though. If your philosophy in life is to ignore learning ideas because you are offended by a grammar error, then you are probably right to skip out, the video isn't targeted at people like that.
- dredmorbius 10y ago
  Grammar is an honest signal. It's not surefire, but the scope of errors here portends quite poorly for the material. Given issues of the modern Web, including the absolute deluge of information, finding credible and worthwhile sources is itself a challenge. Communication -- writing or otherwise -- should be done for the benefit of the reader or audience. To borrow from another item on HN presently (concerning writing manuals).