4 ms·

My first thought was that this would be silly. Until I went inside and saw for myself. Very thought provoking, an exercise definitely worth my while. Until I

by edw519 16y ago

My first thought was that this would be silly. Until I went inside and saw for myself. Very thought provoking, an exercise definitely worth my while. Until I read this: We'll try our best to preserve your data, but no guarantees. Your canvas is secured by obscurity, which is to say it's not very secure at all. Anyone with your canvas' URL may view and edit it. If and when we add a paywall, we'll make sure you can export any existing data. Honestly, how hard would it be to just fix this first? I think you're really on the right track to something good. But until you fix this, I'll just use my own text editor to save my thoughts on my own hard drive.

robfitz 16y ago
Thanks for the feedback. I think that's more than fine. After all, paper is what I've been using until now ;). I wasn't really planning to "launch" this or anything. I pinged the lean startup mailing list to get feedback on the layout of the canvas, and it made its way here. Security certainly wouldn't have been difficult to fix, but it would have added a few days and locked me a little bit further into a canvas design that may-or-may-not be correct. So I started with the big risk first, and the other stuff with fall into place fairly soon.
gizmo 16y ago
> Honestly, how hard would it be to just fix this first? I thought it was a breath of fresh air. The unique ID is clearly very random and long enough to be unguessable. Even if the user and document hashes are not picked in a cryptographically secure way it's still going to be much more secure than the average alpha web 2.0 app that's hacked together with some generic login&auth component. I think you should be upset at products that do auth but do it insecurely, not those who make a conscious decision that a simple solution is good enough. Just look at the websites that don't hash passwords, that don't restrict login cookies to the domain of the app, that don't have SSL logins, and so on. There are a million points where it can go wrong, and even today it's pretty difficult to asses whether your application is secure. Think about it for a second. The security system the authors have chosen is almost impossible to mess up. Given how the hash looks I'm almost entirely sure they used some kind of crypto library to generate it. (If their magic ids looked like the output of randrange(100000, 900000) it would've been obvious). There is no other point of failure. If the hashes are random and unguessable, you're done! For a free product, I'd say that's pretty good! What you want is security, but what you ask for is a login page.
- robfitz 16y ago
  Thanks for making me seem far smarter than I am. My mental process was basically: "Etherpad was easy to use, I'll do that." (come on google, I'm just like them!) You can also type in a more memorable URL (like etherpad, trend emerging) but that, of course, makes it much more guessable.
- edw519 16y ago
  What you want is security, but what you ask for is a login page. Sorry if I didn't make it clear enough, but all I want is: 1. the ability to add, change, or delete my any of my data at any time 2. the ability to share my data with exactly whom I want, no more, no less OP guarantees neither (and, refreshingly, admits it). In fact, "We'll try our best to preserve your data, but no guarantees" and "not very secure at all" were his words, not mine. I was responding to his disclaimer, not my interpretation of his site's security. [FWIW, I use ramamia by hner's jasonlbaptiste and markbao, which has a great and appropriate implementation of unique id. But then again, I'm less concerned about the security of my family reunion plan than of my business plan.]
  - gizmo 16y ago
    I know you want to do (1) and (2), but my point is that you're not getting that from the other web 2.0 apps either. When you delete data perhaps only a is_deleted flag gets toggled in a database, and copies of your work may reside in backups for months or even years. When you want to share your data you want to be reasonably certain the app is secure, but there is no way for you to determine if this is the case. I'm saying that a very simple system with very obvious security implications may be preferable to a complex system. It's easy to get Open Auth wrong, it's easy to get logins wrong, and so on. Many apps will give you that login form and the share and delete buttons but chances are you would shudder at the thought of using the app if you knew what the backend looks like. About those remarks on the page. The first one, "We'll try our best to preserve your data", is the best you can hope for in any situation, and the second remark that the website isn't very secure at all is also truthful given that it doesn't even use SSL. So to reiterate, login forms on an app may make you feel more secure, but it won't bring you any closer to what you want.
khangtoh 16y ago
This can be solved easily with a passphrase so you enter the passphrase on the page and then permission is granted, not the best but makes it more secure. Still no TOS or anything saying that you ARE not giving up ownership of the data your enter.

by edw519 16y ago

robfitz 16y ago

Thanks for the feedback. I think that's more than fine. After all, paper is what I've been using until now ;). I wasn't really planning to "launch" this or anything. I pinged the lean startup mailing list to get feedback on the layout of the canvas, and it made its way here. Security certainly wouldn't have been difficult to fix, but it would have added a few days and locked me a little bit further into a canvas design that may-or-may-not be correct. So I started with the big risk first, and the other stuff with fall into place fairly soon.

gizmo 16y ago

> Honestly, how hard would it be to just fix this first? I thought it was a breath of fresh air. The unique ID is clearly very random and long enough to be unguessable. Even if the user and document hashes are not picked in a cryptographically secure way it's still going to be much more secure than the average alpha web 2.0 app that's hacked together with some generic login&auth component. I think you should be upset at products that do auth but do it insecurely, not those who make a conscious decision that a simple solution is good enough. Just look at the websites that don't hash passwords, that don't restrict login cookies to the domain of the app, that don't have SSL logins, and so on. There are a million points where it can go wrong, and even today it's pretty difficult to asses whether your application is secure. Think about it for a second. The security system the authors have chosen is almost impossible to mess up. Given how the hash looks I'm almost entirely sure they used some kind of crypto library to generate it. (If their magic ids looked like the output of randrange(100000, 900000) it would've been obvious). There is no other point of failure. If the hashes are random and unguessable, you're done! For a free product, I'd say that's pretty good! What you want is security, but what you ask for is a login page.

robfitz 16y ago
Thanks for making me seem far smarter than I am. My mental process was basically: "Etherpad was easy to use, I'll do that." (come on google, I'm just like them!) You can also type in a more memorable URL (like etherpad, trend emerging) but that, of course, makes it much more guessable.
edw519 16y ago
What you want is security, but what you ask for is a login page. Sorry if I didn't make it clear enough, but all I want is: 1. the ability to add, change, or delete my any of my data at any time 2. the ability to share my data with exactly whom I want, no more, no less OP guarantees neither (and, refreshingly, admits it). In fact, "We'll try our best to preserve your data, but no guarantees" and "not very secure at all" were his words, not mine. I was responding to his disclaimer, not my interpretation of his site's security. [FWIW, I use ramamia by hner's jasonlbaptiste and markbao, which has a great and appropriate implementation of unique id. But then again, I'm less concerned about the security of my family reunion plan than of my business plan.]
- gizmo 16y ago
  I know you want to do (1) and (2), but my point is that you're not getting that from the other web 2.0 apps either. When you delete data perhaps only a is_deleted flag gets toggled in a database, and copies of your work may reside in backups for months or even years. When you want to share your data you want to be reasonably certain the app is secure, but there is no way for you to determine if this is the case. I'm saying that a very simple system with very obvious security implications may be preferable to a complex system. It's easy to get Open Auth wrong, it's easy to get logins wrong, and so on. Many apps will give you that login form and the share and delete buttons but chances are you would shudder at the thought of using the app if you knew what the backend looks like. About those remarks on the page. The first one, "We'll try our best to preserve your data", is the best you can hope for in any situation, and the second remark that the website isn't very secure at all is also truthful given that it doesn't even use SSL. So to reiterate, login forms on an app may make you feel more secure, but it won't bring you any closer to what you want.

khangtoh 16y ago

This can be solved easily with a passphrase so you enter the passphrase on the page and then permission is granted, not the best but makes it more secure. Still no TOS or anything saying that you ARE not giving up ownership of the data your enter.