7 ms·

> [...] because we encrypt everything client side, [...]. We get some pretty personnal stuff. How do you see what people post? Do you see people talking about

> [...] because we encrypt everything client side, [...]. We get some pretty personnal stuff. How do you see what people post? Do you see people talking about it, or do you have other means of determining what kind of content gets posted? Just curious; I'm sure your encryption is on point.

Qub3d 6y ago
From what I can see on the FAQ: >The goal of 0bin is not to protect the user and their data (including, obviously, their secrets). >Instead, it aims to protect the host from being sued for the content users pasted on the pastebin. The idea is that you cannot require somebody to moderate something they cannot read - as such, the host is granted plausible deniability. Honestly, the forwardness is refreshing.
nybble41 6y ago
The titles aren't encrypted. Perhaps people are putting personal data in the titles of their posts, or hinting at personal data in the encrypted portion? Which is still a problem since the code served by the site has access to the plaintext, even if it's not normally sent back to the server. It would be trivial to change the code to send the plaintext or encryption key to the server, or just weaken the encryption somehow. Even if you trust the site operators they could be ordered to implement a change like that with an NSL, and prohibited from talking about it. As they say in the FAQ, the encryption is there to provide plausible deniability for the operator of the site, not to protect the users' data.
- BiteCode_dev 6y ago
  Titles are rarely used, but I did receive emails of users saying "woops, can you delete this ?" with very personnal content. Which is why we implemented the delete feature (creating a paste gives you a cookie that allows deletion) recently because we don't want to spend time on customer service for a free site.
BiteCode_dev 6y ago
People post the full links (including the key) everywhere, so regularly, we google a bit to check what people use us for. This allowed us to discover we were pretty popular on the crypto community and in specific fan fic subreddits. Which lead us to implement btc tipping and reader mode. We also got reports, tickets, dmca, etc. We cannot brute force our thousands of paste encrypted payloads, but for a sample, it's easy to follow the bread crumbs. And if we do it, others do it too.

Qub3d 6y ago

From what I can see on the FAQ: >The goal of 0bin is not to protect the user and their data (including, obviously, their secrets). >Instead, it aims to protect the host from being sued for the content users pasted on the pastebin. The idea is that you cannot require somebody to moderate something they cannot read - as such, the host is granted plausible deniability. Honestly, the forwardness is refreshing.

nybble41 6y ago

The titles aren't encrypted. Perhaps people are putting personal data in the titles of their posts, or hinting at personal data in the encrypted portion? Which is still a problem since the code served by the site has access to the plaintext, even if it's not normally sent back to the server. It would be trivial to change the code to send the plaintext or encryption key to the server, or just weaken the encryption somehow. Even if you trust the site operators they could be ordered to implement a change like that with an NSL, and prohibited from talking about it. As they say in the FAQ, the encryption is there to provide plausible deniability for the operator of the site, not to protect the users' data.

BiteCode_dev 6y ago
Titles are rarely used, but I did receive emails of users saying "woops, can you delete this ?" with very personnal content. Which is why we implemented the delete feature (creating a paste gives you a cookie that allows deletion) recently because we don't want to spend time on customer service for a free site.

BiteCode_dev 6y ago

People post the full links (including the key) everywhere, so regularly, we google a bit to check what people use us for. This allowed us to discover we were pretty popular on the crypto community and in specific fan fic subreddits. Which lead us to implement btc tipping and reader mode. We also got reports, tickets, dmca, etc. We cannot brute force our thousands of paste encrypted payloads, but for a sample, it's easy to follow the bread crumbs. And if we do it, others do it too.