4 ms·

> we're not trying to pretend something and actually use data is a bad way When it comes to privacy, people actually want to know that YOU can't be exploited t

> we're not trying to pretend something and actually use data is a bad way When it comes to privacy, people actually want to know that YOU can't be exploited to giving information. If you can access something, what prevents someone from hacking your system and getting our data? That's the point, not your intent. It's that you are an attack vector now. What are you doing to mitigate this?

nathanganser 6y ago
Gotcha, makes sense. I just wanted to clarify this. We're really doing everything we can to make sure the data you share with us is safe. Encrypting google access tokens, updating passwords regularly and using 2FA are a few examples. But then, we're not un-hackable of course. Risk 0 does not exist and that's something every user is and should be aware of. We don't have the same budget for security as big companies and even they get hacked. I do not think that we host the kind of data that a hacker would like to acquire. Notes we take are usually pretty low-risk data. This is what protects us the most probably.
- heimatau 6y ago
  > I do not think that we host the kind of data that a hacker would like to acquire Please don't minimize this. You lose trust when you minimize a valid concern. > Risk 0 does not exist If someone is willing to educate you on the matter, they might already know such trivial things. Which is why I initially said 'what are you doing to minimize this'. You mentioned some above. I'd encourage you to look into more techniques to minimize it even further. This would build trust with whom you are asking to spend money with you.
  - nathanganser 6y ago
    Thanks for the feedback! We'll always work on making our app more secure! We can only succeed at building a long lasting business if we're able to build trust with our users.
- jlokier 6y ago
  > Notes we take are usually pretty low-risk data "Usually". The notes I take sometimes contain PII (personally identifying information) about other people, sometimes notes about things I'm investigating for someone that they would be distressed to find had ended up "on the internet", and sometimes commercial secrets (about jobs, clients etc that they share with me under NDA). And I'm just a lowly programmer and dogsbody doing random client work. Now consider a therapist finds your product useful for their personal notes, and doesn't realise what they are getting into. That would end up a small version of this awful incident: https://news.ycombinator.com/item?id=24886039 https://news.ycombinator.com/item?id=24886039 > I do not think that we host the kind of data that a hacker would like to acquire Hackers don't tend to go for data they would find valuable themselves. They go for data the author of the data finds valuable for themselves (which notes may be by definition), or just as likely, specifically don't want anyone else to read. An example of the former is all those ransomware attacks. An example of the latter is the above link to the private notes blackmail incident.

nathanganser 6y ago

Gotcha, makes sense. I just wanted to clarify this. We're really doing everything we can to make sure the data you share with us is safe. Encrypting google access tokens, updating passwords regularly and using 2FA are a few examples. But then, we're not un-hackable of course. Risk 0 does not exist and that's something every user is and should be aware of. We don't have the same budget for security as big companies and even they get hacked. I do not think that we host the kind of data that a hacker would like to acquire. Notes we take are usually pretty low-risk data. This is what protects us the most probably.

heimatau 6y ago
> I do not think that we host the kind of data that a hacker would like to acquire Please don't minimize this. You lose trust when you minimize a valid concern. > Risk 0 does not exist If someone is willing to educate you on the matter, they might already know such trivial things. Which is why I initially said 'what are you doing to minimize this'. You mentioned some above. I'd encourage you to look into more techniques to minimize it even further. This would build trust with whom you are asking to spend money with you.
- nathanganser 6y ago
  Thanks for the feedback! We'll always work on making our app more secure! We can only succeed at building a long lasting business if we're able to build trust with our users.
jlokier 6y ago
> Notes we take are usually pretty low-risk data "Usually". The notes I take sometimes contain PII (personally identifying information) about other people, sometimes notes about things I'm investigating for someone that they would be distressed to find had ended up "on the internet", and sometimes commercial secrets (about jobs, clients etc that they share with me under NDA). And I'm just a lowly programmer and dogsbody doing random client work. Now consider a therapist finds your product useful for their personal notes, and doesn't realise what they are getting into. That would end up a small version of this awful incident: https://news.ycombinator.com/item?id=24886039 https://news.ycombinator.com/item?id=24886039 > I do not think that we host the kind of data that a hacker would like to acquire Hackers don't tend to go for data they would find valuable themselves. They go for data the author of the data finds valuable for themselves (which notes may be by definition), or just as likely, specifically don't want anyone else to read. An example of the former is all those ransomware attacks. An example of the latter is the above link to the private notes blackmail incident.