4 ms·
Where does it say that? I see here - https://standardnotes.org/knowledge/2/what-is-end-to-end-encryption https://standardnotes.org/knowledge/2/what-is-end-to-e
by jan_Inkepa 6y ago
Where does it say that?
I see here - https://standardnotes.org/knowledge/2/what-is-end-to-end-encryption https://standardnotes.org/knowledge/2/what-is-end-to-end-enc... the claim is:
"Whenever we move your encrypted data over a network, in order to deliver services to you, it is sent over a strictly secure connection to only our private servers. Because this data is encrypted, we can't read it, and we can’t sell it."
(I use Standard Notes, and if there's some element of the security model that I'm misunderstanding, I'd like to know :) )
- astaza123 6y agoit doesn't say that anywhere indeed, but this is my understanding: if you reload the page your login is being preserved without re-entering your password. there's no way to maintain this without storing a key on the server (i.e. either the master key (MK), or a key that encrypts the MK, if the MK is stored locally
- sealeck 6y agoCan't you store it in LocalStorage or IndexedDB
- astaza123 6y agoyou can. however, i hope they don't store it unencrypted - it's a very bad security practice for many reasons. assuming they store it encrypted with a temporary session key, the session key will necessarily be on the server. honestly, storing it on the server in a session storage is not a big deal. my original points are that a) web security is hard b) web e2ee is sort of hype on practice
- sealeck 6y agoFrom what I understand they store it unencrypted on the web, but in the device's keychain when using the Desktop application.