10 ms·

Standard Notes is a phenomenal note taking app and one of the first to bring encryption in note taking. They take security very seriously and have multiple thir

Standard Notes is a phenomenal note taking app and one of the first to bring encryption in note taking. They take security very seriously and have multiple third party audits. With that said, the bad outweigh the good. I don't mean to be a pessimist here (SN is inspirational) but: 1. Their free plan is extremely lacking. You can't even try out many of their editors. 2. Their pro plan mostly only offers editors. I am not sure how having 3 kinds of rich text editors is helpful but they have them. 3. They don't allow any form of account recovery. Which sounds really epic on paper but once you forget your password, you lose all your data. 4. The feature parity between their different apps across platforms is abysmal. The android app is notoriously feature lacking compared to the Web version. (They did put out an update which hopefully changes things). 5. In my extensive usage of the app, conflicts are very normal. I have no issue with that but there's no way to resolve them without creating duplicate copies of the note which clutters up the UI. 5. the UX is poor. No right click on notes, no distraction free mode, no way to collapse the huge notes list. 6. Search and organization seems like an after thought. The only way to organize is via tags. Tags are nice and all but there's not much you can do with them. 7. Their pricing seems absurd. 8. The development seems to be going no where. They are active but many of the above issues are still not addressed. But as I said, it's not all bad. Most people won't notice the above in their initial usage. They have a solid app with okay features. If you are a new user looking for encrypted notes and all that hosh posh or just an alternative to SN, you should also give Notesnook[1][2] a try; it solves all of the above issues in a sensible way. Do note that I am the dev so I am obviously biased. It's not perfect but I think it is a better alternative. [1]https://notesnook.com/ https://notesnook.com/ [2]https://github.com/streetwriters/notesnook/ https://github.com/streetwriters/notesnook/ (it's not open source but the repo has some good FAQ that you might be interested in reading).

sillysaurusx 5y ago
Well yeah they don’t offer any account recovery — that’s a sign the encryption might be trustworthy. It’s only a negative if you don’t care about that.
- thecodrr 5y ago
  I myself thought no account recovery automatically meant safety. It sounds very cool. However, in the past week alone, around 10 users of Notesnook came asking for a way to recover their account because they had forgotten their password. I mean, why should privacy be at such a huge risk to users' data? For the tech savy, Notesnook offers account recovery by giving the user option (actual kind of forcing) to save the encryption key someplace safe. Not ideal, of course, but better than nothing.
  - mkl 5y ago
    So they download the encryption key (unprotected so no password needed) as a file, and they keep the file safe? That's the kind of thing I've been thinking about for an idea of mine. What did those 10 users ask about? How to use the encryption key file?
    - thecodrr 5y ago
      No, what the recovery key actually was because it asked for it in the recovery UI.
      - mkl 5y ago
        I see. Were they able to restore access once you explained? Or had they not saved it somewhere safe? I'm trying to understand the communication requirements around such a feature.
        thecodrr 5y ago
        For most of them it seemed unnecessary; people don't realize the meaning of client-side encryption. I try to keep explanations very short and to the point. > had they not saved it somewhere safe? I had to delete 2 user accounts because they hadn't saved the key at all. All others had saved and were able to recover access. However, most didn't even realize they had saved it until I asked them to check their phone storage. A normal user would do anything to get past dialogs and popups, including clicking on random buttons.
maxgashkov 5y ago
5.1. No keyboard shortcuts. Not even for a 'New Note': https://github.com/standardnotes/forum/issues/1119 https://github.com/standardnotes/forum/issues/1119 The refund process is not automatic either, be prepared for a back-and-forth with customer support if you want to cancel a subscription.
ipiz0618 5y ago
Thanks for posting! It checks most of the boxes for me. I've been using Simplenote which is perfect and minimal for note taking. But when I start to blog I find the lack of live preview and spellcheck inconvenient. Looking forward to the desktop apps and possibly offline support!
- thecodrr 5y ago
  > Thanks for posting! It checks most of the boxes for me. That's awesome. I am glad you liked it! > Looking forward to the desktop apps and possibly offline support! The desktop apps are coming soon. You can track our roadmap on Github: https://github.com/streetwriters/notesnook/blob/main/ROADMAP.md https://github.com/streetwriters/notesnook/blob/main/ROADMAP...
- Rebelgecko 5y ago
  If you're on a Mac, Simplenote works great in conjunction with Nvalt (a fork of Notational Velocity)
- bartvk 5y ago
  What's great about Simplenote, is that it's backed by a nice company that seems to be a good steward year in, year out. No unnecessary features, just continued stable maintenance.
- sealeck 5y ago
  There's also listed.to which is nice for blogging.
- aheckler 5y ago
  > But when I start to blog I find the lack of live preview and spellcheck inconvenient. What platform are you using Simplenote on? On macOS at least, you can write in Markdown and preview it with Cmd+Shift+P. Spellcheck also seems to work for me, but maybe that's a macOS thing and not specifically a Simplenote thing. Disclosure: I work at Automattic, but not on Simplenote.
  - ipiz0618 5y ago
Shacklz 5y ago
> 7. Their pricing seems absurd. I actually really like their pricing model. You can buy years in advance, and they occasionally offer steep discounts (I think I bought two decades in advance around new year?). In a time where more and more services offer me no other way than some crappy monthly subscription that I cannot pay in advance and without auto-renewal, this is really much appreciated. That being said, a lot of your points seem valid - I've started using SN quite some time ago and haven't really noticed any new features since (except for some editor-improvements). Organization is indeed something that probably could use some love, the tags do suffice for me personally (especially with that one extension that lets you create folders with tags), but barely. While I appreciate their stability with regards to UX (it looks/feels the same since forever), the features you mentioned (collapsing, rightclick-menu) would not hurt. Their 'lack of new features' however is, as far as I understood, somewhat intentional - back when I bought it I've read somewhere on the page that they explicitly have the philosophy to also say 'No' to new features if they think it threatens their guarantee of long-term stability/support. Which I think is a very admirable stance these days where short-term-KPIs seem to dominate entire industries.
- thecodrr 5y ago
  > Their 'lack of new features' however is, as far as I understood, somewhat intentional. Um that sounds great but I don't see how a simple thing like a "right-click menu" endangers longevity? All their talk of simplicity and yet they allow you to add a whole spreadsheet editor? I suppose adding editors is simple stuff that's why they have so many. Maybe longevity = less work? Features are not bad. Some features are necessary. Some features enhance the general user experience and even make things simpler. Stagnation is not longevity, it's just slow death. As for pricing: sure, the long term plan is appealing but they ask $9/mo? Which is the most expensive note taking app out there, I think. You buy for 5 years or 20 years but what if nothing in the service changes in 20 years but your situation/use case changes drastically as is normal? What do you do of the additional money you paid? You can't get it back. I don't think 5 year commitment speaks of longevity, that's just marketing. Longevity would be them taking the money after 5 years, not before. I personally love monthly models because I spend exactly the amount I need and I can stop/pause when I want and start it again when I want. Its freedom and there's no commitment. That's why I added only 1 monthly plan in Notesnook. A service should ask you to commit long term because the risk is always too high. Instead it should allow for multiple ways to get your data out in case it ever goes down. And if it goes down, you can be sure that you lose only 1 month of fees.
e3bc54b2 5y ago
I have tried many note-taking apps. From Evernote to Google Keep to OneNote to Standard notes yo plain old notepad to Zotero to Word and really honestly many more. If you say this list is all over the place, then that is because requirements vary depending on purpose, not the other way around. After almost a decade of experimenting, I have come to realise that the best note-taking tool by far is org-mode. It is free, it is extensible, it is not going anywhere in next decade+, it let's me encrypt on my own terms, it let's me store and share on my own terms, it is as lightweight or as heavyweight as I want, it can be as pretty or as ugly as I want, I can edit it anywhere, search and organization is ridiculously advanced compared to anything else out there (or everything else is ridiculously behind). Its biggest strength and arguably biggest weakness is its tied to Emacs. It is a horrible learning curve for beginners, which is why it took me a decade to get to org-mode in the first place, but once you have climbed that hill, you are basically on top of the world. Everybody serious about note-taking should give org-mode a try.
- scpedicini 5y ago
  I read the Wikipedia entry for it but it didn't really shed a lot of light on these types of questions: 1. Can I embed images and more specifically can I embed animated GIF files? 2. Can I embed MP3s and play them within the note? 3. Does it support rich text editor functionality including the ability to insert tables easily from programs like Microsoft excel? 4. Can I use multiple fonts in the same individual note including monospaced ones and broad support for Unicode? 5. Can I easily sync and edit the data on my iPad, then on my android phone without having to worry about where the data is stored? 6. Will it automatically OCR embedded images and allow me to do text searches across my entire set of notes based on that text? If the answer to most of these questions is no, then it doesn't sound like org-note is the best note taking editor as you claim, it just sounds like it's the best editor for your specific set of criteria which does not apply to all notetakers. And that's the problem with trying to narrow down the best note editing tool, it's such a broad area that every notetaker will have their own idiosyncratic needs and priorities. As for me, I have also experimented with a great deal of note editing utilities and the only one that has reasonably met most of my requirements is Evernote. EDIT: of course if the answer is yes, then I may just have a new favorite note editor.
mackrevinack 5y ago
the way they have their free and paid features separated seems pretty lame. with other note taking services, if i decide to go back to the free tier for a while it will still be useable for the most part but with standard notes i would lose basic features like the ability to organise notes or to edit them in the same way. so basically once you start paying you are locked in for life
ay 5y ago
I used the app quite actively for a couple of years and maybe had one conflict at most. Maybe I don’t do edits as intensely as you do. The free plan was perfectly adequate for the first year, then I explored the editors in the paid plan but found I got used to plain text much more so switched off all the add-ons. Was happy to compensate developers for a great app. Forgotten password recovery is very simple: Export an unencrypted backup on one device, delete the account from everywhere, recreate the account, reimport the backup. Search in a single big list worked absolutely fine for me but maybe it’s just the way my brain works :-) I didn’t notice much feature disparity but then again maybe I just like minimalism. Same about the UI - it’s perfect. Very fast and no clutter. Not sure what is absurd about their pricing. I paid the 5 year plan mainly as a token of thanks, because the app is absolutely perfect for my taste and use.
- thecodrr 5y ago
  It's great that SN works well for you but reading about your workarounds/compromises do not make SN better but you as a user better. For example, as you detailed, there is a way to recover your password but you have to do all the steps manually (although I still don't know how you are going to delete your account without your password...). > Same about the UI - it’s perfect. I am curious as to how no context menu for notes makes for a perfect UI for you. The point is of course there are workarounds and ways to make things work for you and that's okay for a free app. If you pay for a service, you want that service to do every thing you want because that's the whole point.
  - ay 5y ago
    All I care is a distributed text replication to all of the available platforms, with no lock-in and decent search. Standard notes does it perfectly. Context menu? Not sure what would I be using it for. But then again it’s my mode of operation. I also have Simplenote, which also works well, but the e2e encryption (and lack of account recovery!) is what attracts me to standard note. About the plan. The point is: the free plan is absolutely perfect for me, and I choose to pay just to say thanks for a great product. The only thing missing for me is ability to see multiple accounts merged in a single UI - that would allow very easy sharing of notes. For that I use iCloud or simplenote.
FiloSottile 5y ago
Is the cryptography protocol documented anywhere? The link on your website under the end-to-end heading leads to the Privacy Policy, that only mentions "XChaCha20-Poly1305-IETF & Argon2" which is far from enough details, especially for a closed source app with no audits. From the names it sounds like you use libsodium, which is good, but it doesn't make rolling your own protocol safe.
- thecodrr 5y ago
  We are a bit lacking on the documentation side currently. However, there is no new protocol. It says "XChaCha20-Poly1305-IETF & Argon2" because that's the core part. Everything else is standard. I'll write up a doc on how encryption + syncing works though. And I have full plans to open source the security related parts of the app.
cyberlab 5y ago
> 3. They don't allow any form of account recovery. Which sounds really epic on paper but once you forget your password, you lose all your data. I actually like this. It's not a misfeature, but a feature. Too often email is a single point of failure and it's how the bulk of account takeover attacks happen. Compromise an email account, and you compromise every account attached to that email. Just don't forget your password to Standard Notes. Can't be hard right?
- thecodrr 5y ago
  > It's not a misfeature, but a feature. It's inconvenient and unnecessary. I don't get what can be so hard about just giving the user the encryption key. In the recovery flow you can just ask the user for the recovery key to decrypt the data and reset the password. That's how Notesnook does it. The email can never become a single point of failure like this.
  - anaerobicover 5y ago
    If there is another piece of data that can be used in the same way as the password (or to override/reset the password) then it is completely equivalent to the password itself from a security perspective. If you can lose the password, what prevents you losing both the password and this secondary key at the same time? If you store them in separate places, then just store two copies of the original password in those two places.
    - thecodrr 5y ago
      What you say is right and that is how password managers work. However, human habit is that people generally keep their password in their heads. The point of giving a secondary key is that: 1. Since it is longer, the user is forced to store it in a file or some other place 2. The message behind "recovery key" is different to the "password" so users react different to it. Giving it more value and attention. 3. Encryption keys are still rare in clients so it stands out and the user again gives it more attention. With that said, it is entirely possible that the user won't save the key or lose it. In which case, nothing can be done. It isn't an ideal solution to account recovery problem but so far I have found this to be the only solution if you are going the zero-knowledge route.
Andrew_nenakhov 5y ago
> Standard Notes is a phenomenal note taking app and one of the first to bring encryption in note taking. They take security very seriously and have multiple third party audits. > They don't allow any form of account recovery. Which sounds really epic on paper but once you forget your password, you lose all your data. You can't have both. If the service has account recovery after you lose your password or encryption keys, it can only mean that there is no any meaningful encryption. Just don't lose your passwords, it's quite simple these days with passwords managers.
- thecodrr 5y ago
  > You can't have both. If the service has account recovery after you lose your password or encryption keys, it can only mean that there is no any meaningful encryption. Incorrect. Check Notesnook[1]. It solves both of those things. [1]https://notesnook.com/ https://notesnook.com/
  - actinium226 5y ago
    How do they achieve it?
    - thecodrr 5y ago
      Check this comment: https://news.ycombinator.com/item?id=26845877 https://news.ycombinator.com/item?id=26845877
  - Andrew_nenakhov 5y ago
    It is obvious that you misunderstand something. Please respond with how exactly they achieve this.
    - thecodrr 5y ago
      It's very simple. Since the encryption key is basically derived from your password, Notesnook allows you to backup the encryption key. This encryption key + a random salt is used to encrypt all the data client-side. In case you forget your password but have the encryption key somewhere safe, you can easily use the encryption key to have your data decrypted. Notesnook does the above by sending a recovery link to your email. After you click on the email, it authenticates you for a short period of time (30m) and shows the recovery UI. You can put your recovery key in the input. The app downloads the encrypted data from the server, decrypts using the key you gave, and if successful, asks you for a new password. Once you give the new password, it re-encrypts everything using the new encryption key. All this happens in 2 steps. You can try it out yourself.
DreamFlasher 5y ago
Looks like Notesnook doesn't support tree folder organization? And it's out.
seestraw 5y ago
Almost all the features you mentioned are related to UI. Personally, I'd rather have something that prioritizes no account recovery over too much UI magic. As long as they make it easy to move my data around (import/export), I'm not too worried. But yes, it would be nice to have a better rich text editor.

sillysaurusx 5y ago

Well yeah they don’t offer any account recovery — that’s a sign the encryption might be trustworthy. It’s only a negative if you don’t care about that.

thecodrr 5y ago
I myself thought no account recovery automatically meant safety. It sounds very cool. However, in the past week alone, around 10 users of Notesnook came asking for a way to recover their account because they had forgotten their password. I mean, why should privacy be at such a huge risk to users' data? For the tech savy, Notesnook offers account recovery by giving the user option (actual kind of forcing) to save the encryption key someplace safe. Not ideal, of course, but better than nothing.
- mkl 5y ago
  So they download the encryption key (unprotected so no password needed) as a file, and they keep the file safe? That's the kind of thing I've been thinking about for an idea of mine. What did those 10 users ask about? How to use the encryption key file?
  - thecodrr 5y ago
    No, what the recovery key actually was because it asked for it in the recovery UI.
    - mkl 5y ago
      I see. Were they able to restore access once you explained? Or had they not saved it somewhere safe? I'm trying to understand the communication requirements around such a feature.
      - thecodrr 5y ago
        For most of them it seemed unnecessary; people don't realize the meaning of client-side encryption. I try to keep explanations very short and to the point. > had they not saved it somewhere safe? I had to delete 2 user accounts because they hadn't saved the key at all. All others had saved and were able to recover access. However, most didn't even realize they had saved it until I asked them to check their phone storage. A normal user would do anything to get past dialogs and popups, including clicking on random buttons.

maxgashkov 5y ago

5.1. No keyboard shortcuts. Not even for a 'New Note': https://github.com/standardnotes/forum/issues/1119 https://github.com/standardnotes/forum/issues/1119 The refund process is not automatic either, be prepared for a back-and-forth with customer support if you want to cancel a subscription.

ipiz0618 5y ago

Thanks for posting! It checks most of the boxes for me. I've been using Simplenote which is perfect and minimal for note taking. But when I start to blog I find the lack of live preview and spellcheck inconvenient. Looking forward to the desktop apps and possibly offline support!

thecodrr 5y ago
> Thanks for posting! It checks most of the boxes for me. That's awesome. I am glad you liked it! > Looking forward to the desktop apps and possibly offline support! The desktop apps are coming soon. You can track our roadmap on Github: https://github.com/streetwriters/notesnook/blob/main/ROADMAP.md https://github.com/streetwriters/notesnook/blob/main/ROADMAP...
Rebelgecko 5y ago
If you're on a Mac, Simplenote works great in conjunction with Nvalt (a fork of Notational Velocity)
bartvk 5y ago
What's great about Simplenote, is that it's backed by a nice company that seems to be a good steward year in, year out. No unnecessary features, just continued stable maintenance.
sealeck 5y ago
There's also listed.to which is nice for blogging.
aheckler 5y ago
> But when I start to blog I find the lack of live preview and spellcheck inconvenient. What platform are you using Simplenote on? On macOS at least, you can write in Markdown and preview it with Cmd+Shift+P. Spellcheck also seems to work for me, but maybe that's a macOS thing and not specifically a Simplenote thing. Disclosure: I work at Automattic, but not on Simplenote.
- ipiz0618 5y ago

Shacklz 5y ago

> 7. Their pricing seems absurd. I actually really like their pricing model. You can buy years in advance, and they occasionally offer steep discounts (I think I bought two decades in advance around new year?). In a time where more and more services offer me no other way than some crappy monthly subscription that I cannot pay in advance and without auto-renewal, this is really much appreciated. That being said, a lot of your points seem valid - I've started using SN quite some time ago and haven't really noticed any new features since (except for some editor-improvements). Organization is indeed something that probably could use some love, the tags do suffice for me personally (especially with that one extension that lets you create folders with tags), but barely. While I appreciate their stability with regards to UX (it looks/feels the same since forever), the features you mentioned (collapsing, rightclick-menu) would not hurt. Their 'lack of new features' however is, as far as I understood, somewhat intentional - back when I bought it I've read somewhere on the page that they explicitly have the philosophy to also say 'No' to new features if they think it threatens their guarantee of long-term stability/support. Which I think is a very admirable stance these days where short-term-KPIs seem to dominate entire industries.

thecodrr 5y ago
> Their 'lack of new features' however is, as far as I understood, somewhat intentional. Um that sounds great but I don't see how a simple thing like a "right-click menu" endangers longevity? All their talk of simplicity and yet they allow you to add a whole spreadsheet editor? I suppose adding editors is simple stuff that's why they have so many. Maybe longevity = less work? Features are not bad. Some features are necessary. Some features enhance the general user experience and even make things simpler. Stagnation is not longevity, it's just slow death. As for pricing: sure, the long term plan is appealing but they ask $9/mo? Which is the most expensive note taking app out there, I think. You buy for 5 years or 20 years but what if nothing in the service changes in 20 years but your situation/use case changes drastically as is normal? What do you do of the additional money you paid? You can't get it back. I don't think 5 year commitment speaks of longevity, that's just marketing. Longevity would be them taking the money after 5 years, not before. I personally love monthly models because I spend exactly the amount I need and I can stop/pause when I want and start it again when I want. Its freedom and there's no commitment. That's why I added only 1 monthly plan in Notesnook. A service should ask you to commit long term because the risk is always too high. Instead it should allow for multiple ways to get your data out in case it ever goes down. And if it goes down, you can be sure that you lose only 1 month of fees.

e3bc54b2 5y ago

I have tried many note-taking apps. From Evernote to Google Keep to OneNote to Standard notes yo plain old notepad to Zotero to Word and really honestly many more. If you say this list is all over the place, then that is because requirements vary depending on purpose, not the other way around. After almost a decade of experimenting, I have come to realise that the best note-taking tool by far is org-mode. It is free, it is extensible, it is not going anywhere in next decade+, it let's me encrypt on my own terms, it let's me store and share on my own terms, it is as lightweight or as heavyweight as I want, it can be as pretty or as ugly as I want, I can edit it anywhere, search and organization is ridiculously advanced compared to anything else out there (or everything else is ridiculously behind). Its biggest strength and arguably biggest weakness is its tied to Emacs. It is a horrible learning curve for beginners, which is why it took me a decade to get to org-mode in the first place, but once you have climbed that hill, you are basically on top of the world. Everybody serious about note-taking should give org-mode a try.

scpedicini 5y ago
I read the Wikipedia entry for it but it didn't really shed a lot of light on these types of questions: 1. Can I embed images and more specifically can I embed animated GIF files? 2. Can I embed MP3s and play them within the note? 3. Does it support rich text editor functionality including the ability to insert tables easily from programs like Microsoft excel? 4. Can I use multiple fonts in the same individual note including monospaced ones and broad support for Unicode? 5. Can I easily sync and edit the data on my iPad, then on my android phone without having to worry about where the data is stored? 6. Will it automatically OCR embedded images and allow me to do text searches across my entire set of notes based on that text? If the answer to most of these questions is no, then it doesn't sound like org-note is the best note taking editor as you claim, it just sounds like it's the best editor for your specific set of criteria which does not apply to all notetakers. And that's the problem with trying to narrow down the best note editing tool, it's such a broad area that every notetaker will have their own idiosyncratic needs and priorities. As for me, I have also experimented with a great deal of note editing utilities and the only one that has reasonably met most of my requirements is Evernote. EDIT: of course if the answer is yes, then I may just have a new favorite note editor.

mackrevinack 5y ago

the way they have their free and paid features separated seems pretty lame. with other note taking services, if i decide to go back to the free tier for a while it will still be useable for the most part but with standard notes i would lose basic features like the ability to organise notes or to edit them in the same way. so basically once you start paying you are locked in for life

ay 5y ago

I used the app quite actively for a couple of years and maybe had one conflict at most. Maybe I don’t do edits as intensely as you do. The free plan was perfectly adequate for the first year, then I explored the editors in the paid plan but found I got used to plain text much more so switched off all the add-ons. Was happy to compensate developers for a great app. Forgotten password recovery is very simple: Export an unencrypted backup on one device, delete the account from everywhere, recreate the account, reimport the backup. Search in a single big list worked absolutely fine for me but maybe it’s just the way my brain works :-) I didn’t notice much feature disparity but then again maybe I just like minimalism. Same about the UI - it’s perfect. Very fast and no clutter. Not sure what is absurd about their pricing. I paid the 5 year plan mainly as a token of thanks, because the app is absolutely perfect for my taste and use.

thecodrr 5y ago
It's great that SN works well for you but reading about your workarounds/compromises do not make SN better but you as a user better. For example, as you detailed, there is a way to recover your password but you have to do all the steps manually (although I still don't know how you are going to delete your account without your password...). > Same about the UI - it’s perfect. I am curious as to how no context menu for notes makes for a perfect UI for you. The point is of course there are workarounds and ways to make things work for you and that's okay for a free app. If you pay for a service, you want that service to do every thing you want because that's the whole point.
- ay 5y ago
  All I care is a distributed text replication to all of the available platforms, with no lock-in and decent search. Standard notes does it perfectly. Context menu? Not sure what would I be using it for. But then again it’s my mode of operation. I also have Simplenote, which also works well, but the e2e encryption (and lack of account recovery!) is what attracts me to standard note. About the plan. The point is: the free plan is absolutely perfect for me, and I choose to pay just to say thanks for a great product. The only thing missing for me is ability to see multiple accounts merged in a single UI - that would allow very easy sharing of notes. For that I use iCloud or simplenote.

FiloSottile 5y ago

Is the cryptography protocol documented anywhere? The link on your website under the end-to-end heading leads to the Privacy Policy, that only mentions "XChaCha20-Poly1305-IETF & Argon2" which is far from enough details, especially for a closed source app with no audits. From the names it sounds like you use libsodium, which is good, but it doesn't make rolling your own protocol safe.

thecodrr 5y ago
We are a bit lacking on the documentation side currently. However, there is no new protocol. It says "XChaCha20-Poly1305-IETF & Argon2" because that's the core part. Everything else is standard. I'll write up a doc on how encryption + syncing works though. And I have full plans to open source the security related parts of the app.

cyberlab 5y ago

> 3. They don't allow any form of account recovery. Which sounds really epic on paper but once you forget your password, you lose all your data. I actually like this. It's not a misfeature, but a feature. Too often email is a single point of failure and it's how the bulk of account takeover attacks happen. Compromise an email account, and you compromise every account attached to that email. Just don't forget your password to Standard Notes. Can't be hard right?

thecodrr 5y ago
> It's not a misfeature, but a feature. It's inconvenient and unnecessary. I don't get what can be so hard about just giving the user the encryption key. In the recovery flow you can just ask the user for the recovery key to decrypt the data and reset the password. That's how Notesnook does it. The email can never become a single point of failure like this.
- anaerobicover 5y ago
  If there is another piece of data that can be used in the same way as the password (or to override/reset the password) then it is completely equivalent to the password itself from a security perspective. If you can lose the password, what prevents you losing both the password and this secondary key at the same time? If you store them in separate places, then just store two copies of the original password in those two places.
  - thecodrr 5y ago
    What you say is right and that is how password managers work. However, human habit is that people generally keep their password in their heads. The point of giving a secondary key is that: 1. Since it is longer, the user is forced to store it in a file or some other place 2. The message behind "recovery key" is different to the "password" so users react different to it. Giving it more value and attention. 3. Encryption keys are still rare in clients so it stands out and the user again gives it more attention. With that said, it is entirely possible that the user won't save the key or lose it. In which case, nothing can be done. It isn't an ideal solution to account recovery problem but so far I have found this to be the only solution if you are going the zero-knowledge route.

Andrew_nenakhov 5y ago

> Standard Notes is a phenomenal note taking app and one of the first to bring encryption in note taking. They take security very seriously and have multiple third party audits. > They don't allow any form of account recovery. Which sounds really epic on paper but once you forget your password, you lose all your data. You can't have both. If the service has account recovery after you lose your password or encryption keys, it can only mean that there is no any meaningful encryption. Just don't lose your passwords, it's quite simple these days with passwords managers.

thecodrr 5y ago
> You can't have both. If the service has account recovery after you lose your password or encryption keys, it can only mean that there is no any meaningful encryption. Incorrect. Check Notesnook[1]. It solves both of those things. [1]https://notesnook.com/ https://notesnook.com/
- actinium226 5y ago
  How do they achieve it?
  - thecodrr 5y ago
    Check this comment: https://news.ycombinator.com/item?id=26845877 https://news.ycombinator.com/item?id=26845877
- Andrew_nenakhov 5y ago
  It is obvious that you misunderstand something. Please respond with how exactly they achieve this.
  - thecodrr 5y ago
    It's very simple. Since the encryption key is basically derived from your password, Notesnook allows you to backup the encryption key. This encryption key + a random salt is used to encrypt all the data client-side. In case you forget your password but have the encryption key somewhere safe, you can easily use the encryption key to have your data decrypted. Notesnook does the above by sending a recovery link to your email. After you click on the email, it authenticates you for a short period of time (30m) and shows the recovery UI. You can put your recovery key in the input. The app downloads the encrypted data from the server, decrypts using the key you gave, and if successful, asks you for a new password. Once you give the new password, it re-encrypts everything using the new encryption key. All this happens in 2 steps. You can try it out yourself.

DreamFlasher 5y ago

Looks like Notesnook doesn't support tree folder organization? And it's out.

seestraw 5y ago

Almost all the features you mentioned are related to UI. Personally, I'd rather have something that prioritizes no account recovery over too much UI magic. As long as they make it easy to move my data around (import/export), I'm not too worried. But yes, it would be nice to have a better rich text editor.