16 ms·
Show HN: I made a free, ad-free and open source tool for sharing private notes
- deleted 5y ago[deleted]
- ransom1538 5y agoI just want to say @gigamick these burn systems are powerful. You might get divorced some day. You might have a business partner subpoena your old gmail account. ALL those emails/texts will be turned over, ALL those emails/texts will get leaked. Use something like this! Make the message burn after reading.
- motoxpro 5y agoGeeze, how much gnarly stuff are you doing?!
- ckpcw 5y agonice project, but I prefer the approach of https://privnote.com https://privnote.com notes are encrypted client-side before sending, click-to-read prevents scraper burn, auto-delete after 30days
- gigamick 5y agoI also really like privnote but I don't think a service such as this should be carrying really shitty ads.
- Mrovel 5y agoGgg
- macintux 5y agoVery cool, but the FAQ doesn’t address the questions people will ask: open source is fine, but what guarantee do we have that the source code matches the deployed code? Or that the deployment is done in a secure environment?
- rank0 5y agoYou have to implement the encryption logic client side. But then now the client has to verify the JavaScript they receive upon visiting the URL matches what is published in the open repository. I’m not sure what convenient method exists to do this for the client. You’d have to compare hashes and idk how that could be done in a easy and trustworthy manor.
- gigamick 5y agoThis is a problem for all OSS and it's something ive been pondering but I don't know how to satisfy this concern.
- annoyingnoob 5y agoIf its really all open source, the way you know is to roll your own.
- joemazerino 5y agoIf your threat model is the service roll your own. Otherwise, trust but verify.
- annoyingnoob 5y agoIn this case, verify how? Ask and trust the answer?
- corycal 5y ago> what guarantee do we have that the source code matches the deployed code? What is the answer to this question in general? Genuinely asking, I never considered this but it seems like a real concern for any OSS.
- macintux 5y agoI don't know that there is an answer, but I'd think the FAQ should at least mention the concern.
- mmh0000 5y agoFYI if I post 1MB of data it explodes and dumps a full stack trace. May not be something you want exposed. SQLSTATE[22001]: String data, right truncated: 1406 Data too long for column 'note' at row 1 (SQL: insert into `notes` (`note`, `password`, `user_id`, `token`, `updated_at`, `created_at`) values ...SNIP...
- deleted 5y ago[deleted]
- gigamick 5y agoAmazing feedback - which is exactly my reason for posting here. I'll address and get back to you.
- woodruffw 5y agoAES-CBC for quick and dirty encryption can be a red flag: the scheme needs to include an encrypt-then-MAC phase or it'll be vulnerable to padding oracle attacks. I tried to do a quick scan of the code[1] to determine whether it does that, but I couldn't locate it, possibly because my PHP comprehension is terrible. [1]: https://github.com/GigaMick/burnernote https://github.com/GigaMick/burnernote
- woodruffw 5y agoUpdate: As far as I can tell, this is the encryption encrypoint[1]. It does seem to be vulnerable to a padding oracle attack, unless the `$request->note` parameter is something much more complicated than it appears to be (i.e., it appears to be the plaintext). It's always great to see people experiment with encryption (and burn-after-use schemes are very cool!) but, absent of further information, I think it's actively dangerous to encourage people to use this. Edit: It might also be a stretch to call this a "burn-after-use" scheme: there's no affirmative proof of a note's destruction on the server side. It seems to just update the database to mark the note as empty and deleted[2]. [1]: https://github.com/GigaMick/burnernote/blob/6c01eddfc5195b15f3d44b1c6a935eb403cbd26a/app/Http/Controllers/NoteController.php#L23 https://github.com/GigaMick/burnernote/blob/6c01eddfc5195b15... [2]: https://github.com/GigaMick/burnernote/blob/6c01eddfc5195b15f3d44b1c6a935eb403cbd26a/app/Http/Controllers/NoteController.php#L50-L54 https://github.com/GigaMick/burnernote/blob/6c01eddfc5195b15...
- woodruffw 5y agoAnother update: it looks like it uses Laravel's encryption API under the hood, which does indeed perform encrypt-then-MAC[1]. So this is probably not vulnerable to a padding oracle attack. But that wasn't obvious from the description, and it gave me a decent fright :-) [1]: https://laravel.com/docs/8.x/encryption#encrypting-a-value https://laravel.com/docs/8.x/encryption#encrypting-a-value
- gigamick 5y agoSo are you saying this is a good thing? You think I should highlight this?
- AnonC 5y ago> On clicking the link and opening your note, it is deleted instantly and completely from our database. Gone forever. I worry about using such services when it comes to sending the note links over email or chat platforms, where the messaging platform may crawl the link and have the content destroyed before the human user has had a chance to see it. Has anyone encountered this on other secret sharing platforms? Using a password that’s not part of the link would prevent from that happening, but I see that it’s optional in this solution.
- gigamick 5y agoGreat feedback. Thank you. TBH I have never seen this happen in all my years of using services like these but its defo a worthwhile consideration.
- bachmeier 5y agoYes, this is an issue. I wrote my own service that I run on my own web server for this type of message. Outlook webmail includes a convenient link preview by default. When someone opened the link, the message was already deleted. I solved it by emailing a link to the link.
- gigamick 5y agoI've no resolved this issue in the same way that other similar products do; I have added a "are you sure you want to read this" screen. Problem resolved :-)
- adolph 5y agoIncoming CSAM.b64 in 3, 2, 1 . . .
- rntksi 5y agoNice gigamick. This has a problem though, when you paste that link in a chat window (e.g. WhatsApp, Telegram, Discord, ...), the app tries to get a link preview. This has the side effect of also expiring the note. I think it's best to implement a feature to detect whether it's a human opening the link or a bot.
- snerbles 5y agoCan confirm this happens with Matrix/Element. Amusingly, the brief contents of the note are visible in the preview along with "This note has now been permanently deleted".
- gigamick 5y agohaha ok this is something I will remedy. As stated in other replies, the reason for posting here was to get feedback and improve the product (I just put to together over the weekend there)
- slowmotiony 5y agoHello, the way that privnote deals with it is by showing a page asking "Do you want to read this note and burn it?". That will solve the issue of preview apps expiring your notes.
- gigamick 5y agoThis is what I done! I realised this morning as I was in a McDonalds drive thru queue how easy it would be to solve just by adding an "are you sure" screen.
- gigamick 5y agoThis issue now resolved :-)
- rntksi 5y ago
- amiamigo 5y agoPretty cool. What's the tech stack for this?
- gigamick 5y agoLaravel only, basically.
- 28uwedj 5y agoYo, this is in "DEV" or "STAGING" mode, and made with laravel https://burnernote.com/create-note https://burnernote.com/create-note
- 28uwedj 5y agoDO NOT USE THIS SITE: 1. Create Note with the contents <script>alert(1);</script> 2. Go to link 3. this site is a massive security flaw.
- gigamick 5y agoThis is exactly why I posted here. Thank you so much for this feedback. Will fix and let you know.
- teitoklien 5y agoYour laravel php framework debug messages are being exposed to users. Cool site tho, Have a lovely week.
- gigamick 5y agoThis issue now resolved.
- svenfaw 5y agoTo clarify, why is being able to display an alert a massive security flaw in this context?
- retube 5y agoThe alert itself is harmless, but demonstrates that arbitrary javascript - which could certainly not be harmless - can be injected into the page.
- mynameismon 5y agoIt's not the ability to display alerts that is concerning, but rather, the ability to run untrusted Javascript. This was a proof of concept that showed that it has a serious XSS vulnerability
- seedie 5y agoFor detailed information on what XSS is, how it can be exploited and prevented have a look at the OWASP XSS description https://owasp.org/www-community/attacks/xss https://owasp.org/www-community/attacks/xss
- geocrasher 5y agohttps://onetimesecret.com https://onetimesecret.com
- 28uwedj 5y agohttps://burnernote.com/n/c39401e3-9e82-4c54-b65c-791820831354 https://burnernote.com/n/c39401e3-9e82-4c54-b65c-79182083135... I dare you.
- S-E-P 5y agoIt's probably been clicked previously.
- jinseokim 5y agoFirst of all, this is a cool idea. I always love to see something private and encrypted. But I found some concerns and ideas about your project (and I think you may can fix these): 0. This has XSS vulnerability. If attacker writes down this memo: <script>do_the_evil_things()</script> and passes to people, they might be unknowingly attacked(get tracked by attacker their IP/Browser fingerprint, mine cryptocurrencies for attacker, etc...) 1. This basically works under server-side encryption. When user type their text in the website, it is encrypted with the secret key on your config file and saved on the database. This is only effective when attacker only succeeds to crack the database. Also, you can read the text. I know you won't, but you know, cryptographers don't trust anyone. If you want to mitigate this, you might want to learn about end-to-end encryption. In short: the hash of the private link is the secret key. The browser randomly generate the key and encrypt/decrypt the text. The server only receives/saves the ciphertext. 2. AES-256-CBC is unsafe because it provides confidentiallity and not authenticity.[1] This means the attacker who can only crack the database can edit the ciphertext to pseudo-arbitrary plaintext under certain circumstance without knowing of the key. Also under another circumstance, attacker can use 'Padding oracle attack' to recover the ciphertext. it seems your service is not in this case: Laravel's encryption is AES-256-CBC + MAC, which mitigates this problem. So this is safe, but next time, if you write some crypto-related things without Laravel, you'd better use some high-level library such as libsodium or sjcl. 3. This service uses CloudFlare. Using CloudFlare might be safe on small project because they have rock solid WAF to prevent general attacks. But it may be unsafe for a whistleblower from NSA: when it matters with state-sponsered attackers or law enforcements, CloudFlare can be attacked/warranted. Then it becomes another attack vector. Again, your service and idea are cool. But you should remember that this area is full of land mines, dragons, and dinosaurs with laser guns. Welcome to privacy/crypto world! [1]: https://arxumpathsecurity.com/blog/2019/10/16/cbc-mode-is-malleable-dont-trust-it-for-authentication https://arxumpathsecurity.com/blog/2019/10/16/cbc-mode-is-ma...
- gigamick 5y agoThis is good! As I said in another post, the reason I posted this here was to get feedback and improve. All of these points are excellent and I will address them and get back to you.
- ycuser2 5y agoRelated: https://temp.pm/ https://temp.pm/
- durch 5y agoVery zeitgeisty :), I've created something similar a while ago (https://tmp.page https://tmp.page), the idea was to have expiring web pages, with a nice API. Our FEs are quite similar, yours is nicer tough :).
- yessirwhatever 5y agoITM citizen!
- gigamick 5y agoThank you :-)
- jmkd 5y agoIssue: Forward and back buttons allow the note to persist (at least visually). Impact: Someone reads a private note on a shared computer, how long will it remain visible in history? Browser: Chrome 95
- gigamick 5y agoExcellent observation. Thank you!
- privacyonsec 5y agohow do I burn the note ?
- gigamick 5y agoJust open the Link.
- rakoo 5y agoFrom the about page: > However [alternatives'] pages are laden with ads, have a poor UI, and you can't know for sure if they really are actually encrypting / deleting anything. There has been a private zero-knowledge pastebin for years: zerobin, forked into privatebin now (https://zerobin.net/ https://zerobin.net/). In fact the original is almost 10-years old but hasn't displayed a single ad, has been open source the whole time, has had time to iron out a lot of bugs and has a better UX than this: it doesn't need cookies to work. In terms of security, zerobin encrypts/decrypts everything in the browser. The server has no knowledge of the content. In contrast, burnernote receives the content _and_ the password in cleartext and encrypts/hashes them. Unfortunately, as long as there's a server you will have to trust it. In both cases you have to rely on something other than code and HTTPS to know if your content actually remains private or not
- jrexilius 5y agoThanks for the pointer! Zerobin (PrivateBin) seems a much better implementation.
- gigamick 5y agoThis is awesome feedback and client side encryption is 100% on its way. I just put this together over the weekend and then put around places like this for feedback. Client side is coming.
- 5y ago
- derekzhouzhen 5y agoDatabase will have backups. For smallish text data I'd just use memory only.
- charles_f 5y agoFun, I made something very similar, but that encrypts E2E and using ECDH (demo: https://drop.fev.al/ https://drop.fev.al/ and github: https://github.com/cfe84/drop https://github.com/cfe84/drop)