4 ms·

> things that obviously don't need it Why do you think a note taking service doesn't need end-to-end encryption? Perhaps you don't care if a rogue employee rea

> things that obviously don't need it Why do you think a note taking service doesn't need end-to-end encryption? Perhaps you don't care if a rogue employee reads your personal diary, or if the company gets hacked and all your private notes are stolen. Or if an overreaching government demands your data. Personally I do care. The note taking solution I currently use has E2E encryption, and I won't consider switching to a different solution that lacks this.

reitanqild 5y ago
Thanks for asking. I think you are genuinely curious so here is my best answer: If it is that important, don't use a service like this. Seriously don't. Edit: and don't use any other online service either, E2EE or not! As I write towards the end, E2EE in a web service like this can be trivially worked around by anyone who can push code to prod. (Or anyone who can inject it.) Basically anyone working at a small product like this and any serious three letter agency. It is not that I don't care. I very much do care. I still remember a friend of me from years ago who told about some (probably IRC) friends of his who ran a "Dropbox"-style service hardly breaking even, just because of all the fun they had looking at all the stuff that people didn't dare to put on Dropbox. So my point is: - if things need to stay secret, don't write them down, - and if you have to write them down, don't let them leave your device - and if you have to send them, encrypt them properly first and then send them. Do this mean I encrypt everything before I fire up <whatever messenger I use>? No. If <whatever messenger I use> gets owned big time and all my chats with my wife gets dumped we'll probably laugh at it. Nothing we did was illegal and nothing of it is embarrassing - it would only be embarrassing if I posted it publicly or if I sent it using a service that I should have known better than to use.
Fervicus 5y ago
What solution are you using now? I am using Standard Notes right now but I wish there were more alternatives.

reitanqild 5y ago

Thanks for asking. I think you are genuinely curious so here is my best answer: If it is that important, don't use a service like this. Seriously don't. Edit: and don't use any other online service either, E2EE or not! As I write towards the end, E2EE in a web service like this can be trivially worked around by anyone who can push code to prod. (Or anyone who can inject it.) Basically anyone working at a small product like this and any serious three letter agency. It is not that I don't care. I very much do care. I still remember a friend of me from years ago who told about some (probably IRC) friends of his who ran a "Dropbox"-style service hardly breaking even, just because of all the fun they had looking at all the stuff that people didn't dare to put on Dropbox. So my point is: - if things need to stay secret, don't write them down, - and if you have to write them down, don't let them leave your device - and if you have to send them, encrypt them properly first and then send them. Do this mean I encrypt everything before I fire up <whatever messenger I use>? No. If <whatever messenger I use> gets owned big time and all my chats with my wife gets dumped we'll probably laugh at it. Nothing we did was illegal and nothing of it is embarrassing - it would only be embarrassing if I posted it publicly or if I sent it using a service that I should have known better than to use.

Fervicus 5y ago

What solution are you using now? I am using Standard Notes right now but I wish there were more alternatives.