3 ms·

> In the end, trust is Still Required™ This entire section is FUD. Trust is "Still Required™" - unfortunately HN doesn't support underlines so I can't get accr

> In the end, trust is Still Required™ This entire section is FUD. Trust is "Still Required™" - unfortunately HN doesn't support underlines so I can't get accross the full obnoxiousness of the original formatting - therefore having your data in someone elses database is no worse then using an app that someone might add a backdoor to?

fastball 4y ago
Author here – can't say I agree. If this is FUD, I would assume there is an app you're familiar with which you can say with actual 100% certainty is end-to-end encrypted in a leakproof way?
- amadeuspagel 4y ago
  I don't need to have 100% certainty that an app is end-to-end encrypted in a leakproof way to prefer it to an app that's not end-to-end encrypted at all.
  - fastball 4y ago
    Having a preference is different from saying something is FUD. It's not FUD to say that there is still a lot of faith/trust required in the gap between "this app claims to be E2EE" and "this app is perfectly E2EE with no holes in an ongoing manner so my content is actually secure". Especially because it's much harder for a notes app to have encryption features like Perfect Forward Secrecy. It is a very common pattern that an app which claims to be secure turns out not to be. In fact I would say that claim to be secure and actually live up to that are probably the exception rather than the rule. This is why we self-host 99% of the content related to managing Supernotes (as a business) on Supernotes itself, but (a small minority of) sensitive content we keep in 1Password, which is one of the few apps I trust to have done E2EE well enough for me to feel that data is secure.
- longrod 4y ago
  In cyber security there's no such thing as 100% secure. There's insecure, secure, less secure, more secure etc. Always relative because security is not a concrete thing. You can't at any point say this app is 100% secure. That doesn't mean that the app is not 100% secure or that the app shouldn't use encryption since it can't be proven. This is why I like what the folks over at Notesnook are doing with Vericrypt [0], which essentially allows users to verify the encryption themselves in a very easy to use way. [0] https://vericrypt.notesnook.com/ https://vericrypt.notesnook.com/

fastball 4y ago

Author here – can't say I agree. If this is FUD, I would assume there is an app you're familiar with which you can say with actual 100% certainty is end-to-end encrypted in a leakproof way?

amadeuspagel 4y ago
I don't need to have 100% certainty that an app is end-to-end encrypted in a leakproof way to prefer it to an app that's not end-to-end encrypted at all.
- fastball 4y ago
  Having a preference is different from saying something is FUD. It's not FUD to say that there is still a lot of faith/trust required in the gap between "this app claims to be E2EE" and "this app is perfectly E2EE with no holes in an ongoing manner so my content is actually secure". Especially because it's much harder for a notes app to have encryption features like Perfect Forward Secrecy. It is a very common pattern that an app which claims to be secure turns out not to be. In fact I would say that claim to be secure and actually live up to that are probably the exception rather than the rule. This is why we self-host 99% of the content related to managing Supernotes (as a business) on Supernotes itself, but (a small minority of) sensitive content we keep in 1Password, which is one of the few apps I trust to have done E2EE well enough for me to feel that data is secure.
longrod 4y ago
In cyber security there's no such thing as 100% secure. There's insecure, secure, less secure, more secure etc. Always relative because security is not a concrete thing. You can't at any point say this app is 100% secure. That doesn't mean that the app is not 100% secure or that the app shouldn't use encryption since it can't be proven. This is why I like what the folks over at Notesnook are doing with Vericrypt [0], which essentially allows users to verify the encryption themselves in a very easy to use way. [0] https://vericrypt.notesnook.com/ https://vericrypt.notesnook.com/