3 ms·

Author here – can't say I agree. If this is FUD, I would assume there is an app you're familiar with which you can say with actual 100% certainty is end-to-end

Author here – can't say I agree. If this is FUD, I would assume there is an app you're familiar with which you can say with actual 100% certainty is end-to-end encrypted in a leakproof way?

amadeuspagel 4y ago
I don't need to have 100% certainty that an app is end-to-end encrypted in a leakproof way to prefer it to an app that's not end-to-end encrypted at all.
- fastball 4y ago
  Having a preference is different from saying something is FUD. It's not FUD to say that there is still a lot of faith/trust required in the gap between "this app claims to be E2EE" and "this app is perfectly E2EE with no holes in an ongoing manner so my content is actually secure". Especially because it's much harder for a notes app to have encryption features like Perfect Forward Secrecy. It is a very common pattern that an app which claims to be secure turns out not to be. In fact I would say that claim to be secure and actually live up to that are probably the exception rather than the rule. This is why we self-host 99% of the content related to managing Supernotes (as a business) on Supernotes itself, but (a small minority of) sensitive content we keep in 1Password, which is one of the few apps I trust to have done E2EE well enough for me to feel that data is secure.
longrod 4y ago
In cyber security there's no such thing as 100% secure. There's insecure, secure, less secure, more secure etc. Always relative because security is not a concrete thing. You can't at any point say this app is 100% secure. That doesn't mean that the app is not 100% secure or that the app shouldn't use encryption since it can't be proven. This is why I like what the folks over at Notesnook are doing with Vericrypt [0], which essentially allows users to verify the encryption themselves in a very easy to use way. [0] https://vericrypt.notesnook.com/ https://vericrypt.notesnook.com/

Author here – can't say I agree. If this is FUD, I would assume there is an app you're familiar with which you can say with actual 100% certainty is end-to-end encrypted in a leakproof way?

amadeuspagel 4y ago

I don't need to have 100% certainty that an app is end-to-end encrypted in a leakproof way to prefer it to an app that's not end-to-end encrypted at all.

fastball 4y ago
Having a preference is different from saying something is FUD. It's not FUD to say that there is still a lot of faith/trust required in the gap between "this app claims to be E2EE" and "this app is perfectly E2EE with no holes in an ongoing manner so my content is actually secure". Especially because it's much harder for a notes app to have encryption features like Perfect Forward Secrecy. It is a very common pattern that an app which claims to be secure turns out not to be. In fact I would say that claim to be secure and actually live up to that are probably the exception rather than the rule. This is why we self-host 99% of the content related to managing Supernotes (as a business) on Supernotes itself, but (a small minority of) sensitive content we keep in 1Password, which is one of the few apps I trust to have done E2EE well enough for me to feel that data is secure.

longrod 4y ago

In cyber security there's no such thing as 100% secure. There's insecure, secure, less secure, more secure etc. Always relative because security is not a concrete thing. You can't at any point say this app is 100% secure. That doesn't mean that the app is not 100% secure or that the app shouldn't use encryption since it can't be proven. This is why I like what the folks over at Notesnook are doing with Vericrypt [0], which essentially allows users to verify the encryption themselves in a very easy to use way. [0] https://vericrypt.notesnook.com/ https://vericrypt.notesnook.com/