3 ms·
The home page title has the word zero knowledge, I guess? Their GitHub has slightly more info regarding this, but I agree that stuff like this should have at l
by jerieljan 3y ago
The home page title has the word zero knowledge, I guess?
Their GitHub has slightly more info regarding this, but I agree that stuff like this should have at least a page dedicated for it that explains how they've implemented their security.
> Notesnook is a free (as in speech) & open-source note-taking app focused on user privacy & ease of use. To ensure zero knowledge principles, Notesnook encrypts everything on your device using XChaCha20-Poly1305 & Argon2.
https://github.com/streetwriters/notesnook https://github.com/streetwriters/notesnook
- kstrauser 3y agoAs long as we’re walking down this road, you also don’t encrypt with Argon2. It’s a hashing function, specialized for passwords.
- z_ 3y agoAnd chacha20-poly1305 is listed in the SSH MiTM issue. https://www.freebsd.org/security/advisories/FreeBSD-SA-23:19.openssh.asc https://www.freebsd.org/security/advisories/FreeBSD-SA-23:19...
- radlad 3y agoWireguard also uses ChaCha20-Poly1305, but I am not sure it's relevant? I believe that attack is specific to SSH: "The attack exploits weaknesses in the specification of SSH paired with widespread algorithms, namely ChaCha20-Poly1305 and CBC-EtM, to remove an arbitrary number of protected messages at the beginning of the secure channel, thus breaking integrity." [0] https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-integrity-using-novel-data-corruption-attack/ https://arstechnica.com/security/2023/12/hackers-can-break-s...