6 ms·

Yeah, Evernote really should have been zero-knowledge end-to-end encrypted. Recently https://crypton.io/ https://crypton.io/ was released and my hope is that l

Yeah, Evernote really should have been zero-knowledge end-to-end encrypted. Recently https://crypton.io/ https://crypton.io/ was released and my hope is that lots of new SaaS offerings will use it and that this will in the end force even the big names (Dropbox, 37signals, etc) to adopt real security.

jpdoctor 14y ago
> to adopt real security. Won't happen until it's perceived that the lack of security is costing them money.
- quinndupont 14y ago
  Personally, I've complained to them that as a premium user I should be given the option to fully encrypt a notebook (zero-knowledge style, so only I have the keys). This prohibits all the social network-type sharing stuff though, so they are uninterested in doing this (same with Dropbox). It's a fundamental issue, but I hate that these companies think they should put "sharing" ahead of "security".
  - ncryptedcloud 14y ago
    (Disclosure I work for nCrypted Cloud) The FREE product is still in Beta but the Pro version (due out in two months) WILL allow you to request zero knowledge and there will be no Recovery key. I know that you know that this means that if you ever forget your password, there is no helping you but I say it so that others reading this understand the dangers of this. Why are we going to supply this functionality then? Because users keep requesting it
brisance 14y ago
I'm not a technical person, but how would they be able to search and index the items if everything is encrypted?
- MartinMond 14y ago
  They wouldn't be able to do this on the server side. However their native iOS, Mac, Windows clients could just create&update the search index locally and sync the encrypted version. With HTML5 localStorage this also works in Web Apps. Of course there's a tradeoff, but for me that's easily worth it.
  - derefr 14y ago
    The "tradeoff" seems to be "make the server into a dumb store for encrypted data." At which point, you don't have Evernote (an API for fuzzy-matching clippings punted into it from various devices), you have Evernote (a set of fat client programs each of which must maintain an entire copy of the dataset--notably, stored necessarily alongside its own decryption key on the client side, increasing attack surface--and do manual synchronization) plus a POSS (Plain Old Storage Service, like S3.) The resultant workflow sounds like it would have more in common with several people trying to edit the same Word document over SMB, than with making web requests. [EDIT: clarity about client-side encryption]
    - MartinMond 14y ago
      The "tradeoff" seems to be "make the server into a dumb store for encrypted data." At which point, you don't have Evernote (an API for fuzzy-matching clippings punted into it from various devices), you have Evernote (a set of fat client programs) plus a POSS (Plain Old Storage Service, like S3.) In fact, the workflow sounds like it would have more in common with editing a Word document over SMB than with making web requests. Not at all. Fuzzy-matching can be done client side just as well as server-side. The constraints are a bit different, but not too much (E.g. on the server-side: Make it scale --> conserve CPU, on the (mobile) client-side: Make it fast --> conserve CPU) Otherwise, yeah most Web Apps are nothing more than editing stuff over the network and visualizing it differently. The #1 competitor or a SaaS isn't some other SaaS but rather Word/Excel: http://www.startupcfo.ca/2011/05/the-1-competitor-for-saas-vendors/ http://www.startupcfo.ca/2011/05/the-1-competitor-for-saas-v... Edit: Also there's no reason to believe the client-side store wouldn't be encrypted. That'd be exceedingly stupid.
superuser2 14y ago
Evernote's value precludes a zero-knowledge model. Effective search, slicing by tag, OCR, etc. are all server-side.
ncryptedcloud 14y ago
(Disclosure I work for nCrypted Cloud) Zero Knowledge will be an option with the pro version due out in about 2 months but as I have commented before, if the password is forgotten, there is no accessing that data

jpdoctor 14y ago

> to adopt real security. Won't happen until it's perceived that the lack of security is costing them money.

quinndupont 14y ago
Personally, I've complained to them that as a premium user I should be given the option to fully encrypt a notebook (zero-knowledge style, so only I have the keys). This prohibits all the social network-type sharing stuff though, so they are uninterested in doing this (same with Dropbox). It's a fundamental issue, but I hate that these companies think they should put "sharing" ahead of "security".
- ncryptedcloud 14y ago
  (Disclosure I work for nCrypted Cloud) The FREE product is still in Beta but the Pro version (due out in two months) WILL allow you to request zero knowledge and there will be no Recovery key. I know that you know that this means that if you ever forget your password, there is no helping you but I say it so that others reading this understand the dangers of this. Why are we going to supply this functionality then? Because users keep requesting it

brisance 14y ago

I'm not a technical person, but how would they be able to search and index the items if everything is encrypted?

MartinMond 14y ago
They wouldn't be able to do this on the server side. However their native iOS, Mac, Windows clients could just create&update the search index locally and sync the encrypted version. With HTML5 localStorage this also works in Web Apps. Of course there's a tradeoff, but for me that's easily worth it.
- derefr 14y ago
  The "tradeoff" seems to be "make the server into a dumb store for encrypted data." At which point, you don't have Evernote (an API for fuzzy-matching clippings punted into it from various devices), you have Evernote (a set of fat client programs each of which must maintain an entire copy of the dataset--notably, stored necessarily alongside its own decryption key on the client side, increasing attack surface--and do manual synchronization) plus a POSS (Plain Old Storage Service, like S3.) The resultant workflow sounds like it would have more in common with several people trying to edit the same Word document over SMB, than with making web requests. [EDIT: clarity about client-side encryption]
  - MartinMond 14y ago
    The "tradeoff" seems to be "make the server into a dumb store for encrypted data." At which point, you don't have Evernote (an API for fuzzy-matching clippings punted into it from various devices), you have Evernote (a set of fat client programs) plus a POSS (Plain Old Storage Service, like S3.) In fact, the workflow sounds like it would have more in common with editing a Word document over SMB than with making web requests. Not at all. Fuzzy-matching can be done client side just as well as server-side. The constraints are a bit different, but not too much (E.g. on the server-side: Make it scale --> conserve CPU, on the (mobile) client-side: Make it fast --> conserve CPU) Otherwise, yeah most Web Apps are nothing more than editing stuff over the network and visualizing it differently. The #1 competitor or a SaaS isn't some other SaaS but rather Word/Excel: http://www.startupcfo.ca/2011/05/the-1-competitor-for-saas-vendors/ http://www.startupcfo.ca/2011/05/the-1-competitor-for-saas-v... Edit: Also there's no reason to believe the client-side store wouldn't be encrypted. That'd be exceedingly stupid.

superuser2 14y ago

Evernote's value precludes a zero-knowledge model. Effective search, slicing by tag, OCR, etc. are all server-side.

ncryptedcloud 14y ago

(Disclosure I work for nCrypted Cloud) Zero Knowledge will be an option with the pro version due out in about 2 months but as I have commented before, if the password is forgotten, there is no accessing that data