I find it particularly amusing how many commenters are complaining about the lack of statement/explanation on the security model & encryption used behind the sc

I find it particularly amusing how many commenters are complaining about the lack of statement/explanation on the security model & encryption used behind the scenes--especially those comments suggesting one should hold out for such an explanation before using this service. Not because that isn't helpful information to have, but because it does not, in fact, provide the slightest shred of increased security, or additional reasons to trust this app (or any others). I mean, the state of HN comments on things like Torpedo all tend to feature such a ring of comments warning everyone to not try something when there isn't a statement about security/encryption. And yet, such a statement is absolutely worthless for decision-making or increased trust. Anybody could write a statement promising all manner of security/encryption awesomeness all over the things they make. We could have a team put out an app that claims it has encrypted its own source code with AES256 4,096 times before deploying to servers and that everything you do is encrypted a billion times over, and it's just fucking words. Yeah, nobody would trust something that claimed that, I'm sure, cos it sounds ridiculous. But it's not inherently more or less trustable and/or secure based on the content alone. If you're basing your decisions about who to trust on their words, you're using the wrong metric. "We delete everything, trust us" is no different from " the contents of secrets are encrypted with a randomly generated key, using AES 256 bit encryption, before being stored in our database. The key is then embedded in the share URL for the secret. We don't store the key nor the URL in our DB, so the only way to decrypt it is with the URL."[1] None of this is to suggest you shouldn't trust the guys behind Torpedo and their app. I think you should. But even my words don't matter. No mere statement about security/encryption can be trusted based on the words alone. You can only actually trust something if you've been able to verify that it complies with the statement. And very few of the services anyone uses allow their users to obtain that level of verification. [1]: https://news.ycombinator.com/item?id=7769443 https://news.ycombinator.com/item?id=7769443