3 ms·

There's always a possibility of someone just taking a screenshot.

borplk 12y ago
Every time some service like this is submitted there's someone complaining about screenshots. Of course they can take screenshots, that's not the use case. People can also memorize things, or create fake pages and screenshots. Or film the screen of their phones, or take photos of their TV. You can't just send beams magically to their head and then make all evidence and memory of it magically disappear. The use case is for when you want to send someone a password or a small message, instead of sending it to live in their IM history or email inbox, you send it with something like this, so if they can successfully read it, you know they were the only ones to ever read it, otherwise they would not be able to read it. Is it for super secret stuff? No. Is it good enough for many use cases? Yes. In case of password, you'd communicate URL, username etc regularly and just use something like this for password, so even if this thing itself is not terribly secure, it's missing context so it's still fine. Example: Hey John, here's the login details for the grocery manager: username: blahblah login url: http://example.com/login http://example.com/login password: get it from http://kevlar.io/QlIk6NKFfX78dRq3ZES5yw http://kevlar.io/QlIk6NKFfX78dRq3ZES5yw
- viraptor 12y ago
  > when you want to send someone a password or a small message No, this is a terrible service for it for a few reasons: - it doesn't force https, so you should never send any password through it - you have no control over it, so for all we know all secrets will be saved forever on an insecure server - you have no idea who runs the service, so for all we know all secrets will be published in a year, available for everyone to download Best way to collect lots of logins, passwords, cc details? Start your own "secure" storage service.
  - borplk 12y ago
    Without the other context the random password itself is not useful to the service. People exchange full login details in email and IM all the time, this simply helps with the problem of having them sit in the history and archives indefinitely. Security is a spectrum not an absolute measure.
- awalton 12y ago
  > you know they were the only ones to ever read it, This is the problem. If you could prove that they're the only ones that ever read it, it'd be great. But it's data hosted on someone else's closed source service most likely running on a VPS somewhere that yet another third party entity is running, connecting to your browser over unencrypted HTTP.
  - borplk 12y ago
    Yes my comment assumed the path from your system to the server is secure (and from server to recipient), and that the server is trusted.
- fishnchips 12y ago
  Fair enough. As long as you are reasonably careful like with your example this will work alright for many cases.

Every time some service like this is submitted there's someone complaining about screenshots. Of course they can take screenshots, that's not the use case. People can also memorize things, or create fake pages and screenshots. Or film the screen of their phones, or take photos of their TV. You can't just send beams magically to their head and then make all evidence and memory of it magically disappear. The use case is for when you want to send someone a password or a small message, instead of sending it to live in their IM history or email inbox, you send it with something like this, so if they can successfully read it, you know they were the only ones to ever read it, otherwise they would not be able to read it. Is it for super secret stuff? No. Is it good enough for many use cases? Yes. In case of password, you'd communicate URL, username etc regularly and just use something like this for password, so even if this thing itself is not terribly secure, it's missing context so it's still fine. Example: Hey John, here's the login details for the grocery manager: username: blahblah login url: http://example.com/login http://example.com/login password: get it from http://kevlar.io/QlIk6NKFfX78dRq3ZES5yw http://kevlar.io/QlIk6NKFfX78dRq3ZES5yw

viraptor 12y ago
> when you want to send someone a password or a small message No, this is a terrible service for it for a few reasons: - it doesn't force https, so you should never send any password through it - you have no control over it, so for all we know all secrets will be saved forever on an insecure server - you have no idea who runs the service, so for all we know all secrets will be published in a year, available for everyone to download Best way to collect lots of logins, passwords, cc details? Start your own "secure" storage service.
- borplk 12y ago
  Without the other context the random password itself is not useful to the service. People exchange full login details in email and IM all the time, this simply helps with the problem of having them sit in the history and archives indefinitely. Security is a spectrum not an absolute measure.
awalton 12y ago
> you know they were the only ones to ever read it, This is the problem. If you could prove that they're the only ones that ever read it, it'd be great. But it's data hosted on someone else's closed source service most likely running on a VPS somewhere that yet another third party entity is running, connecting to your browser over unencrypted HTTP.
- borplk 12y ago
  Yes my comment assumed the path from your system to the server is secure (and from server to recipient), and that the server is trusted.
fishnchips 12y ago
Fair enough. As long as you are reasonably careful like with your example this will work alright for many cases.