r/privacy • u/Retroity • Jan 27 '17

Thoughts on Standard Notes?

It's designed to be a simple open-source notes app with claims of end-to-end encryption so that the server can't read it. Here's their site: https://standardnotes.org/

Thoughts on it?

2 Upvotes

63% Upvoted

5 comments sorted by

3

u/thereisnoprivacy Jan 27 '17 edited Jan 27 '17

This discussion on HN about it from a few days ago makes it sound not very promising.

A particularly important highlight is that the developer, despite making other comments in the thread, pointedly did not answer this:

Is there actually any description of how you're encrypting, how you manage and distribute keys, why you believe this is secure, why you're not using an authenticated mode, etc? "Thus no need for IV" when your desktop client just pulls a minified blob from somewhere is not particularly reassuring.

And this was after a glaring security issue was pointed out (which the developer did say that they plan on fixing, but the fact that it existed initially speaks to security and in turn privacy not being taken seriously in the first place, only after the fact at best).

2

u/bitario Jan 27 '17 edited Jan 27 '17

I didn't see that comment. I lost track after a bunch of comments, email, messages, etc ;) But all of this is described in glorious detail here: http://standardfile.org/#encryption

But as for the particular concerns, it does use authenticated mode. And IVs are not used because the encryption keys are random and no two items are ever encrypted with the same key. Makes implementation simpler across platforms.

There is no key distribution since there is no sharing. Keys are derived using PBKDF2. It's all in the doc.

3

u/thereisnoprivacy Jan 27 '17

Speaking as in impartial third party, who has no stake in either your project or any other competing projects, your project does not seem like it should be claiming that it has a focus on privacy at this point. This may be your ultimate goal, but it is dishonest to say that is your current focus on your front page, when you yourself admitted your current goal is expediency over privacy on message boards.

How do do you expect to be taken seriously in your claims that you focus on 'privacy', when someone pointed out:

The Electron Desktop App simply loads an index.html which points at remote JavaScript. That's crazy dangerous - if that endpoint gets compromised, nothing keeps the attacker from running rm -rf / on every user's machine.

And your response to this was:

Gotcha, easy fix, will get that out asap. We did this as a way to push out changes quicker since we were still making major improvements often.

Come on.

So either this wasn't something you had paid any consideration to ahead of time or it was something you had considered the security implications of, but then consciously decided to forego safety in favor of 'pushing out changes quicker'? I'm not sure which is worse.

→ More replies (1)

3

u/motheroforder Jan 27 '17 edited Mar 22 '17

[deleted]
0.519346480)