Hacker News Reader

Comment by bahador | Hacker News Reader

I like the idea a lot, but the security implications of this are scary. May as well just do a cloud based key stroke recorder.

View on HN

In defense, you're not recording keystrokes. Simply taking bash history which is already recorded locally and moving it to the cloud.

You are giving all your bash history to a third party, that is incredibly scary and if you can't see the security implications then you need to rethink your product.

Agree privacy is a concern. You can configure what you do and don't send as well.

the problem is, theres a pretty good chance people will still send all sorts of passwords and access credentials. that's a big liability if you get exploited.

should you do this? no.. but people do, all the time.. take for example this MySQL bug report with many complaints that the command now issues a warning when you specify a password on the command line: https://bugs.mysql.com/bug.php?id=66546

Seriously I don't think you really understand the implications here or you aren't taking them seriously, if you did you sure wouldn't be talking about this so nonchalantly. You should seriously shut this down before you get some young programmers/admins fired or worse.

Also from your FAQ what the hell is "strong level encryption", can you not name it? Can you go into the extreme technical details of what encryption you are using, how data is protected in memory and at rest?

The FAQ says 'storage level encryption' which presumably means volume encryption, but in any case is unlikely to protect against anyone gaining access to the box, only against someone making off with the physical storage.

Reply on news.ycombinator.com