Comment by Veratyr | Hacker News Reader

Comment by Veratyr | Hacker News Reader

It's very interesting but the title seems a little hyperbolic as there are numerous caveats (from the "About" section):

- "Note that the security benefits of hardbin only apply when accessing it over a local (or otherwise trusted) gateway. If you access it over a gateway that you do not control, then the security model degrades to be equivalent to that of traditional encrypted pastebins."

- "The content will need to be pinned to make sure it stays around for long term (the same as any content stored in IPFS)." (though this doesn't impact the merits of its encryption)

- "You need to make very sure to use a known-good version of the code when creating pastes, as it would be trivial to create a malicious version that looks identical. The best thing to do is write down the hash the first time you use it, and always use the same hash. If you want to upgrade to a new version of the software, you'll need to update your hash."

- "I don't recommend using hardbin for highly critical stuff as the code has not been thoroughly audited by anyone but me."

The last is perhaps the most worrying thing.

These are all standard security concerns. Anyone who brings you something similar and does not have a long list like this is in marketing or sales.

If these are all standard security concerns, doesn't that make this a standard security pastebin?

I think the point is that it's an extraordinary claim with unextraordinary evidence.

Does anyone remember when the phrase "extraordinary claims require extraordinary evidence" was used regards to truly extraordinary claims? Like room-temperature superconductors. Or cold fusion. Or that aliens were responsible for the birth of human civilization?

This is not an extra-ordinary claim. This is the claim of "I made secure software, and I reckon it's pretty good" wrapped up in the extremely ordinary common English-language hyperbole of calling something 'the best' when there is no way to know if it is, or prove it one way or the other.

However, the use of hyperbole transforms the claim into an extraordinary one.

That is, unless you consider hyperbole to now be standard, in which case we have to likewise transform the original material being quoted.

Otherwise we're comparing apples to super duper hyper bestest-ever oranges.

Yep, I consider the use of hyperbole to be a standard colloquialism in this case, not a claim that they did an in-depth experimental study of pastebins and have compiled a report for peer review.

The vanilla "secure pastebin" is simply an insecure pastebin served over HTTPS.

Better, actually-trying-to-be-secure pastebin implementations will encrypt the data with JS before sending it to the server, and later decrypt it with a key that's embedded in the link's URL fragment (which the server never sees).

The security evolution here is that both the ciphertext and the code for the webpage to decrypt it are stored on IPFS, which is a content-addressed filesystem.

Thus, so long as you access pastes through a trusted (ie, local) IPFS note, the hardbin server operator can't insert code on the webpage after-the-fact to exfiltrate the key or plaintext back to them.

Or just knocking out risk areas using proven solutions in ways similar to past within parameters the cryptographers state instead of new, fancy stuff. Plus one for a memory safe language low-level enough for preventing leaks. Works more often than the new, fancy stuff.

We took "the world's most" out of the title above.

It's still inaccurate with word secure in there. That's a more widespread problem, though. ;)

For how long is publicly available, encrypted data going to resist bruteforce decryption? 30 years perhaps? Usually the "millions of years" estimate ignores the Moore's law.

Your data might be secure when is encrypted and never leaves your network.

Reply on news.ycombinator.com