Hacker News Reader

Comment by Sukotto | Hacker News Reader

Why should I trust these guys with my data? It's bad enough that Google knows so much about me... but at least they have some checks and balances built in. What sort of safety does "greplin" have to offer adopters?

View on HN

If you get uncomfortable, you can delete your account at any time. We'll delete your data. Not in 14 days, a week or tomorrow. That moment. We're convinced that you'll find enough value with Greplin to overcome that issue - the same way many did with mint.com.

We're also working with a) encrypted indexes b) only writing the index to disk rather then any content. this shuts down a lot of neat features (generating snippets etc.) - but users that are willing to forgo features for added security might find it useful.

Can you share any details of how your encrypted indices work? Searching over encrypted data is an active research area. I'm curious to learn what you are doing in practice.

So you don't have any backups then? (And I mean actual backups - replication is not a backup)

Hmm, could they use on-the-fly encryption/decryption? That is, use a symmetric cipher to encrypt the stored data on the servers and then do a simple backup of the data. When you delete your account they would just delete the encryption key. Backing up the encryption key could be done on your side (send you your own encryption key if you need to recover your data).

we're going to offer that.

I think the worry was actually, "Isn't my data backed up somewhere even if you delete it the instant I tell you to? So then you still have my data?"

bingo. If they can delete my data on the instant -- then they quite possibly don't have backups. If they do have some form of semi offline backups - then not all of my data is deleted on the instant.

Not a worry so much as a harder problem that sometimes doesn't get considered.

Sorry to pollute the stream here, but...

I'm interested in talking to you about integration. I can't use the contact form on your website because every page now sends me to the "Thanks for signing up" page and, unfortunately, you don't have an email address in your profile. Can you (or somebody appropriate :) shoot me an email (address in my profile)?

Mint prominently provides privacy and security information, and background on how they secure the system. You should similarly provide something on the front page, providing some of the details you've mentioned elsewhere in this thread.

Thanks for caring about the privacy of user data so much from day one!

that's not true. I can not delete my account at this very moment. You have sucked in 6 of my accounts and have not showed me an ounce of value. That was a terrible decision.

that was the risk you took when being a very early adopter

I've been kicking around and gradually prototyping an idea somewhat similar to greplin, but locally hosted. I originally thought of it more as a cloud archival system, as a guard against some dinky web service I use shutting down and locking me out of my data, but once you're collecting all the data adding really good search on top of it is a natural next step. Right now I'm aiming at distributing it as a VM image (because the dependencies and such are rather complicated), but some day I'd like to see it running directly on backup/NAS devices like the Drobo so that you could have a (roughly) "just plug it in" backup solution for both local files and cloud data.

You just described how it should be: locally hosted solution. I believe you are onto something here.

I use http://www.google.com/quicksearchbox/ for this use case (OS X). However, it does not search network based data. Only filesystem content.

The great thing about OAuth is that you can revoke access after the fact. At least Greplin doesn't ask for your username and password when it's not necessary.

Reply on news.ycombinator.com