Hacker News Reader

Comment by awt | Hacker News Reader

Simplicity -- Just one entry per day, automatically time stamped. Security -- Your entries are encrypted using JS before being sent to the server, so I, as the sysadmin, can't read them and harass you as some google employees are known to do.

View on HN

I'm interested in learning how this works. i.e. how do you encrypt the data client side? is it a randomly generated key? (I guess not since the user would need to know it to decrypt the data on another machine). If the user picks a key, is it the same as their password? If the key is the same as their password, do you store the password in localStorage? etc etc?

(Sorry, just thinking out loud here and not sure how this'll work)

Got it. On security, you might try and test to see whether the added security you offer is meaningful to your audience. The security offered by web services is already sufficient for me to share my most personal emails and financial information.

I like the idea of a simple beautiful interface where I can look back at my journal entries easily.

Don't you as the sysadmin have access to the keys though? Even using an evercookie or something like that -- I fail to see what prevents you (Your malicious twin lets say) from seeing these?

The key (which is generated from the password), is stored using localStorage while the user has the app unlocked. I could certainly send myself the key somehow, but the concerned user should be able to snort that out fairly easily. I guess one option would be to opensource all or part of the js.

So if I blow away my local storage I'm hosed?

Doesn't sound like it. The key would probably be regenerated from the password and stored in localStorage again.

Reply on news.ycombinator.com