Hacker News Reader

Since the pitch keeps referring to Firebase, I thought I might as well mention this here: a while ago I built an encryption layer for the Firebase RTDB at https://github.com/Reviewable/firecrypt. It's not nearly as nice as Etsebase appears to be, but if you're already committed (cough locked in cough) to Firebase then it will get you a good chunk of the way there. (And yes, I still actively use and maintain it.)

View on HN

VERY interesting! Reading the README first paragraph, I see you mention this doesn't make sense for apps where anon users can see data. But what about when anon users can sign up for an account, THEN have access to sensitive data?

It might work, if you truly trust whoever signs up. The fundamental issue is that there's just one encryption key for the whole database, and you need to provide it to everyone who you want to have access to encrypted data. If you stop trusting someone for any reason your only recourse is re-encrypting the entire database, which is a painful offline operation. (You might also be able to support multiple encryption keys -- one per user, say -- but the library isn't really set up to make that convenient right now.)

Reply on news.ycombinator.com