Paaster – Secure by default end to end encrypted pastebin | Hacker News Reader

Paaster – Secure by default end to end encrypted pastebin

github.com

49 pointswardpearce17 comments

> Can I trust a instance of paaster not hosted by me?

> No. Anyone could modify the functionality of paaster to expose your secret key to the server. We recommend using a instance you host or trust.

That's refreshingly honest, but I hope that some day a technology like WhatsApp / Cloudflare's recently released "Code Verify" extension helps to solve this.

https://inside.com/campaigns/inside-dev-2022-03-11-31674/sec...

AFAICT you could permanently trust a webapp loaded from an IPFS-scheme URI (as e.g. Brave can do), after it’s been audited once.

But then if you're using an IPFS gateway instead of hosting your own instance then the gateway could serve you different content, no?

Since you request data by a hash, and your software should verify the downloaded data has the same hash, no.

If you're using a gateway, you have to trust the gateway.

You could probably have a pretty light wrapper around the gateway which verifies the hash.

It wouldn't be as easy as simply using a gateway but still much easier than hosting/implementing an IPFS node locally

Well, to use the node locally you just run a binary, it's not like there's much to it.

No, but getting at content can sometimes take a while if it's not very actively seeded, e.g. I've had to wait hours for images to load on IPFS.

Yes, definitely. Discovery with IPFS is abysmal.

I think that providing API to be used by standalone clients is far more better approach

https://0bin.net/ has existed for quite some time now

I wish there was a way to create a link which doesn't contain the password so I can send the password separately.

Looking at https://github.com/WardPearce/paaster/blob/Development/paast... the link is just concatenated with # - navigate(`/${pasteId}#${paste.clientSecret}`)}

So you could just copy the link as everything before the # and send the rest as the password separately

Yep, that's exactly how it works.

It's the same concept as how mega.nz do their E2EE.

Pinterest open sourced a similar tool a few years back - Snappass: https://github.com/pinterest/snappass

Might as well use WebRTC to establish realtime e2e p2p pasting.

Text input seems to be broken on mobile? (iOS Chrome)

Reply on news.ycombinator.com