Laverna – Store your notes anonymously and encrypted
laverna.cc
laverna.cc
The USP of Evernote isn't that you can take notes from anywhere as much as anything can be a note (An audio clip, your current location, a picture etc) and that can be very well organised, grouped and saved in the cloud and offline on demand.
It's basically a "database" for the non techies: Save everything in there and query by tags, organise by books or search in the content and meta data.
This is because all the encryption features they tout depend implicitly on content (HTML and JavaScript) the server sends you every time you use the application. Because you receive this content anew on every usage, there's no way to verify what you're getting. Today it might be fine, but tomorrow it might contain a key logger or subtle cryptographic flaws.
You also can't depend on the community for help verifying this content, because it can be distributed selectively. The mass of users might get benign content while interesting targets get backdoored software.
* It might be safe to distribute something like this as an installable sandboxed web application. I'm actually not 100% certain. But the no-install-just-browse-to-this-url model is definitely insecure.
It's never a good idea to do crypto over a website.
I would be greatly interested if you could expand on some of the pitfalls of browser extensions and how they differ among browsers. Thanks in advance!
As far as how they differ among browsers, Chrome (and I suppose Opera, now as well) does a good job sandboxing one extension from another, and from stopping websites gaining access to running extensions. Is it perfect? I can't really answer that.
One problem with Chrome extensions is that unless you want your users to have to download the .crx file, and drag and drop it into their browser, you have to use the Chrome webstore. This is especially retarded because in order to upload your extension to the Chrome webstore, they either need your private key you signed the extension with, or they generate a private key for you. This means that your private key is not private and extension signing is a complete joke. So if you're releasing an extension for the security-literate, it makes sense to create a .crx file, sign it yourself with your own PGP key, and offer it as a separate download that they have to drag+drop into Chrome. The chrome webstore is not a secure means of distribution.
Firefox, on the other hand, is more forgiving with installations but has no real sandboxing. This means it's possible for one extension to read another's data. Plans to introduce threading (and I think as a consequence of threading, sandboxing as well) are in the works, but it's still going to be a while until Firefox gives extensions the same protections Chrome does.
Really, if you can, it's best to do crypto in a native app where the sandboxing is done for you by the operating system and you don't have to rely on a browser. Node-webkit is a great way to do this since it merges the two worlds nicely (at least for desktop).
I didn't realize the Chrome web store requires your private key. That's insane.
Instead, one would download a specific version as a tarball with a verifiable checksum that indicates the source is equivalent to the version audited by the community on GitHub. The app is then loaded & run locally.
In addition, you could control network access if you wrap it in its own OS-native custom browser app and use a firewall that controls outgoing connections. (Like LittleSnitch on OS X.) That is, create a thin shell around WebKit uniquely for use with this web app, and control its network access.
(I think the two measures are redundant, but hey, if you're going to be paranoid...)
"None of us can get access to your personal data because we are using IndexedDB and localStorage. In fact all your information will be stored only on client side."
So does this mean that clearing cookies in Chrome will delete all your information?
"Cookies, site, and plug-in data:
Cookies: Files stored on your computer by websites you've visited. These files contain user information, such as preferences for websites or profile information.
Site data: HTML5 enabled storage types including application caches, Web Storage data, Web SQL Database data, and Indexed Database data.
Plug-in data: Any client-side data stored by plug-ins that use the NPAPI ClearSiteData API"
https://support.google.com/chrome/answer/95582?p=settings_cl...
It offers a hosted option (the default) or an open-source server you can run internally if you want more control of your data (or don't want to pay). Disclosure: I'm building it.
Note that Turtl uses IndexedDB to store everything (encrypted) locally, but also syncs to the server. This means if you wipe your local storage, your profile will be re-downloaded back to the client (only un-synced changes will be lost).
Mobile versions are on the way.
Bit of advise however: The front page of the website doesn't really describe it very well. There's barely any screenshots (and the ones that exist are hidden for two thirds of the time), and there's not much of a description of the actual application. There's descriptions of what features it has over your competitors, but not really anything about what the core product is. Honestly, if I saw the website outside of the context of this comment thread, I probably would have passed it by.
All in all it looks like a good alternative to Google Keep which I can feel good about using. Best of luck!
I think one thing I'm definitely missing are use cases, which would help people understand that product better. I'll see what I can do about making the screenshots more obvious as well.
I've been toying with the idea of creating a demo with pre-populated content and letting people play around with it on the site. Would that be something you'd try out as a passerby who happened to land on the site?
The most important feature keeping me with Evernote is the ability to drag and drop images.
vim + git + markdown
Doesn't solve your image issue, but for text-only it's a pretty nice solution if you're comfortably living in vim anyway.
It's completely replaced Evernote for me. You can drag and drop images from a browser or the file system.
It does nothing to address the anonymous or secure aspects however.
1. https://www.zotero.org/ 2. https://www.zotero.org/support/dev/dataserver_setup