Hacker News Reader

Comment by jamestomasino | Hacker News Reader

It's interesting that you chose not to encrypt the titles of the entries. I suppose that's so that it's easier for us to browse back in time and find an entry without having to decrypt them all?

Things I noted:

- Each entry gets its own passphrase. You could use the same one again or again, or change it up. The addition of a 'hint' is nice.

- The title default should clear when you enter it with your tab or mouse focus. That's a minor thing, but annoying.

Regarding the keys used in the browser, is it possible to have whatever key phrase we enter also be seeded? That way, if by some miracle your database was compromised, anyone that did happen to use the same key passphrase over and over would have an extra level of protection? (Crypto people out there, does this actually give any additional protection, or am I just piling on unnecessary steps?)

View on HN

Exactly. Some early feedback from friends said they needed more ways to find entries other than timestamps. Was thinking either titles or tags, and went with titles for now. Maybe I should make it more clear that titles aren't encrypted.

It asks you for a new cipher key on every entry, correct. The encryption keys aren't stored.

You could use the same cipher key for each entry though, and keep it in some password vault somewhere (maybe even on BitJournal itself). And leave a hint to remind you where the cipher key is.

I really like it, dylanbfox. I think being more explicit on the titles would be a nice thing.

My biggest question is where you see the future of this project going. Having a web-based home for my private journaling might be something I'd want, and the crypto seems nice. It does mean that there would never be a social aspect here that would grow a community in that regard. Ad serving for revenue is out because of the security implications. That leaves the question of what your plans are for hosting long term.

You said this was a weekend project, and it's great, but if I were to start using this to store private information that I value, what sort of trust could I have that you'd keep the service going? Is it something you'd try to eventually monetize, or is this a candidate for open-sourcing so folks could self-host?

I agree. Don't know what commercial plans you had for it, but I'd love to see something exactly like this as an open source single-page JS app that I could run as file:.. (this would help w/ pull reqs too).

Thanks! I got a lot of great feedback yesterday that I'm incorporating, which is why I decided to pull the trigger and post to HN in the first place.

For now I'm going to keep developing it as much as I can. I don't have any commercial plans. I thought about open sourcing it, and it's something I'm seriously considering.

I do plan to host it for a while, but if for whatever reason I were to stop supporting it I would make this clear very far in advance. I should probably talk about this somewhere on the website. I'm sure other people have the same question.

If you or anyone else has any other feedback/suggestions, please send it my way! My email is on the "info" page of the site. Thanks again.

Reply on news.ycombinator.com