I strongly disagree with this whole sentiment. The vulnerable need actual protection, not perceived. Invention that is not grounded in reality won't work. Which grand vision starts from falsehood? A possibility not yet proven is not a lie, it's a potential. People united is not a fundamental virtue, people united under virtuous pretenses is of value; people united under a lie is more likely a cult, or a sick society.
true, we host the vector DB in our own VPC. Obviously it requires trust between the customers and Jumble though. It's tricky, these technologies are cheap as a service, but very expensive for private instances.
We are building Talenter, a tool where developers can create a private page for recruiters to chat and ask questions of a virtual candidate. Recruiters can pre-screen candidates, and leverage the database to find a perfect match to their job description.
it's definitely valid to mix the two; the article is just one way to categorise which is subjective; but it is a mental model I found helps to keep in mind for my own journaling practice
yeah, perhaps client-side encryption or User encryption ownership or something along those lines.
To me, "encrypted storage" doesn't sound like anything different that what is done with normal authentication methods.
Thanks a lot for the encouragement; but also I really appreciate the honest feedback, it wouldn't be hacker news if people stopped being honest, it's why we all love the conversations here.
I agree the primary appeal (and thus market) of this app is not technical, but of course it's still important that the technical aspects are vetted and secure.
Maybe zero-knowledge should be open sourced, built from source by users as a desktop app (so they can lock to a version), and each version should be stamped (hash of specific version signed) by trusted 3rd party penetration testing agency -- it does limit the reach of the product though
You are right, I get what you are saying. But I guess I'm speaking more from a user perspective. Some people have told me they can't write down private things in a physical journal; as someone they are living with can easily pick it up and read it. In theory, a digital copy can be secured with more confidence than a physical copy ... for example by encrypting things with a key that you're confident only you have access to. I think I should have said that one benefit of "digital" is the potential for increased security ... online is clearly not the case.
it's ok, it's hacker news so I expected honesty which I appreciate. But What would you call an authentication mechanism which never passes the decryption key off the browser? It's an improvement over systems that handle the keys themselves on the server side.
the decryption key never leaves the browser. Maybe it's not perfect, but I'm not using the keywords because it's trendy, this project started out of an interest in more secure authentication and data security.
writing is a tool to help us think. Since we have limited active memory to think with, the words act like storage which helps organise thoughts and cover more ground
Thanks for the feedback! The hash is actually used to derive an actual key using PBKDF2 -- the library used is https://cryptojs.gitbook.io/docs/
Also, I'm interested if you see an attack vector on the authentication method. One thing to note is that even if an attacker can authenticate successfully they still have no access to the user private data without brute forcing the master password.