Re:PurritoBin: Ultra fast, minimalistic, encrypted command l...
by tialaramex on Sunday July 05, 2020 @10:43PM
(#23744187)
I can think of one very good reason to have clients encrypt pastes for you as service provider:
If the pastes are encrypted by somebody else you simply have no idea what's inside them. You can easily find an expert who will explain to a jury, or a journalist, that you had no way to know it was an assassination plot / stolen bitcoin wallet / confession of child molestation. I'm sure you don't look (other people's business is quickly boring) but it may be difficult today to prove you didn't, because you could have.
But in terms of what I've used, in some tech jobs I've used in-house HTTPS pastebin sites. If we control the machine with the data in it then we get to decide what policies to apply, and if things go bad we know who (us) needs to fix that. In the last place I worked they used GitHub gists, so in principle Microsoft could snoop those and I'd have been uncomfortable seeing anything secret in them.
If the pastes are encrypted by somebody else you simply have no idea what's inside them. You can easily find an expert who will explain to a jury, or a journalist, that you had no way to know it was an assassination plot / stolen bitcoin wallet / confession of child molestation. I'm sure you don't look (other people's business is quickly boring) but it may be difficult today to prove you didn't, because you could have.
But in terms of what I've used, in some tech jobs I've used in-house HTTPS pastebin sites. If we control the machine with the data in it then we get to decide what policies to apply, and if things go bad we know who (us) needs to fix that. In the last place I worked they used GitHub gists, so in principle Microsoft could snoop those and I'd have been uncomfortable seeing anything secret in them.