Standard Notes is a safe place for your notes, thoughts, and life's work

Re:Standard Notes is a safe place for your notes, thoughts, ... by mkl on Friday April 16, 2021 @10:16PM (#26841092)

So they download the encryption key (unprotected so no password needed) as a file, and they keep the file safe? That's the kind of thing I've been thinking about for an idea of mine. What did those 10 users ask about? How to use the encryption key file?

[ Parent | on HN ]

Re:Standard Notes is a safe place for your notes, thoughts, ... by thecodrr on Friday April 16, 2021 @10:41PM (#26841194)

No, what the recovery key actually was because it asked for it in the recovery UI.

[ Parent | on HN ]

Re:Standard Notes is a safe place for your notes, thoughts, ... by mkl on Saturday April 17, 2021 @01:12AM (#26841745)

I see. Were they able to restore access once you explained? Or had they not saved it somewhere safe? I'm trying to understand the communication requirements around such a feature.

[ Parent | on HN ]

Re:Standard Notes is a safe place for your notes, thoughts, ... by thecodrr on Saturday April 17, 2021 @01:36AM (#26841828)

For most of them it seemed unnecessary; people don't realize the meaning of client-side encryption. I try to keep explanations very short and to the point.

> had they not saved it somewhere safe?

I had to delete 2 user accounts because they hadn't saved the key at all. All others had saved and were able to recover access. However, most didn't even realize they had saved it until I asked them to check their phone storage. A normal user would do anything to get past dialogs and popups, including clicking on random buttons.

[ Parent | on HN ]

Re:Standard Notes is a safe place for your notes, thoughts, ... by TylerE on Friday April 16, 2021 @11:42PM (#26841431)

The problem with that sort of thing is that you now have one of two situations

1. Either the key is only as secure as what ever random online service you have it backed up on (in which case, it might as well be stored at SN and save the user all kinds of headaches)

2. The key isn't backed up, and this won't be realized until the worst possible time.

[ Parent | on HN ]

Re:Standard Notes is a safe place for your notes, thoughts, ... by thecodrr on Saturday April 17, 2021 @01:21AM (#26841774)

1. That is up to the user. They can save it wherever they like: a secure online storage, a USB, a piece of paper...

2. True but there are a couple of things you can do: i) regularly remind the user via email and in-app notification to backup their recovery key. ii) force the user to download/copy the recovery key on login/signup.

By force, I really do mean force. Don't let the user use the app until they click the download recovery key button.

[ Parent | on HN ]

Re:Standard Notes is a safe place for your notes, thoughts, ... by mkl on Saturday April 17, 2021 @01:01AM (#26841694)

Well, putting a couple of USB drives in a sock drawer, garden shed, etc. is pretty secure. Point 2 is the tricky one, as communicating that necessity seems challenging.

[ Parent | on HN ]

Re:Standard Notes is a safe place for your notes, thoughts, ... by TylerE on Saturday April 17, 2021 @01:47AM (#26841875)

Unless your house burns down, or you get flooded out, etc.

[ Parent | on HN ]

Re:Standard Notes is a safe place for your notes, thoughts, ... by mkl on Saturday April 17, 2021 @04:56AM (#26842699)

Yes, that's why the garden shed or some other non-house location is good (leaving it with relatives in another city would be good too, and at work would be an option for some).

[ Parent | on HN ]