Jeff Atwood's security blunder regarding email

Re:Jeff Atwood's security blunder regarding email by EGreg on Monday April 30, 2012 @12:35AM (#3908047)

This gives me an idea. A secure web notebook where you can record things that only you can get out. They will be encrypted on the server basically, and your password will be used to decrypt them. Also you will use SSL to post. Is there any vault like this that's freely accessible?

[ Parent | on HN ]

Re:Jeff Atwood's security blunder regarding email by duskwuff on Monday April 30, 2012 @01:11AM (#3908112)

The problem with such a service is that there's no practical way to figure out whether they're reading your data on the sly. (Even if your data is technically being encrypted on the client side, there's nothing to stop them from slipping in some extra JS one day to start sending your encryption key to their server.)

[ Parent | on HN ]

Re:Jeff Atwood's security blunder regarding email by georgemcbay on Monday April 30, 2012 @04:41AM (#3908477)

Only the super paranoid would bother using a service like this, and those people would require verifiable encryption on the client side.

[ Parent | on HN ]

Re:Jeff Atwood's security blunder regarding email by dchest on Monday April 30, 2012 @06:58AM (#3908714)

They will be encrypted on the server basically

And now you have to trust the server.

[ Parent | on HN ]

Re:Jeff Atwood's security blunder regarding email by chaitanya on Monday April 30, 2012 @12:44AM (#3908062)

LastPass has a "Secure Notes" feature which works this way.

[ Parent | on HN ]