Burnernote
Security and privacy
self-destructing notes
SHOW HN2021
124points
76comments
#413of 2,533 in 2021
Top 17%of 2021 by points
How HN took it
RoastedHalf or more of the comments are critical
4 positive, 13 neutral or asking, 2 mixed, 20 critical, out of 39 comments about the project. Thread score -0.34.
Privacy: 0 for, 11 againstExecution: 1 for, 7 againstDesign: 2 for, 0 againstIdea: 1 for, 1 againstDocs: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Clean UI and free, ad-free approach
From 2 comments
Yeah, Burnernote is clean and a nice UI. Good luck and thanks for putting it out there!
jrexilius on HNnice :-) liking the new "Show me the note" button gatekeeper. cheers
rntksi on HN
Useful burn-after-use idea for privacy
From 1 comment
I just want to say @gigamick these burn systems are powerful. You might get divorced some day. You might have a business partner subpoena your old gmail account. ALL those…
ransom1538 on HN
Objections
Server-side encryption; plaintext sent to server, client-side encryption promised
From 2 comments
From the about page: > However [alternatives'] pages are laden with ads, have a poor UI, and you can't know for sure if they really are actually encrypting / deleting anything.…
rakoo on HNFirst of all, this is a cool idea. I always love to see something private and encrypted. But I found some concerns and ideas about your project (and I think you may can fix…
jinseokim on HN
XSS vulnerability in note display
From 2 comments
DO NOT USE THIS SITE: 1. Create Note with the contents <script>alert(1);</script> 2. Go to link 3. this site is a massive security flaw.
28uwedj on HNThe alert itself is harmless, but demonstrates that arbitrary javascript - which could certainly not be harmless - can be injected into the page.
retube on HN
Link previews by chat apps destroy notes
From 2 comments
Nice gigamick. This has a problem though, when you paste that link in a chat window (e.g. WhatsApp, Telegram, Discord, ...), the app tries to get a link preview. This has the…
rntksi on HNCan confirm this happens with Matrix/Element. Amusingly, the brief contents of the note are visible in the preview along with "This note has now been permanently deleted".
snerbles on HN
AES-CBC without authentication and deletion not provably sound
From 2 comments
AES-CBC for quick and dirty encryption can be a red flag: the scheme needs to include an encrypt-then-MAC phase or it'll be vulnerable to padding oracle attacks. I tried to do a…
woodruffw on HNIt's a very good thing that it isn't susceptible to that particular weakness, as that would have been a disastrous one. But there are a lot of things that are left to be desired…
woodruffw on HN
Stack traces exposed on large input
From 1 comment
FYI if I post 1MB of data it explodes and dumps a full stack trace. May not be something you want exposed. ``` SQLSTATE[22001]: String data, right truncated: 1406 Data too long…
mmh0000 on HN
Requests
Client-side encryption
From 2 comments
This is awesome feedback and client side encryption is 100% on its way. I just put this together over the weekend and then put around places like this for feedback. Client side…
gigamick on HNZerobin certainly is cool but for me the UI is really dated looking and in my opinion not at all minimalist. I have client side encryption coming to Burnernote very soon.
gigamick on HN
Confirmation page before reading a note
From 2 comments
Hello, the way that privnote deals with it is by showing a page asking "Do you want to read this note and burn it?". That will solve the issue of preview apps expiring your notes.
slowmotiony on HNNice gigamick. This has a problem though, when you paste that link in a chat window (e.g. WhatsApp, Telegram, Discord, ...), the app tries to get a link preview. This has the…
rntksi on HN
Proof that source matches deployed code
From 2 comments
Very cool, but the FAQ doesn’t address the questions people will ask: open source is fine, but what guarantee do we have that the source code matches the deployed code? Or that…
macintux on HN> what guarantee do we have that the source code matches the deployed code? What is the answer to this question in general? Genuinely asking, I never considered this but it seems…
corycal on HN
Questions
How to guarantee deployed code matches open source repo
From 2 comments
Very cool, but the FAQ doesn’t address the questions people will ask: open source is fine, but what guarantee do we have that the source code matches the deployed code? Or that…
macintux on HNYou have to implement the encryption logic client side. But then now the client has to verify the JavaScript they receive upon visiting the URL matches what is published in the…
rank0 on HN
Whether deleted notes are truly purged from storage
From 1 comment
My point was that it's a claim that's impossible to formally prove: we don't really know how to do formal proofs of destruction, at least not with the scheme you're using. But…
woodruffw on HN
Alternatives named
PrivateBin / ZeroBin
From 1 comment
From the about page: > However [alternatives'] pages are laden with ads, have a poor UI, and you can't know for sure if they really are actually encrypting / deleting anything.…
rakoo on HN
Privnote
From 1 comment
nice project, but I prefer the approach of https://privnote.com notes are encrypted client-side before sending, click-to-read prevents scraper burn, auto-delete after 30days
ckpcw on HN
OneTimeSecret
From 1 comment
https://onetimesecret.com
geocrasher on HN
temp.pm
From 1 comment
Related: https://temp.pm/
ycuser2 on HN