Hacker News new | ask | show | jobs
by angry_octet 2032 days ago
Offering this as a hosted instance is tantamount to conspiracy to enable identity theft, and worse. These things just shouldn't be chucked into someone's S3 bucket or SQL database.
2 comments

You've been downvoted, but it does seem like a high risk for information security.
Everyone loves to preach ethics and accountability but I think lots of people in tech secretly dislike the constraints. Or not so secretly if they work at fb.

For everything you do, you should consider "what if this is used by the worst person to target the most vulnerable people?" Stalker exes, online scammers, insurance companies, 4chan wieners, toxic MRAs, data brokers working for PIs etc. Assume an open S3 bucket with data from 5000 users. Imagine how much identify theft and intimate partner violence that could enable.

Wait until you hear what people are storing on PasteBin!
Security companies ('threat intel') routinely scan new pastes to find nice stuff, like creds and code, and also C&C from bots. Pastebin is a bit gauche for that now. Even S3 bucket scanning is too everyday.
No, let's sync it to Facebook/WhatsApp/Snapchat/Google, so we know our privacy will be invaded.
A set of index cards works pretty well. An excel file on a USB stick is pretty good for most people. Even better if you can use an encrypted volume -- simple on macos and painful elsewhere.

The usual trade-off is ease of access -- on the cloud you can get it anywhere. But it isn't encrypted, it's accessed via an API, and you're dependent on someone not fucking that up.

This software can run offline, which is good, but the monetisation is via the cloud, which is bad.

Too bad portable software is such a shitshow. Everyone has these enormous runtime engines and there is no way to be confident in anything they run hasn't been updated the siphon off everything to a random cloud instance. It's architected to trust the cloud rather than devices we can physically control.