From 706ad42098e3fd4b4c37939f8132cd7e12574dee Mon Sep 17 00:00:00 2001 From: iceTwy Date: Thu, 3 Oct 2013 23:36:30 +0200 Subject: [PATCH] Rewrite & add further info to the FAQ The FAQ contained a bunch of typos and inaccurate information. Hopefully, this should fix both problems. --- zerobin/views/faq.tpl | 92 ++++++++++++++++++++++--------------------- 1 file changed, 47 insertions(+), 45 deletions(-) diff --git a/zerobin/views/faq.tpl b/zerobin/views/faq.tpl index f58929e..16decfd 100644 --- a/zerobin/views/faq.tpl +++ b/zerobin/views/faq.tpl @@ -4,64 +4,66 @@
-
- -
How does it work?
+
+
How does 0bin work?
-

We generate a random key, and encrypt the paste with it using +

A random key is generated and used to encrypt the paste, thanks to the sjcl - javascript library.

-

The content is sent encrypted to the server, which returns the + JavaScript library.

+

The encrypted content is then sent to the server, which returns the address of the newly created paste.

-

The javascript code then redirects to this address, but it adds the +

The JavaScript code redirects to this address, but it adds the encryption key in the URL hash (#).

-

When somebody want to read the paste, he usually just click on a link - with this URL. If the hash containing the key is part of it, Obin's - javascript will use it to decrypt the content sent by the server.

-

The browser never sends the hash to the server, so it does not - receives the key.

+

When somebody wants to read the paste, they will usually click on a link + with this URL. If the hash containing the key is a part of it, 0bin's + JavaScript will use it to decrypt the content sent by the server.

+

The browser never sends the hash to the server, so the latter does not + receives the key at any time.

-
Javascript encryption is not secure!
+
But JavaScript encryption is not secure!
-

No it's not.

-

The goal of 0bin is not to protect the users - or their secrets.

-

The goal is to make it hard to sue the host because of the - content users pasted in his service. The idea is that you can not - require somebody to moderate something he can't read

+

No, it isn't.

+

The goal of 0bin is not to protect the user and their data + (including, obviously, their secrets).

+

Instead, it aims to protect the host from being sued for the + content users pasted on the pastebin. The idea is that you cannot + require somebody to moderate something they cannot read - as such, + the host is granted plausible deniability.

+ +

Remember that as an user, you should use 0bin in the same way as unencrypted and + insecure pastebins - that is, with caution. The only difference with those is that if + you decide to host a 0bin server, the encryption feature hopefully be used as a defense. + This is not proven, though! :-) +

-
What if the server changes the Javascript code? Or in the case of a man - in the middle attack?
+
What if the server changes the JavaScript code? And what happens in the case of a MITM attack?

Read above.

-

0bin the is not built to protect the users content. It is built to - protect the host. If the user content is compromised, 0bin still - provides the host with the main feature: ignorance of the hosted content.

-

The case where the host himself compromises the encryption process - to read the content makes no sense: in that case he wouldn't have - installed 0bin in the first place. 0bin is here to protect him.

-

If you want to be sure nobody can read your content, you should - not use 0bin. Use - cryptocat (but JS crypto warnings apply) - or OTR for chatting, - GPG/enignmail - for emails and TrueCrypt for storage.

+

0bin is not built, and does not aim, to protect user data - but rather the host. + If any user data is compromised, 0bin still provides the host with + plausible deniability (as they ignore the content of the pastes).

+

It would make no sense if the host was to compromise the encryption process + to read the data; in that case, they wouldn't have + installed 0bin in the first place, as 0bin is here to protect them.

+

However, if you want to ensure your data is not read in anyway, you should + not use 0bin. Use OTR for chatting, + GnuPG for encrypted & verified data sharing, with EnigMail + for emails and TrueCrypt for storage.

+

It would be unlikely for those softwares to fail you. Errors will nearly always come from your side - you ought to have a perfect operations security + if you do not want your data to be leaked. Remember to use your common sense.

-
How did you come out with such a cool idea?
+
How did the idea of 0bin emerge?
-

We didn't, we based 0bin on - sebsauvage's work.

- -

It was a reaction to - Pastebin been forced to moderate its content - because of so many illegal stuffed posted to it. 0bin should be used the - same way Pastebin is for users. The only - difference is that if you host it, we hope the encryption - feature can be used as a defense. This is not proven though :-)

- +

0bin is based on sebsauvage's work. + The project sprang as a reaction to the implementation of a moderation system on Pastebin, + due to the significant amount of illegal content pasted on it, or that it linked to.

- +
How can I get 0bin?
+
+

0bin is an open-source project, and the code is hosted on GitHub. + You can either download a tarball or clone the repository.

+