mirror/0bin
1
0
Fork 0
mirror of https://github.com/Tygs/0bin.git synced 2023-08-10 21:13:00 +03:00
Code Issues Projects Releases Wiki Activity

Rewrite & add further info to the FAQ

Browse Source 
The FAQ contained a bunch of typos and inaccurate information. Hopefully, this should fix both problems.
This commit is contained in:
iceTwy 2013-10-03 23:36:30 +02:00
parent 1a99bde81c
commit 706ad42098
1 changed files with 47 additions and 45 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

88
zerobin/views/faq.tpl
View File

@ -5,63 +5,65 @@
<hr width="90%"> <hr width="90%">
<dl> <dl>
<dt>How does 0bin work?</dt>
<dt>How does it work?</dt>
<dd> <dd>
<p>We generate a random key, and encrypt the paste with it using <p>A random key is generated and used to encrypt the paste, thanks to
the <a href="http://crypto.stanford.edu/sjcl/">sjcl</a> the <a href="http://crypto.stanford.edu/sjcl/">sjcl</a>
javascript library.</p> JavaScript library.</p>
<p>The content is sent encrypted to the server, which returns the <p>The encrypted content is then sent to the server, which returns the
address of the newly created paste.</p> address of the newly created paste.</p>
<p>The javascript code then redirects to this address, but it adds the <p>The JavaScript code redirects to this address, but it adds the
encryption key in the URL hash (#).</p> encryption key in the URL hash (#).</p>
<p>When somebody want to read the paste, he usually just click on a link <p>When somebody wants to read the paste, they will usually click on a link
with this URL. If the hash containing the key is part of it, Obin's with this URL. If the hash containing the key is a part of it, 0bin's
javascript will use it to decrypt the content sent by the server.</p> JavaScript will use it to decrypt the content sent by the server.</p>
<p>The browser never sends the hash to the server, so it does not <p>The browser never sends the hash to the server, so the latter does not
receives the key.</p> receives the key at any time.</p>
</dd> </dd>
<dt>Javascript encryption is not secure!</dt> <dt>But JavaScript encryption is not secure!</dt>
<dd> <dd>
<p>No it's not.</p> <p>No, it isn't.</p>
<p>The goal of 0bin is <strong>not</strong> to protect the users <p>The goal of 0bin is <strong>not</strong> to protect the user and their data
or their secrets.</p> (including, obviously, their secrets).</p>
<p>The goal is to make it hard to sue the host because of the <p>Instead, it aims to protect the host from being sued for the
content users pasted in his service. The idea is that you can not content users pasted on the pastebin. The idea is that you cannot
require somebody to moderate something he can't read</p> require somebody to moderate something they cannot read - as such,
the host is granted plausible deniability.</p>
<p>Remember that as an user, you should use 0bin in the same way as unencrypted and
insecure pastebins - that is, with caution. The only difference with those is that if
you decide to host a 0bin server, the encryption feature hopefully be used as a defense.
This is not proven, though! :-)
</dd> </dd>
<dt>What if the server changes the Javascript code? Or in the case of a man <dt>What if the server changes the JavaScript code? And what happens in the case of a <a href="https://en.wikipedia.org/wiki/Man-in-the-middle_attack">MITM attack</a>?</dt>
in the middle attack?</dt>
<dd> <dd>
<p>Read above.</p> <p>Read above.</p>
<p>0bin the is not built to protect the users content. It is built to <p>0bin is not built, and does not aim, to protect user data - but rather the host.
protect the host. If the user content is compromised, 0bin still If any user data is compromised, 0bin still provides the host with
provides the host with the main feature: ignorance of the hosted content.</p> plausible deniability (as they ignore the content of the pastes).</p>
<p>The case where the host himself compromises the encryption process <p>It would make no sense if the host was to compromise the encryption process
to read the content makes no sense: in that case he wouldn't have to read the data; in that case, they wouldn't have
installed 0bin in the first place. 0bin is here to protect him.</p> installed 0bin in the first place, as 0bin is here to protect them.</p>
<p><strong>If you want to be sure nobody can read your content, you should <p><strong>However, if you want to ensure your data is not read in anyway, you should
not use 0bin</strong>. Use not use 0bin</strong>. Use <a href="http://www.cypherpunks.ca/otr/">OTR</a> for chatting,
<a href="https://crypto.cat/">cryptocat</a> (but JS crypto warnings apply) <a href="https://gnupg.org/">GnuPG</a> for encrypted & verified data sharing, with <a href="https://www.enigmail.net/">EnigMail</a>
or <a href="http://www.cypherpunks.ca/otr/">OTR</a> for chatting,
<a href="http://gnupg.org/">GPG</a>/<a href="http://enigmail.mozdev.org/home/index.php.html">enignmail</a>
for emails and <a href="http://www.truecrypt.org/">TrueCrypt</a> for storage.</p> for emails and <a href="http://www.truecrypt.org/">TrueCrypt</a> for storage.</p>
<p>It would be unlikely for those softwares to fail you. Errors will nearly always come from your side - you ought to have a perfect <a href="https://en.wikipedia.org/wiki/Operations_security">operations security</a>
if you do not want your data to be leaked. Remember to use your common sense.</p>
</dd> </dd>
<dt>How did you come out with such a cool idea?</dt> <dt>How did the idea of 0bin emerge?</dt>
<dd> <dd>
<p>We didn't, we based 0bin on <p>0bin is based on <a href="http://sebsauvage.net/wiki/doku.php?id=php:zerobin">sebsauvage's work</a>.
<a href="http://sebsauvage.net/paste/">sebsauvage's work</a>.</p> The project sprang as a reaction to <a href="https://www.zdnet.com/blog/security/pastebin-to-hunt-for-hacker-pastes-anonymous-cries-censorship/11336">the implementation of a moderation system on Pastebin</a>,
due to the significant amount of illegal content pasted on it, or that it linked to.</p>
<p>It was a reaction to </dd>
<a href="https://www.zdnet.com/blog/security/pastebin-to-hunt-for-hacker-pastes-anonymous-cries-censorship/11336">Pastebin been forced to moderate its content</a> <dt>How can I get 0bin?</dt>
because of so many illegal stuffed posted to it. 0bin should be used the <dd>
same way <a href="pastebin.com">Pastebin</a> is for users. The only <p>0bin is an open-source project, and the code is hosted on <a href="https://github.com/sametmax/0bin">GitHub</a>.
difference is that if you host it, we hope the encryption You can either download a tarball or clone the repository.</p>
feature can be used as a defense. This is not proven though :-)</p>
</dd> </dd>
</dl> </dl>
</div> </div>