Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Password #15

Open
Quantum-Future opened this issue Aug 9, 2024 · 3 comments
Open

Add Password #15

Quantum-Future opened this issue Aug 9, 2024 · 3 comments

Comments

@Quantum-Future
Copy link

Good app. !
Is it possible to add support for setting a password?

@nain-F49FF806
Copy link
Owner

Good app. !

Thank you. Glad to hear you are liking it.

Is it possible to add support for setting a password?

It is.

But its utility is very limited, I believe. And correctly using it is actually tricky. So it has not been a priority.

To understand your use case, can you answer a few questions?

  1. What is the purpose of the password?

  2. How would you securely share the password?

  3. Are you aware that we already generate a secure encryption key,
    and that a password won't increase the encryption strength?

@Quantum-Future
Copy link
Author

Well, thinking about your questions, I realized that you're right: the utility is limited.
I'm aware of point 3: a password won't increase the encription stength, just thougth it will increase security by adding an additional "layer" (the need to know a password), but maybe it's not much worthwhile.

@nain-F49FF806
Copy link
Owner

nain-F49FF806 commented Aug 13, 2024

.. thougth it will increase security by adding an additional "layer" (the need to know a password), but maybe it's not much worthwhile

Yes, passwords in relation to privatebin work on the concept of preshared key. You must already have agreed to a unique password with the person you want to communicate with, like in person, or over phone.

In such a scenario, the agreed password could be useful for future pastes. However, in such a scenario, you might as well coordinate a more secure and reliable way to communicate, like Signal messenger / Autocrypt email.

To improve practical security with strangers (i.e no pre-agreed password), you could use the "burn on read" feature. This will ensure that the paste expires as soon as your recipient opens it, preventing anyone else from being able to access it thereafter. This of course assumes your communication isn't actively intercepted, but at most passively monitored.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants