|
|
@@ -17,7 +17,7 @@ Data is encrypted and decrypted in the browser using 256bit AES in [Galois Count
|
|
|
This is a fork of ZeroBin, originally developed by
|
|
|
[Sébastien Sauvage](https://github.com/sebsauvage/ZeroBin). ZeroBin was refactored
|
|
|
to allow easier and cleaner extensions. PrivateBin has many more features than the
|
|
|
-original ZeroBin. It is however still fully compatible to the original ZeroBin 0.19
|
|
|
+original ZeroBin. It is, however, still fully compatible to the original ZeroBin 0.19
|
|
|
data storage scheme. Therefore, such installations can be upgraded to PrivateBin
|
|
|
without losing any data.
|
|
|
|
|
|
@@ -38,15 +38,14 @@ without losing any data.
|
|
|
|
|
|
## What it doesn't provide
|
|
|
|
|
|
-- As a user you have to trust the server administrator, your internet provider,
|
|
|
- and any country the traffic passes through not to inject any malicious javascript code.
|
|
|
+- As a user you have to trust the server administrator.
|
|
|
For basic security, the PrivateBin installation *has to provide HTTPS*!
|
|
|
- Additionally it should be secured by
|
|
|
+ Otherwise you would also have to trust your internet provider, and any country
|
|
|
+ the traffic passes through not to inject any malicious javascript code.
|
|
|
+ Additionally the instance should be secured by
|
|
|
[HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) and
|
|
|
ideally by [HPKP](https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning) using a
|
|
|
- certificate, either validated by a trusted third party (check the certificate
|
|
|
- when first using a new PrivateBin instance), or self-signed by the server
|
|
|
- operator, validated using a
|
|
|
+ certificate. It can use traditional certificate authorities and/or use
|
|
|
[DNSSEC](https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions)
|
|
|
protected
|
|
|
[DANE](https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities)
|
|
|
@@ -58,8 +57,8 @@ without losing any data.
|
|
|
use a strong password and only share it privately and end-to-end-encrypted.
|
|
|
|
|
|
- A server admin might be forced to hand over access logs to the authorities.
|
|
|
- PrivateBin encrypts your text and the discussion contents, but who accessed it
|
|
|
- first might still be disclosed via such access logs.
|
|
|
+ PrivateBin encrypts your text and the discussion contents, but who accessed a
|
|
|
+ paste (first) might still be disclosed via access logs.
|
|
|
|
|
|
- In case of a server breach your data is secure as it is only stored encrypted
|
|
|
on the server. However, the server could be misused or the server admin could
|
rugk