Skip to content

Commit 6387eb1

Browse files
sametmaxsametmax
committed
Merge pull request Tygs#55 from iceTwy/master
Rewrite & add further info to the FAQ
2 parents 1a99bde + 706ad42 commit 6387eb1

File tree

1 file changed

+47
-45
lines changed

1 file changed

+47
-45
lines changed

‎zerobin/views/faq.tpl

Lines changed: 47 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -4,64 +4,66 @@
44

55
<hr width="90%">
66

7-
<dl>
8-
9-
<dt>How does it work?</dt>
7+
<dl>
8+
<dt>How does 0bin work?</dt>
109
<dd>
11-
<p>We generate a random key, and encrypt the paste with it using
10+
<p>A random key is generated and used to encrypt the paste, thanks to
1211
the <a href="http://crypto.stanford.edu/sjcl/">sjcl</a>
13-
javascript library.</p>
14-
<p>The content is sent encrypted to the server, which returns the
12+
JavaScript library.</p>
13+
<p>The encrypted content is then sent to the server, which returns the
1514
address of the newly created paste.</p>
16-
<p>The javascript code then redirects to this address, but it adds the
15+
<p>The JavaScript code redirects to this address, but it adds the
1716
encryption key in the URL hash (#).</p>
18-
<p>When somebody want to read the paste, he usually just click on a link
19-
with this URL. If the hash containing the key is part of it, Obin's
20-
javascript will use it to decrypt the content sent by the server.</p>
21-
<p>The browser never sends the hash to the server, so it does not
22-
receives the key.</p>
17+
<p>When somebody wants to read the paste, they will usually click on a link
18+
with this URL. If the hash containing the key is a part of it, 0bin's
19+
JavaScript will use it to decrypt the content sent by the server.</p>
20+
<p>The browser never sends the hash to the server, so the latter does not
21+
receives the key at any time.</p>
2322
</dd>
2423

25-
<dt>Javascript encryption is not secure!</dt>
24+
<dt>But JavaScript encryption is not secure!</dt>
2625
<dd>
27-
<p>No it's not.</p>
28-
<p>The goal of 0bin is <strong>not</strong> to protect the users
29-
or their secrets.</p>
30-
<p>The goal is to make it hard to sue the host because of the
31-
content users pasted in his service. The idea is that you can not
32-
require somebody to moderate something he can't read</p>
26+
<p>No, it isn't.</p>
27+
<p>The goal of 0bin is <strong>not</strong> to protect the user and their data
28+
(including, obviously, their secrets).</p>
29+
<p>Instead, it aims to protect the host from being sued for the
30+
content users pasted on the pastebin. The idea is that you cannot
31+
require somebody to moderate something they cannot read - as such,
32+
the host is granted plausible deniability.</p>
33+
34+
<p>Remember that as an user, you should use 0bin in the same way as unencrypted and
35+
insecure pastebins - that is, with caution. The only difference with those is that if
36+
you decide to host a 0bin server, the encryption feature hopefully be used as a defense.
37+
This is not proven, though! :-)
38+
3339
</dd>
34-
<dt>What if the server changes the Javascript code? Or in the case of a man
35-
in the middle attack?</dt>
40+
<dt>What if the server changes the JavaScript code? And what happens in the case of a <a href="https://en.wikipedia.org/wiki/Man-in-the-middle_attack">MITM attack</a>?</dt>
3641
<dd>
3742
<p>Read above.</p>
38-
<p>0bin the is not built to protect the users content. It is built to
39-
protect the host. If the user content is compromised, 0bin still
40-
provides the host with the main feature: ignorance of the hosted content.</p>
41-
<p>The case where the host himself compromises the encryption process
42-
to read the content makes no sense: in that case he wouldn't have
43-
installed 0bin in the first place. 0bin is here to protect him.</p>
44-
<p><strong>If you want to be sure nobody can read your content, you should
45-
not use 0bin</strong>. Use
46-
<a href="https://crypto.cat/">cryptocat</a> (but JS crypto warnings apply)
47-
or <a href="http://www.cypherpunks.ca/otr/">OTR</a> for chatting,
48-
<a href="http://gnupg.org/">GPG</a>/<a href="http://enigmail.mozdev.org/home/index.php.html">enignmail</a>
49-
for emails and <a href="http://www.truecrypt.org/">TrueCrypt</a> for storage.</p>
43+
<p>0bin is not built, and does not aim, to protect user data - but rather the host.
44+
If any user data is compromised, 0bin still provides the host with
45+
plausible deniability (as they ignore the content of the pastes).</p>
46+
<p>It would make no sense if the host was to compromise the encryption process
47+
to read the data; in that case, they wouldn't have
48+
installed 0bin in the first place, as 0bin is here to protect them.</p>
49+
<p><strong>However, if you want to ensure your data is not read in anyway, you should
50+
not use 0bin</strong>. Use <a href="http://www.cypherpunks.ca/otr/">OTR</a> for chatting,
51+
<a href="https://gnupg.org/">GnuPG</a> for encrypted & verified data sharing, with <a href="https://www.enigmail.net/">EnigMail</a>
52+
for emails and <a href="http://www.truecrypt.org/">TrueCrypt</a> for storage.</p>
53+
<p>It would be unlikely for those softwares to fail you. Errors will nearly always come from your side - you ought to have a perfect <a href="https://en.wikipedia.org/wiki/Operations_security">operations security</a>
54+
if you do not want your data to be leaked. Remember to use your common sense.</p>
5055
</dd>
51-
<dt>How did you come out with such a cool idea?</dt>
56+
<dt>How did the idea of 0bin emerge?</dt>
5257
<dd>
53-
<p>We didn't, we based 0bin on
54-
<a href="http://sebsauvage.net/paste/">sebsauvage's work</a>.</p>
55-
56-
<p>It was a reaction to
57-
<a href="https://www.zdnet.com/blog/security/pastebin-to-hunt-for-hacker-pastes-anonymous-cries-censorship/11336">Pastebin been forced to moderate its content</a>
58-
because of so many illegal stuffed posted to it. 0bin should be used the
59-
same way <a href="pastebin.com">Pastebin</a> is for users. The only
60-
difference is that if you host it, we hope the encryption
61-
feature can be used as a defense. This is not proven though :-)</p>
62-
58+
<p>0bin is based on <a href="http://sebsauvage.net/wiki/doku.php?id=php:zerobin">sebsauvage's work</a>.
59+
The project sprang as a reaction to <a href="https://www.zdnet.com/blog/security/pastebin-to-hunt-for-hacker-pastes-anonymous-cries-censorship/11336">the implementation of a moderation system on Pastebin</a>,
60+
due to the significant amount of illegal content pasted on it, or that it linked to.</p>
6361
</dd>
64-
62+
<dt>How can I get 0bin?</dt>
63+
<dd>
64+
<p>0bin is an open-source project, and the code is hosted on <a href="https://github.com/sametmax/0bin">GitHub</a>.
65+
You can either download a tarball or clone the repository.</p>
66+
</dd>
6567
</dl>
6668

6769
</div>

0 commit comments

Comments
 (0)