(Jan 24, 2014 03:55 PM)Snorlax Wrote:  Not yet. So unless somebody gets access to your account, your PMs will be safe.
Read this: https://hackforums.net/showthread.php?tid=4015844&pid=37898990#pid37898990

---

Most likely. I hope so. Thanks for pointing out.

Do you mind sending me that code you used in a PM?

(Jan 24, 2014 03:58 PM)Wolf Haley Wrote:  I imagine any HTML would work. But this is what it was in particular.

<iframe src=""></iframe>

(Jan 24, 2014 04:14 PM)DogeCoin Wrote:  Hm, I don't like the thought of my PMs being unencrypted and readable by anyone... I'm no expert in encryption but perhaps you could encrypt our passwords with our hashed password as the key (use new salt of course). I don't know. I just think security should be the #1 priority here.

BTW, do you guys have a github for this? Open source would be great.

(Jan 24, 2014 04:20 PM)Snorlax Wrote:  Unfortunately not. It is closed for now.
The encryption will be safe. Nobody will be able to decrypt your messages unless you use a bad password like 123.
Look up XOR ;) It will be secure. Trust me.

(Jan 24, 2014 04:24 PM)DogeCoin Wrote:  Oh, really? I thought you only had encryption for passwords.

So even the people who have access to the server wont be able to read the PM logs?

(Jan 24, 2014 04:26 PM)Snorlax Wrote:  You are absolutely right!
https://hackforums.net/showthread.php?tid=4015844&pid=37898990#pid37898990

Take a look at the screenshot. Some of those are regular messages starting with [quote=... and so on.
It will not be readable by anyone but you, if you know the encryption key!

(Jan 24, 2014 04:40 PM)DogeCoin Wrote:  Thanks, but how is that encryption key generated? Via our password?

(Jan 24, 2014 04:42 PM)Snorlax Wrote:  You enter an encryption key for your uploads, and then you would have to enter that key to unlock the messages (I guess unlocking to the session would be okay).

Okay so the XSS has been fixed. I have no idea why the first thing did not work... Do not ask me, lol.

(Jan 24, 2014 04:44 PM)DogeCoin Wrote:  Thanks for explaining everything, looks really HQ. BTW, I have a spare SSL cert if you want it feel free to PM me.

(Jan 24, 2014 05:51 PM)binary_paroxysm Wrote:  Hey, you should post the source code to github so we can evaluate it and run our own instance. Decentralized systems are very hard to backdoor ;)

Also, code auditing is a great community activity

(Jan 24, 2014 05:55 PM)Snorlax Wrote:  It will not be open source at the moment.

(Jan 24, 2014 05:57 PM)binary_paroxysm Wrote:  https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle

Well, I would strongly advise everyone to not use this system until it has been open sourced. Otherwise, it's like sticking your dick into a stranger's asshole. You never know what you'll catch ;)

(Jan 24, 2014 06:06 PM)1n9i9c7om Wrote:  So you're saying that you shouldn't use it because it's not open source? Please ask Mark Zuckerberg to release the Facebook Source. 🤝
--
I see where you come from, you want to be sure that the system is secure and even the people who have access to the can't read the PMs. You either trust this page or you don't, but you can't force us/'Snorlax to make it open source. ;)

(Jan 24, 2014 06:08 PM)binary_paroxysm Wrote:  Seems like you could use some help locking it down, though.