[badbrains]

Not yet. So unless somebody gets access to your account, your PMs will be safe.
Read this: https://hackforums.net/showthread.php?ti...id37898990

---

Most likely. I hope so. Thanks for pointing out.

Do you mind sending me that code you used in a PM?

I imagine any HTML would work. But this is what it was in particular.

<iframe src=""></iframe>

[Null Byte]

Hm, I don't like the thought of my PMs being unencrypted and readable by anyone... I'm no expert in encryption but perhaps you could encrypt our passwords with our hashed password as the key (use new salt of course). I don't know. I just think security should be the #1 priority here.

BTW, do you guys have a github for this? Open source would be great.

['Snorlax]

I imagine any HTML would work. But this is what it was in particular.

<iframe src=""></iframe>

Looking into it. I found the issue! ;)

Hm, I don't like the thought of my PMs being unencrypted and readable by anyone... I'm no expert in encryption but perhaps you could encrypt our passwords with our hashed password as the key (use new salt of course). I don't know. I just think security should be the #1 priority here.

BTW, do you guys have a github for this? Open source would be great.

Unfortunately not. It is closed for now.
The encryption will be safe. Nobody will be able to decrypt your messages unless you use a bad password like 123.
Look up XOR ;) It will be secure. Trust me.

[Null Byte]

Unfortunately not. It is closed for now.
The encryption will be safe. Nobody will be able to decrypt your messages unless you use a bad password like 123.
Look up XOR ;) It will be secure. Trust me.

Oh, really? I thought you only had encryption for passwords.

So even the people who have access to the server wont be able to read the PM logs?

['Snorlax]

Oh, really? I thought you only had encryption for passwords.

So even the people who have access to the server wont be able to read the PM logs?

You are absolutely right!
https://hackforums.net/showthread.php?ti...id37898990

Take a look at the screenshot. Some of those are regular messages starting with [quote=... and so on.
It will not be readable by anyone but you, if you know the encryption key!

[Null Byte]

You are absolutely right!
https://hackforums.net/showthread.php?ti...id37898990

Take a look at the screenshot. Some of those are regular messages starting with [quote=... and so on.
It will not be readable by anyone but you, if you know the encryption key!

Thanks, but how is that encryption key generated? Via our password?

['Snorlax]

Thanks, but how is that encryption key generated? Via our password?

You enter an encryption key for your uploads, and then you would have to enter that key to unlock the messages (I guess unlocking to the session would be okay).

Okay so the XSS has been fixed. I have no idea why the first thing did not work... Do not ask me, lol.

[Null Byte]

You enter an encryption key for your uploads, and then you would have to enter that key to unlock the messages (I guess unlocking to the session would be okay).

Okay so the XSS has been fixed. I have no idea why the first thing did not work... Do not ask me, lol.

Thanks for explaining everything, looks really HQ. BTW, I have a spare SSL cert if you want it feel free to PM me.

['Snorlax]

Thanks for explaining everything, looks really HQ. BTW, I have a spare SSL cert if you want it feel free to PM me.

Oh interesting. My mate and I have our own hosting "company", so we get our certificates pretty cheap.
I will shoot you a PM if I ever need it. Maybe we can make a deal ;) We will see.

[sarciszewski]

Hey, you should post the source code to github so we can evaluate it and run our own instance. Decentralized systems are very hard to backdoor ;)

Also, code auditing is a great community activity

['Snorlax]

Hey, you should post the source code to github so we can evaluate it and run our own instance. Decentralized systems are very hard to backdoor ;)

Also, code auditing is a great community activity

It will not be open source at the moment.

[sarciszewski]

It will not be open source at the moment.

https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle

Well, I would strongly advise everyone to not use this system until it has been open sourced. Otherwise, it's like sticking your dick into a stranger's asshole. You never know what you'll catch ;)

[1n9i9c7om]

https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle

Well, I would strongly advise everyone to not use this system until it has been open sourced. Otherwise, it's like sticking your dick into a stranger's asshole. You never know what you'll catch ;)

So you're saying that you shouldn't use it because it's not open source? Please ask Mark Zuckerberg to release the Facebook Source. 🤝
--
I see where you come from, you want to be sure that the system is secure and even the people who have access to the can't read the PMs. You either trust this page or you don't, but you can't force us/'Snorlax to make it open source. ;)

[sarciszewski]

So you're saying that you shouldn't use it because it's not open source? Please ask Mark Zuckerberg to release the Facebook Source. 🤝
--
I see where you come from, you want to be sure that the system is secure and even the people who have access to the can't read the PMs. You either trust this page or you don't, but you can't force us/'Snorlax to make it open source. ;)

Hehe. Show me my Facebook page and I'll concede your point :3

I'm glad you get it. Kerckhoff's Principle isn't as widely known as it ought to be.

Seems like you could use some help locking it down, though. I can help, but I don't contribute to closed source products. I'd be betraying years of GNU/Linux if I did ;)

[1n9i9c7om]

Seems like you could use some help locking it down, though.

Nope. As you could see on a screenshot that 'Snorlax posted, he's already working on it. :)