[Tommy Chong-]

This is a little project I've been working on and I'm offering it free to use for everyone.
I'll be improving it over time.


Current features:
Destroyable messages
Message tracker
Disposable Shoutbox
All messages are stored encrypted in the database using Rijndael 256 encryption
IP logger with multiple domains and extensions

The Encryption Key is now giving along with the created message and no longer stored anywhere

Added a simple IP logger with the follow links to choose from:

zippyshare.cf
fileupload.ga
imageshare.cf
4cdn.cf (based of 4chan's 4cdn.org)

With the following extensions:

.jpg, .png, .gif, .php, .html, .mp3, .mp4, .exe, .rar, .zip, .webm

[Mi2414]

Interesting, posting to read over later.

[Orgy]

does it encrypt the message server side or client side? same question for decryption

[Tommy Chong-]

does it encrypt the message server side or client side? same question for decryption

Server side 🤝

[Orgy]

Server side 🤝

yeah fuck that

---

edit: follow up question: where do you store the encryption key?

[SUI-3183372]

yeah fuck that

---

edit: follow up question: where do you store the encryption key?

On a separate server directly connected to the main server.

I wonder if it'd be a good idea if you could set your own key? Nah.... probably not. Too secure.

[Orgy]

On a separate server directly connected to the main server.

Ah so if the anyone takes the main box they can easily access the keys and therefore decrypt everything?

[AnonymousDownload]

Very interesting. If you choose the message to be destroyed upon reading, does it still have a log or a way to be viewed if someone takes the main box as Orgy theorized?

Most of whom I speak with where I'm concerned about utmost security is on these forums...so for me our HF XMPP works great.

I've been seeing most people abandon all security and just jump to skype though. Is this as commonplace as I've been seeing?

[SwordofJustice]

Just a suggestion for your destroyable messages, you might want to make it so that when someone clicks on the message, it redirects them to a generic url so that the message cannot be tied to anyone sending it through IMs / PMs.

[Tommy Chong-]

Seems like it.

Only way of being safe with stuff like this is keeping the encryption, decryption, and key client side (javascript).

I'll be looking into this.

This is the first thing I ever actually coded so I'm sorry if it's not what you've expected.
Messages that are destroyed can't be decrypted because they simply don't exist anymore.

[Tommy Chong-]

I don't suggest doing anything security related if you're new to coding.

But, as it's definitely a nice project, look at how privnote handles it;
You enter your message and when you submit it to the server, javascript in the client's browser encrypts said message.
The message is sent to their servers, without any sort of encryption key that's being stored.
The key is displayed using javascript, and is added to the generated url after the # character (which is a Fragment identifier).
This key is not sent to the server, but can be accessed by javascript.
Thus the client loads the generated url and gets the message that was encrypted. The key is then used by javascript to decrypt the message.
(An extra failsafe is added to the message to make sure decryption was successful, a simple string would be perfectly fine)

This is how a safe "encrypted note" website works, and should only work.

Good luck.

Alright, thanks for taking your time to explain this
I'll take my time to look into this and implement it if I'm able to in the future.
I understand the way how I approached it isn't the most secure way, but it's better than nothing I guess.

Anyways, +1

[Orgy]

I understand the way how I approached it isn't the most secure way, but it's better than nothing I guess.

Anyways, +1

I disagree. Providing a false sense of security is worse than providing no security.

[Tommy Chong-]

The encryption key is now given along with the encrypted message and no longer stored in any database

[Tommy Chong-]

Updated IP logging links as cloudflare anally penetrated me.