search

sebsauvage / ZeroBin

A minimalist, opensource online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256 bits AES.
http://sebsauvage.net/wiki/doku.php?id=php:zerobin
952 stars 213 forks source link

Burn After Reading and JS disabled #89

Open SoniEx2 opened 9 years ago

SoniEx2 commented 9 years ago

Currently if you have JS disabled and open a BAR paste, it gets deleted, even tho you didn't read it. My proposal is to move paste data loading to a script, and change how you access paste data to use, say, myzerobin/pastedata_<id> instead of embedding it into the page.

This would also solve IRC bots deleting BAR pastes when fetching page info.

exec commented 9 years ago

The way it works currently, the server accesses the data from the identifier, regardless of whether or not the crypto key is correct. This is because the crypto data is stored in the file along with whether or not the file is burn-on-read. As a part of fetching that data, it reads whether or not the file is burn-on-read, then if it is, wipes the file. That's the design of ZeroBin. A way to get around this would be to create a basic HTML page with an instant meta redirect to the content, then share that to the person who you intend to share the information with. Not very quick or easy, but it works.

SoniEx2 commented 9 years ago

I don't care if it gets deleted if you use the wrong key, that's fine.

But if you delete it when JS is off...