overview for Ward

Don't know the complete inner workings of Cryptpad. But it appears Purplix uses more modern encryption, uses more modern frameworks & has more safe guards against MITM attacks. Also additional options like captcha, proxy block, account required etc.

I've been working on a end-to-end encrypted survey system in c/[email protected]

[–] [email protected] 1 points 2 years ago

Purplix is planning to launch with multiple choice, single choice, short answer and long answer. After launch we'll be adding additional answer types.

I've been working on a end-to-end encrypted survey system in c/[email protected]

[–] [email protected] 1 points 2 years ago* (last edited 2 years ago)

Not 100% sure what you mean, but the encryption key for questions are only known by users who are shared the link & is never transmitted to the server. Answers are encrypted by the survey's public key what only the creator of said survey knows the private key. The public key is also encrypted by the secret key in the URL so the server can't even submit answers.

Here is a example URL of a survey.

example.com/s/64b185662c74e7c40cac5e66/KfcrkxiR-4nomGbEqNos0dyhEBsgiUAqPpZiRQt5syE#oAnQnjWhxq2IFTZBvrylVSHxg92HoWQr2mJQ-qZwvPY

s/64b185662c74e7c40cac5e66 - This is the survey ID, transmitted to server.
/KfcrkxiR-4nomGbEqNos0dyhEBsgiUAqPpZiRQt5syE - This is a hash of the survey's signing public key, this is to stop MITM attacks from the host & validation of the survey questions.
#oAnQnjWhxq2IFTZBvrylVSHxg92HoWQr2mJQ-qZwvPY - This is the secret key for decrypting questions, this is also used to decrypt the public key for encrypting answers. This key is never transmitted to server.

All encryption & decryption happens locally, so the server never sees any plain text. It is possible for the host to modify the frontend to expose keys, but this is true of any web app & Purplix is hosted from Vercel straight from our Git repo, so it would be quite obvious if this happened.

I've been working on a end-to-end encrypted survey system in c/[email protected]

[–] [email protected] 3 points 2 years ago* (last edited 2 years ago)

No not currently, not comfort taking funding for any of my projects right now, until I establish some sort of expensive breakdown and transparent fund use. But even with funding a decent audit from a company who knows what they are doing would probably be 7k USD minimum.

I do have a personal fund for hosting, what is used for Paaster. https://github.com/sponsors/WardPearce

I've been working on a end-to-end encrypted survey system in c/[email protected]

[–] [email protected] 1 points 2 years ago (2 children)

Yea I'd love to have Paaster audited, currently I don't think its likely I'd get enough funding to do so as auditing is expensive.

I've been working on a end-to-end encrypted survey system in c/[email protected]

[–] [email protected] 3 points 2 years ago

Encrypted at rest doesn't always mean E2EE. For example if data is transmitted in plain text to the server and then encrypted before storage. This is still encrypted at rest.