No not currently, not comfort taking funding for any of my projects right now, until I establish some sort of expensive breakdown and transparent fund use. But even with funding a decent audit from a company who knows what they are doing would probably be 7k USD minimum.
Don’t know the complete inner workings of Cryptpad. But it appears Purplix uses more modern encryption, uses more modern frameworks & has more safe guards against MITM attacks. Also additional options like captcha, proxy block, account required etc.
No, survey questions and answers are encrypted & decrypted locally. At no point does the server or any other actors can view that plain data said from whom the survey is intended for.
I understand encrypted-at-rest to mean that the data is always stored under encryption, except when it is being actively being used or displayed. Am I wrong?
So in your usecase also, all data is stored under encryption and only decrypted by the surveyor or the surveyed; so this is encrypted at rest, no?
Encrypted at rest doesn’t always mean E2EE. For example if data is transmitted in plain text to the server and then encrypted before storage. This is still encrypted at rest.
E2EE meaning survey questions and answers are encrypted locally & decrypted locally. The server or any other actors can’t view survey questions aside from users its shared with and survey answers are only readable by the owner of such survey.
This means on a data leak, nothing is readable.
Yea Purplix.io is still in development, so it isn’t live yet. Hense the fail DNS lookup you show.
Not 100% sure what you mean, but the encryption key for questions are only known by users who are shared the link & is never transmitted to the server. Answers are encrypted by the survey’s public key what only the creator of said survey knows the private key. The public key is also encrypted by the secret key in the URL so the server can’t even submit answers.
s/64b185662c74e7c40cac5e66 - This is the survey ID, transmitted to server.
/KfcrkxiR-4nomGbEqNos0dyhEBsgiUAqPpZiRQt5syE - This is a hash of the survey’s signing public key, this is to stop MITM attacks from the host & validation of the survey questions.
#oAnQnjWhxq2IFTZBvrylVSHxg92HoWQr2mJQ-qZwvPY - This is the secret key for decrypting questions, this is also used to decrypt the public key for encrypting answers. This key is never transmitted to server.
All encryption & decryption happens locally, so the server never sees any plain text. It is possible for the host to modify the frontend to expose keys, but this is true of any web app & Purplix is hosted from Vercel straight from our Git repo, so it would be quite obvious if this happened.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !privacyguides@lemmy.one
In the digital age, protecting your personal information might seem like an impossible task. We’re here to help.
This is a community for sharing news about privacy, posting information about cool privacy tools and services, and getting advice about your privacy journey.
You can subscribe to this community from any Kbin or Lemmy instance:
Check out our website at privacyguides.org before asking your questions here. We’ve tried answering the common questions and recommendations there!
Want to get involved? The website is open-source on GitHub, and your help would be appreciated!
This community is the “official” Privacy Guides community on Lemmy, which can be verified here. Other “Privacy Guides” communities on other Lemmy servers are not moderated by this team or associated with the website.
Moderation Rules:
We prefer posting about open-source software whenever possible.
No soliciting engagement: Don’t ask for upvotes, follows, etc.
Surveys, Fundraising, and Petitions must be pre-approved by the mod team.
Be civil, no violence, hate speech. Assume people here are posting in good faith.
Don’t repost topics which have already been covered here.
News posts must be related to privacy and security, and your post title must match the article headline exactly. Do not editorialize titles, you can post your opinions in the post body or a comment.
Memes/images/video posts that could be summarized as text explanations should not be posted. Infographics and conference talks from reputable sources are acceptable.
No help vampires: This is not a tech support subreddit, don’t abuse our community’s willingness to help. Questions related to privacy, security or privacy/security related software and their configurations are acceptable.
No misinformation: Extraordinary claims must be matched with evidence.
Do not post about VPNs or cryptocurrencies which are not listed on privacyguides.org. See Rule 2 for info on adding new recommendations to the website.
General guides or software lists are not permitted. Original sources and research about specific topics are allowed as long as they are high quality and factual. We are not providing a platform for poorly-vetted, out-of-date or conflicting recommendations.
Looks pretty cool
While I can’t say I would have use for it myself I wish you luck and will spread it around where I can.
Sheeesshh, you know when Public lewdness supports your project you know its good! Thanks for the kind words, have a great day.
Purplix now supports per Survey & per Canary themes.
Can’t really see your screenshots but do you have alternate voting systems like Ranked Choice or Approval?
Purplix is planning to launch with multiple choice, single choice, short answer and long answer. After launch we’ll be adding additional answer types.
deleted by creator
Yea I’d love to have Paaster audited, currently I don’t think its likely I’d get enough funding to do so as auditing is expensive.
deleted by creator
No not currently, not comfort taking funding for any of my projects right now, until I establish some sort of expensive breakdown and transparent fund use. But even with funding a decent audit from a company who knows what they are doing would probably be 7k USD minimum.
I do have a personal fund for hosting, what is used for Paaster. https://github.com/sponsors/WardPearce
How does in compare to https://cryptpad.fr?
Don’t know the complete inner workings of Cryptpad. But it appears Purplix uses more modern encryption, uses more modern frameworks & has more safe guards against MITM attacks. Also additional options like captcha, proxy block, account required etc.
Where is the data stored? Is it encrypted at rest?
No, survey questions and answers are encrypted & decrypted locally. At no point does the server or any other actors can view that plain data said from whom the survey is intended for.
I understand encrypted-at-rest to mean that the data is always stored under encryption, except when it is being actively being used or displayed. Am I wrong? So in your usecase also, all data is stored under encryption and only decrypted by the surveyor or the surveyed; so this is encrypted at rest, no?
Encrypted at rest doesn’t always mean E2EE. For example if data is transmitted in plain text to the server and then encrypted before storage. This is still encrypted at rest.
Excellent work! I’ve been looking for something like this for AGES
When you say end-to-end encrypted, what are you referring to?
What’s the intent for this tool that isn’t solved via TLS?
Also, just as an aside, but this is kind of funny given the context:
E2EE meaning survey questions and answers are encrypted locally & decrypted locally. The server or any other actors can’t view survey questions aside from users its shared with and survey answers are only readable by the owner of such survey.
This means on a data leak, nothing is readable.
Yea Purplix.io is still in development, so it isn’t live yet. Hense the fail DNS lookup you show.
How does that work? Couldn’t the server just pretend to be a client?
Not 100% sure what you mean, but the encryption key for questions are only known by users who are shared the link & is never transmitted to the server. Answers are encrypted by the survey’s public key what only the creator of said survey knows the private key. The public key is also encrypted by the secret key in the URL so the server can’t even submit answers.
Here is a example URL of a survey.
example.com/s/64b185662c74e7c40cac5e66/KfcrkxiR-4nomGbEqNos0dyhEBsgiUAqPpZiRQt5syE#oAnQnjWhxq2IFTZBvrylVSHxg92HoWQr2mJQ-qZwvPY
s/64b185662c74e7c40cac5e66- This is the survey ID, transmitted to server./KfcrkxiR-4nomGbEqNos0dyhEBsgiUAqPpZiRQt5syE- This is a hash of the survey’s signing public key, this is to stop MITM attacks from the host & validation of the survey questions.#oAnQnjWhxq2IFTZBvrylVSHxg92HoWQr2mJQ-qZwvPY- This is the secret key for decrypting questions, this is also used to decrypt the public key for encrypting answers. This key is never transmitted to server.All encryption & decryption happens locally, so the server never sees any plain text. It is possible for the host to modify the frontend to expose keys, but this is true of any web app & Purplix is hosted from Vercel straight from our Git repo, so it would be quite obvious if this happened.
I’m going to assume whoever is hosting the service can’t view your surveys and results.