Airborn: Create and edit files online, securely

https://www.airborn.io/

by raleighm • 8 years ago

159 70 8 years ago

iamwil• 8 years ago

Airborn needs to charge more for their business users. If there's one common lesson on Indie Hackers, it's that everyone (including customers) stands to gain from charging more.

If Airborn creators on on this thread: how did you think about getting people to pay while making the source available? It doesn't seem commonly done.

twiss18• 8 years ago

Yeah, I'll look at increasing prices. Thanks.

We're basically banking on medium-size businesses finding it more convenient to use a hosted service, especially when it offers the same or a higher level of security.

otoburb• 8 years ago

Great way to comply with GDPR! Also presumably reduces your data management overhead slightly, although it seems you're still storing data on your own systems[1]. This reminds me of SpiderOak's "No Knowledge" claim[2].

[1] https://www.airborn.io/docs/security

[2] https://spideroak.com/no-knowledge/

twiss18• 8 years ago

Thanks! No, all data is stored either on Amazon S3 or on our servers. The way we make sure that nobody can read your data is using encryption.

alehul• 8 years ago

(Disclaimer: I don't know much at all about the current standards of encryption)

Is this security not already standard, and not practiced by companies like Dropbox? As a side note, I like the collaboration aspect and one-person-per-paragraph is a pretty smart idea!

Edit: To those downvoting, sorry, I'm just curious and I think some of us were unaware of the differences between Airborn and other services, which I've now learned can still view your data

CGamesPlay2• 8 years ago

Most "encrypted communications" means that no unauthorized third parties can view the data as a result of the encryption. However, even if Dropbox stores your files encrypted, they still have the keys to those files and so could be coerced into decrypting (them through a warrant, for example).

lucideer2• 8 years ago

This looks potentially nice.

The initial assumption with these types of services is always that an attacker, having compromised their servers, could simply inject malicious code into the browser.

From their docs:

Normally, when hackers get access to your server, they can change the code that gets sent to customers. For example, they could make the code say "send your password to us". Then, even though they can't read documents immediately, passwords start coming in and they can soon read them.
To solve this, we're using a relatively new web technology (Service Workers) to install some code which can't be changed without setting off a warning to you. That code then keeps taps on all other code, and checks that it matches the publicly available version on GitHub.

Interested to see how robust it is...

EGreg2• 8 years ago

That's because the Web is not secure in precisely that way.

But how would you know an app developer wasn't compromised and signed the next version with a backdoor also?

twiss18• 8 years ago

The Service Worker doesn't simply check a signature from the developer, it checks the source code against the version on GitHub. So, to know whether it contains a backdoor, read the code on GitHub.

CGamesPlay2• 8 years ago

Interesting strategy to list updating the software as a premium feature. Will you make old versions of the software permanently available to customers to install on new devices? Will you support your v1 API forever?

twiss18• 8 years ago

Non-business accounts update to the latest version automatically. If you login to an old non-updated account using a new device, you get the old version. We might eventually notify old accounts that they have to update, but we haven't needed to do so yet. If you pay close attention to the requests by https://www.airborn.io/demo, you can see "v2" :)

oftenwrong• 8 years ago

Better headline:

"Airborn: Create and edit files online, securely."

HN has too many submissions with single-word headlines that tell you absolutely nothing about what you're clicking on.

raleighm• 8 years ago

Thanks. Done.

arnarbi• 8 years ago

How are encryption keys established between the clients?

prophesi2• 8 years ago

I like how they don't flaunt crypto terms all over the place. Calling encrypted content "gibberish" is fun.

And I think it's a genius use-case for Service Workers. From their security page[0]: "we're using a relatively new web technology (Service Workers) to install some code which can't be changed without setting off a warning to you. That code then keeps taps[sic] on all other code, and checks that it matches the publicly available version on GitHub."

Combine this with HSTS, and you can be certain the code running hasn't been modified by a third-party.

[0] https://www.airborn.io/docs/security

forapurpose2• 8 years ago

you can be certain

To be precise: If it works as described, it makes it (a little? substantially? orders of magnitude?) more difficult for third parties to modify the code.

"Certain" is not a word used in security, IME.

prophesi2• 8 years ago

Very true. You probably still need to trust that the developers' Github accounts aren't compromised. I was looking at their repo[0] for this Service Worker verification, and their "So what's the problem this solves?" section confuses me, as it doesn't explain the how. :/

[0] https://github.com/airbornio/signed-web-apps

esseti2• 8 years ago

few questions:

- here [0] "All documents are encrypted before they leave your computer" how then one can collaborate as in gdocs (from the pic it seems like that)

- what key do you use for encrypting the docs? is it the user password? if so it can't be recoverd (as dashlane for example [1]) is this the approach?

PS: the login seems broken https://www.airborn.io/app

[0]https://www.airborn.io/docs/security [1]https://support.dashlane.com/hc/en-us/articles/115003111325

twiss18• 8 years ago

- When you create a collaboration link, it contains an encryption key. (You can additionally also set a password.) All messages sent to the server by collaborators are then encrypted with those. The collaboration algorithm is currently quite simple, and paragraphs are locked when editing them. In the future we'd like to use a P2P algorithm, e.g. using Y.js. [1]

- When you sign up, the page downloads a file on your PC which contains your username, and your password encrypted with a "password recovery key". When you lose your password, we send you your password recovery key and you can decrypt your password with it.

[1] https://github.com/airbornio/airborn/issues/15

mapgrep3• 8 years ago

It is clever that you put the encryption key after the hash sign ("#") component of the collaboration URL, so it never touches your servers.

forapurpose2• 8 years ago

When you lose your password, we send you your password recovery key and you can decrypt your password with it.

Having the password recovery keys, can you decrypt user passwords? Does that matter in this scenario?

amelius• 8 years ago

Even if we get hacked, they can't read your documents.

Unless e.g. they make the system serve up malicious javascript.

twiss18• 8 years ago

Please see https://www.airborn.io/docs/security for a description of how we solved that :)

Invictus0• 8 years ago

Is Google Docs not secure enough already? I haven't heard of any hacks on that platform. What additional features are offered here besides security?

braincoke• 8 years ago

From what I understand, Airborn.io has the advantages of being Open Source and respecting your privacy (by storing the data encrypted).

michaelgrafl• 8 years ago

Google can read your documents, if I understand correctly. Airborn can't.

Whether that's important to you, only you can judge.

woranl• 8 years ago

Does Airborn have paying customers? How important is the issue that they are trying to fix?

mapgrep3• 8 years ago

On the document editor, is it just me or are you missing a blockquote control?

Also, is there a reason you're using inline styles to do italics and bold instead of the specific tags for those things?

(Deleted question you answered downthread.)

twiss18• 8 years ago

You can create a blockquote element by pressing Tab, although it won't have any special styling. If you want, you could add some CSS in Raw view. I'll look into making a control for this specifically, although IIRC browser support for blockquotes in contenteditable is a bit inconsistent.

Regarding inline styles, I don't remember why, sorry. It might again have been to fix some inconsistency between browsers.

mapgrep3• 8 years ago

Thanks for the information. FWIW my main issue with inline styles is, my use case would be taking the HTML into another system, and the more pervasive the inline styles are, the more likely they are to override our the desired styling contained in stylesheets produced by that system. They may help your product work better on purely its own terms but they are (IMO) highly suboptimal when HTML leaves your system and travels.

raleigh_user2• 8 years ago

You need Patrick from PriceIntelligently to analyze your pricing page. Maybe tweet at him or Hiten Shah and see if either will help.

I'd recon they would suggest you keep 2 tiers and add a call us tier for b2b enterprise.

I see where decently sized companies would pay a lot more than $10/month/user to ensure their sensitive docs can't be stolen.

I certainly am no expert but if the product works as it seems this should be more valuable than $100/year/employee.

EGreg2• 8 years ago

What are their emails? Write it in an antispam way, we'd be interested also

pccampbell4• 8 years ago

patrick[at]priceintelligently[dot]com

Always happy to help where I can when it comes to pricing.

bovermyer• 8 years ago

Dunno email, but Patrick's Twitter handle is Patticus.

chatmasta4• 8 years ago

That’s ironic because I have about 500 emails from this Patrick guy spamming my inbox from 2014-2016. I’m quite sure I never opted in; I just searched my inbox for a subscription confirmation email and could not find it.

Seems like Patrick is in this thread, so sorry if I’m off-base, but I really would like to know what I did to deserve hundreds of emails from “Patrick at Price Intelligently,” because I’m pretty sure I never subscribed to his list.

(It’s not just him, btw - the worst are the GitHub profile scrapers that somehow manage to make it into my “primary” inbox)

staplers• 8 years ago

Tbh their entire site needs a ui/ux rework. The header and div background transparency makes it difficult to read the content.

ocdtrekkie2• 8 years ago

So I remember trying this before, and it had a 'desktop' and an app store where you could add more apps, but right now the demo seems to be limited to documents and presentations.

Is that a change in focus or a limitation of the demo?

twiss18• 8 years ago

Yeah. I've been focusing on office apps rather than "any apps", and I removed the window manager based on feedback here and elsewhere that it felt too "heavy" and unnecessary. Also, the app store was actually the Firefox OS marketplace, which was shut down. (And to be honest, the apps in it weren't super useful for Airbon to begin with. There weren't very many apps for "serious work".)

Under the hood, it's theoretically still super easy to add/install apps in Airborn, though, and Firefox OS's marketplace server is open source, so maybe in the future?

ocdtrekkie2• 8 years ago

I can agree with that, the window manager was really neat (as I've always indicated these sorts of cloud platforms are like virtual OSes), but probably didn't add much to usability.

Performance seems really smooth, I'm glad to see this is still coming along quite nicely.

Even if it isn't the best UI, I think you really do still need to get something like EtherCalc on here, even for personal use, I love spreadsheets for storing structured information, and for business users, it's almost definitely a need.

mychael• 8 years ago

Nice idea, but the design of this leaves a lot to be desired.

twiss18• 8 years ago

Do you have some more specific criticism on the design?

geekamongus• 8 years ago

This made the rounds on Reddit a few months ago, and it was called airbornOS back then. Glad to see they dropped the "OS" part, as it really isn't an OS.

ummonk• 8 years ago

Have you considered increasing your pricing, and adding more premium features? As a supporter of client-side encryption in cloud apps, I really want to make sure you have a sustainable business. https://training.kalzumeus.com/newsletters/archive/saas_pric...

twiss18• 8 years ago

Yes! What kind of premium features do you have in mind?

anf• 8 years ago

A Premium Enterprise support Platinum Plan for $500/mo can be a big seller and allegedly the minimum expense report you can file in some large orgs [1].

1. https://www.kalzumeus.com/2012/08/13/doubling-saas-revenue/

chatmasta4• 8 years ago

Like others, I also like the novel service workers solution (mitigation might be more accurate) to client side code integrity.

I’m more interested in how you handle the encryption keys. Specifically, how does a user share a document with another? You mentioned that the “share group” has its own private key; where is this stored?

twiss18• 8 years ago

The encryption key is in the share link, and also stored encrypted in all collaborating users' accounts (if they have one - an account is not required to collaborate).

chatmasta4• 8 years ago

So the user is responsible for securely transmitting the share URL? i.e. Secrets are shared out-of-band?

It’s pretty clever, I like it. Definitely not the holy grail of client side browser-based multiparty encryption, but you’ve found some innovative techniques. Bravo, good luck with it.

udia• 8 years ago

I just tried using this app with one of my friends and I found that editing in real time between two people wasn't working as intended. When someone else wrote text, the text I wrote (in a separate paragraph) would disappear.

Is anyone else seeing this? It needs a bit more polish before I could use it for encrypted collaborative editing.

twiss18• 8 years ago

Thanks for the report, I'll look into it. But yeah, the collaboration is still a bit rough around the edges currently.

lsh123• 8 years ago

As usual, the discussion about whether something is secure enough or not should start from describing various attack vectors (which will be different for different class of users). AFAIK, the airborn product tries to eliminate an attack on its own servers / data stored on servers and in transit. While it is a good thing but by itself it doesn't necessarily make all the users of the product secure. In particular, they ignore attacks on the client itself, injection on the network, and several other "offline" attack vectors (e.g. taking pictures of user's screen). I understand the desire to make marketing simple for end users, but I really don't think that it helps people make rational decisions about security.

joewee• 8 years ago

Is there a open source alternative to this? Something I could deploy on my own server?

Airborn: Create and edit f​iles online​, securely

Related Stories

Airborn: Create and edit files online, securely