ZeroBin provides an encrypted alternative to Pastebin - Update
Developer Seb Sauvage has released the first public version of ZeroBin, an open source alternative to Pastebin. ZeroBin allows users to post text snippets anonymously and then send a link to the pasted file to other users. In contrast to Pastebin, it supports client side encryption of posted files (using 256-bit AES) which means the server retains no knowledge of the information being stored. Users can also easily clone existing "pastes" on the site.
Sauvage says that server administrators cannot moderate the snippets being stored and should "hopefully" be legally protected by the client-side encryption as they have no way of knowing what is being stored by the system. He provides an instance of the software for interested parties to test, but warns that any content stored on that site will be regularly deleted.
Update 18-04-12: ZeroBin works by creating a new 256-bit AES key for every code snippet. When a user posts a snippet, the text is encrypted on the client side and is then sent to the server. The server then creates a URL that makes the snippet accessible on the internet. On the client, this URL is displayed in the format:
When the data is sent to the server, the anchor with the attached secret key is omitted. Other users can only access the pasted text if the original uploader gives them the full URL including the key. With the full URL, other browsers can again decrypt the stored message locally.
Preliminary tests by The H's associates at heise Security have shown that the developer's claims are correct and that the system works as intended. The pasted text is sent encrypted and enclosed by
<div id="cipherdata">...</div> tags. A possible problem with this approach is the fact that badly written search engine crawlers could follow ZeroBin links that have been posted publicly and therefore log the complete URL including the encryption key.
- Pastebin.com arms itself against misuse, a report from The H.