Ghostbin #408

New Issue

2018-03-16T13:06:02Z

huubert commented

2018-03-16 13:06:02 +00:00

(Migrated from github.com)

Ghostbin is not really secure, because after creating an encrypted paste, it's possible to access it with javascript disabled, which means the content is not decrypted in the user's browser. Also, it requires cookies to even work at all, which shouldn't be needed.

Hillside502 commented

2018-03-16 20:17:18 +00:00

(Migrated from github.com)

Open Source Ghostbin Alternatives - AlternativeTo.net
https://alternativeto.net/software/ghostbin/?license=opensource

Open Source Ghostbin Alternatives - AlternativeTo.net https://alternativeto.net/software/ghostbin/?license=opensource

ghost commented

2018-03-16 21:57:17 +00:00

(Migrated from github.com)

It can be self-hosted, though, if you're concerned about server-side security. But yeah, we're just recommending the main server.

huubert commented

2018-03-17 16:27:12 +00:00

(Migrated from github.com)

I don't consider that secure, but maybe it's just me...
Regardless, Ghostbin should be the third option in the Paste Services section and not the first, and maybe it should be mentioned in the notes that encryption/decryption is not done in the browser.

I don't consider that secure, but maybe it's just me... Regardless, Ghostbin should be the third option in the Paste Services section and not the first, and maybe it should be mentioned in the notes that encryption/decryption is not done in the browser.

ghost commented

2018-05-10 08:58:34 +00:00

(Migrated from github.com)

Just FYI:
ghostbin.com runs outdated Apache 2.4.18 and outdated OpenSSH 7.2 P2. The security of the whole server setup isn't very exemplary. Furthermore, the TLS configuration supports insecure RC4 for encryption and weak cipher suites.

Just FYI: ghostbin.com runs outdated [Apache 2.4.18](https://www.cvedetails.com/vulnerability-list/vendor_id-45/product_id-66/version_id-199589/Apache-Http-Server-2.4.18.html) and outdated [OpenSSH 7.2 P2](https://www.cvedetails.com/vulnerability-list/vendor_id-97/product_id-585/version_id-194112/Openbsd-Openssh-7.2.html). The security of the [whole server setup](https://www.htbridge.com/websec/?id=rYAkummU) isn't very exemplary. Furthermore, the TLS configuration [supports insecure RC4 for encryption and weak cipher suites](https://tls.imirhil.fr/https/ghostbin.com).

👍 3

ghost commented

2018-05-27 06:52:38 +00:00

(Migrated from github.com)