*eww*

*
*

Stack Exchange Network

Stack Exchange network consists of 176 Q&A communities including Stack
Overflow, the largest, most trusted online community for developers to learn,
share their knowledge, and build their careers.

Visit Stack Exchange Submit


Loading…

1
2 0
3 +0
4

* Tour Start here for a quick overview of the site
* Help Center Detailed answers to any questions you might have
* Meta Discuss the workings and policies of this site
* About Us Learn more about Stack Overflow the company
* Business Learn more about hiring developers or posting ads with us

5
6 Log in Sign up
7 current community

  * Information Security
    help chat
  * Information Security Meta

  your communities

  Sign up or log in to customize your list.

  more stack exchange communities

  company blog

By using our site, you acknowledge that you have read and understand our
Cookie Policy, Privacy Policy, and our Terms of Service.

Information Security Stack Exchange is a question and answer site for
information security professionals. It only takes a minute to sign up.

Sign up to join this community

Anybody can ask a question

Anybody can answer

The best answers are voted up and rise to the top
Submit

1 Home
2 1 Questions
  2 Tags
  3 Users
  4 Jobs
  5 Unanswered

Are private pastes on pastebin.com vulnerable? Can you trust pastebin?

Ask Question
Asked 4 years, 7 months ago
Active 3 years ago
Viewed 10k times
*
Submit
1
Submit
2

I use https://pastebin.com/ to organize some lists. When I select "Paste
Exposure: Private" , will it be really private and only accessible via login?
I read somewhere in the internet that there are programs that may capture what
is inside a private paste and they only need the paste ID. Is that true?

I am also worried because some private pastes from my account have +10 'unique
visitors'. That shouldn't be.

Are there alternatives? I need to manage several lists and I like it to be
bound to an account but if anybody may read my stuff that would be awful.

confidentiality
share | improve this question | follow  |
edited Jan 31 '16 at 12:57

Mark Buffalo
22k88 gold badges7171 silver badges8989 bronze badges
asked Jan 30 '16 at 12:50

Z3noNZ3noN
1911 silver badge22 bronze badges

* You could use evernote, one note and such services, you get your data bound
  to your account and it's kept private. – Silverfox Jan 30 '16 at 13:20
* You might consider getting some PHP-capable webspace and setting up
  Owncloud. It comes with a text file editor. – Philipp Jan 30 '16 at 13:46
* Try Google Drive? – Neil Smithline Jan 30 '16 at 22:02
* pretty sure "unique visits" is glitched. if you come back to your post after
  a while it will get a +1, and if you refresh it will always get another +1.
  come back every now and then and it will always gain another 2 "unique"
  visits. – Dave Cousineau Feb 26 '17 at 2:47
* Use "hastebin," it isn't indexed by search engines. – SuperAdmin Mar 29 '17
  at 11:50

add a comment  |

3 Answers

Active Oldest Votes

Submit
5
Submit

    Are private pastes on pastebin.com vulnerable?

Absolutely. Remember, if you are using a free service, then you are the
product. Pastebin as a free service is definitely vulnerable. Personally, I
use pastebin quite often. It's a very good service, and I am not worried about
the website owners running off with my private information because I do not
provide it.

However, since you are paying... I doubt a company would go out of their way
to hurt their customers. Still, we can't see what the admins of the website
are able to do, so we likely can't inform you.

    I am also worried because some private pastes from my account have +10
    'unique visitors'. That souldn't be.

Do not rely on free services like this for things that need to be kept
private/safe.

I understand Pastebin.com has a private paste option for paid accounts.
Private and unlisted pastes are different.

------------------------------------------------------------------------------

Are my pastes truly private?

1 The owner(s) and moderator(s) of the website can easily know what you're
  pasting. And they can even do this without it showing up on the website
  counter if they wanted to. They could do something like this:

// finds all the latest private pastes first.
LoadFiles(db.Query("SELECT [file_name] from [paste_data]
where [access_type] = 'Private' ORDER BY [date_posted] ASC"));
2 If your machine is infected, or your internet connection is being monitored,
  people can find your pastes and pass them on to others. In the case of
  private pastes, your login can be shared.

3 The URLs, even if unlisted, can be enumerated. You can "guess" Urls. If
  someone stumbles across yours, they may eventually find your paste. This may
  not work for private pastes.

I think #1 and #2 are the most likely. However, I just wouldn't expect my
pastes to be private once they go online. "Unlisted" in the context of
Pastebin simply means they won't be listed on the main website, not that you
can't visit them or guess the URL.

With private pastes, it's interesting that others can view your pastes. I
would suspect website admins at this point.

* Side note: The extra unique visitors may be an after-effect of you visiting
  the pastes in question under incognito/VPN. If you have a dynamic IP address
  or VPN, and the website counts all unique IP addresses visiting the pages,
  regardless of account, then it will likely update the counter. Why not test
  this?

------------------------------------------------------------------------------

Product Recommendations

Unfortunately, this isn't really a place for product recommendations. However,
I would not expect anything I post online to be truly private.

If you want some decent privacy, my recommendation is to create your own
website, encrypt the pastes you upload, and give people keys; one to to access
files, and one to decrypt them. One Key to view them, One Key to decrypt them
and on the website unbind them, In the Land of Mordor where the Shadows lie.

share | improve this answer | follow  |
edited Jan 31 '16 at 14:00
answered Jan 30 '16 at 14:18

Mark BuffaloMark Buffalo
22k88 gold badges7171 silver badges8989 bronze badges

* One key to rule them all... – William Oliver Jul 1 '16 at 13:49

add a comment  |
*

Submit
0
Submit

The answer is trivially it depends! Here are some guidelines:

* Can you trust pastebin to honestly protect private data from external
  accesses?: yes - they want their clients to feel confortable with the
  service
* can you trust that this protection is unbreakable? No absolute security is
  an illusion - no center is currently protected against a strong
  military-like attack (a true one with real guys and real weapons). On a more
  realistic point of view, highest security rules come at a cost and you
  cannot expect a low value service to have them
* can you trust that pastebin admins and moderator will never look your
  private data? well here we have real human being and a fired employee can do
  weird things as a vengeance... and because of the above line you cannot
  expect any protection against that
* if you put there high valuable information can you trust pastebin to not use
  it? You are on your own, but after seeing the above line I would not

share | improve this answer | follow  |
answered Mar 29 '17 at 10:35

Serge BallestaSerge Ballesta
21.1k44 gold badges3636 silver badges7171 bronze badges

add a comment  |

Submit
0
Submit

You can't trust most of the softwares out there, if you read privacy policy of
PasteFS ( https://www.pastefs.com ) you will notice that though they offer
private pastes, they still have mentioned vulnerabilities which are true for
every service out there.

for example:

    Though your communication with pastefs.com is as safe as this document
    ensures, but if you are posting/saving sensitive information on
    pastefs.com then we suggest you to go through your browser's privacy
    policy too. Because everything you post is eventually going through a web
    browser. We recommend Firefox over closed source browsers.

So if you're planning to upload something private, use encryption on your end
too, for example gpg/pgp

For example: check this post https://www.pastefs.com/pid/39

share | improve this answer | follow  |
answered Aug 15 '17 at 11:32

AurangzebAurangzeb
119

add a comment  |

**

Your Answer

*















Thanks for contributing an answer to Information Security Stack Exchange!

* Please be sure to answer the question. Provide details and share your
  research!

But avoid …

* Asking for help, clarification, or responding to other answers.
* Making statements based on opinion; back them up with references or personal
  experience.

To learn more, see our tips on writing great answers.

Submit
*

Sign up or log in

Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Submit

Post as a guest

Name

Email

Required, but never shown


Post as a guest

Name

Email

Required, but never shown


Post Your Answer  Discard

By clicking “Post Your Answer”, you agree to our terms of service, privacy
policy and cookie policy


Not the answer you're looking for? Browse other questions tagged
confidentiality or ask your own question.

The Overflow Blog
* Can one person run an open source project alone?
* Podcast 270: How developers can become great writers
Featured on Meta
* Hot Meta Posts: Allow for removal by moderators, and thoughts about future…
* Goodbye, Prettify. Hello highlight.js! Swapping out our Syntax Highlighter

*

Related

33
Why can a Tor exit node decrypt data, but not the entry node?
8
Android side channels: what can one app observe about other apps?
1
Are there different degrees of “confidentiality”? What is the best way for a
psychologist to maintain confidentiality of communications with patients?
7
can multiple encryption of data with multiple keys increase the security?
3
PHP processing form submission, how can I best protect sensitive information
submitted via the form?
1
How to Prove you created IP using a Notary

Hot Network Questions

* What are the economic incentives for professors to hire and train graduate
  students?
* How to initialise qubit in complex state in qiskit?
* Should I make my two steps have the same rise or keep one closer to a
  typical height?
* In the past, why was timezone change based on year?
* Find the IP address of a newly-booted Raspberry Pi
* Do I (witness) have to respond to email from defendant's lawyer?
* What techniques do you use to read sheet music faster
* Where is φιλημι attested?
* What the CEO says has to go no matter what
* Can I make a neverending Soup in an instantpot?
* Client can no longer afford to pay me due to unforseen circumstances
* How to straighten a twisted 2x6 deck board
* Why use aluminum wire in an (old) TV degaussing harness
* Are Mutual Information and Kullback–Leibler divergence equivalent?
* I found an error in my exam that caused me to lose time on other questions,
  resulting in a lower grade. How can I appeal?
* Cannondale CAAD Optimo Tiagra 2020 CREAKING
* How does the LEGO Super Mario figure know which power up is attached?
* Can the Giant Owl language be learned with the Linguist feat?
* Is cloud computing mainly just a marketing term?
* I want my aliens to arrive at the edges of the solar system, they would
  arrive in a week, what do I need to have?
* Is cross-staff beaming helpful or confusing?
* Using brine as construction material for an ocean floating town
* Minimal maximum byte for Turing Completeness
* In what way does technical analysis involve astrology and reading tea
  leaves?

more hot questions
Question feed

Subscribe to RSS

Question feed

To subscribe to this RSS feed, copy and paste this URL into your RSS reader.

https://security.stackexchange.com/feeds/question/112227

Information Security

* Tour
* Help
* Chat
* Contact
* Feedback
* Mobile

Company

* Stack Overflow
* For Teams
* Advertise With Us
* Hire a Developer
* Developer Jobs
* About
* Press
* Legal
* Privacy Policy

Stack Exchange
Network

* Technology
* Life / Arts
* Culture / Recreation
* Science
* Other

* Stack Overflow
* Server Fault
* Super User
* Web Applications
* Ask Ubuntu
* Webmasters
* Game Development

* TeX - LaTeX
* Software Engineering
* Unix & Linux
* Ask Different (Apple)
* WordPress Development
* Geographic Information Systems
* Electrical Engineering

* Android Enthusiasts
* Information Security
* Database Administrators
* Drupal Answers
* SharePoint
* User Experience
* Mathematica

* Salesforce
* ExpressionEngine® Answers
* Stack Overflow em Português
* Blender
* Network Engineering
* Cryptography
* Code Review

* Magento
* Software Recommendations
* Signal Processing
* Emacs
* Raspberry Pi
* Stack Overflow на русском
* Code Golf

* Stack Overflow en español
* Ethereum
* Data Science
* Arduino
* Bitcoin
* Software Quality Assurance & Testing
* Sound Design

* Windows Phone
* more (28)

* Photography
* Science Fiction & Fantasy
* Graphic Design
* Movies & TV
* Music: Practice & Theory
* Worldbuilding
* Video Production

* Seasoned Advice (cooking)
* Home Improvement
* Personal Finance & Money
* Academia
* Law
* Physical Fitness
* Gardening & Landscaping

* Parenting
* more (10)

* English Language & Usage
* Skeptics
* Mi Yodeya (Judaism)
* Travel
* Christianity
* English Language Learners
* Japanese Language

* Chinese Language
* French Language
* German Language
* Biblical Hermeneutics
* History
* Spanish Language
* Islam

* Русский язык
* Russian Language
* Arqade (gaming)
* Bicycles
* Role-playing Games
* Anime & Manga
* Puzzling

* Motor Vehicle Maintenance & Repair
* Board & Card Games
* Bricks
* Homebrewing
* Martial Arts
* The Great Outdoors
* Poker

* Chess
* Sports
* more (16)

* MathOverflow
* Mathematics
* Cross Validated (stats)
* Theoretical Computer Science
* Physics
* Chemistry
* Biology

* Computer Science
* Philosophy
* Linguistics
* Psychology & Neuroscience
* Computational Science
* more (10)

* Meta Stack Exchange
* Stack Apps
* API
* Data

* Blog
* Facebook
* Twitter
* LinkedIn
* Instagram

site design / logo © 2020 Stack Exchange Inc; user contributions licensed
under cc by-sa. rev 2020.9.11.37588

Information Security Stack Exchange works best with JavaScript enabled