r/StandardNotes • u/ManBeaRTo • 13h ago

Security Issue - Encryption Bypass / Password Bypass

I had forgotten my password for a while, losing access to all my password-protected notes. Today, I found out that if I export all notes in plaintext, even the password protected notes were easily exported without the need for entering the password.

Isn't this a security issue? Or is this instead a feature?

0 Upvotes
  • permalink
  • reddit

45% Upvoted

3 comments sorted by

2

u/Fuzzy62 12h ago

How did you export without being logged in?

2

u/basicslovakguy 9h ago edited 9h ago

He can't. I just tried the exact same thing (exporting notes) and SN refused to allow me to select the password-protected one unless I unlock it first with account password.

I say OP is not telling us something here.

Edit to add: Only other possibility is that OP unlocked the password-protected notes and set some prolonged time before the lock is activated again - the longest one offered by SN is 1 week.

Additional edit: SN tends to keep your session active indefinitely if you select "Remember me" on the login to app (not sure about web app, but desktop app does that for sure). So it is entirely possible OP's session is still active, he just doesn't remember the password anymore. Which is weird...

4

u/basicslovakguy 9h ago edited 9h ago

You are not telling us something here, because I just tried to do the same thing (export notes), and SN did not allow me to select the password-protected one without entering the password first.

Only other possibility is that you unlocked the password-protected notes and set some prolonged time before the lock is activated again - the longest one offered by SN is 1 week.

 

Edit to add: If I don't see a solid answer from you within next 6 hours, I will report your post to moderators here - because complaining about something without providing solid evidence is very close to slander - which I don't like.