Query parameters support?

[skygate2012]

First off I want to express my thanks to you for developing and hosting this project. I was about to make something identical for my personal use, but you implemented everything plus the encryption. 👍

It would be nice to automatically query a note when a query parameter is present in the URL (e.g. /?p=correct%20horse%20battery%20staple), so that one could bookmark the link for each note. Potentially also making multiple notes easily manageable just within the users' bookmark list.

[Athlon1600]

Using query parameters like that would make the app a lot less secure, because when you visit:

• https://notepad.mx/?p=correct%20horse%20battery%20staple

^ query strings get sent to the server, so server admins (such as myself) would be able to see your passphrase, and thus read your notes, which would break this promise:

another thing is your web-browser treating each of those ?p=passphrase as their own unique web-pages, which means they will be logged in your web-browser history. Basically, your browser history for this app right now looks like:

• https://notepad.mx/
• https://notepad.mx/
• https://notepad.mx/

but if we started using query strings, it would look like:

• https://notepad.mx/?p=correct%20horse%20battery%20staple
• https://notepad.mx/?p=white%20horse
• https://notepad.mx/?p=black%20horse

^ that would be a big problem if you are accessing your notes from a computer that's not your own (like a school computer) or if someone somehow got access to your web-history.... they'd see all your passphrases.

However, the feature you are asking for MIGHT work using hash parameters:
https://notepad.mx/#pass=correct%20horse%20battery%20staple

that should be just as secure as it is now, because hashes do not leave your web-browser basically.

Need to do more research, as security is very important for me. I'm even paranoid about letting people type in their passphrase, because what if the computer they are on have a keylogger installed? Need solutions around that too...

[skygate2012]

Ah I see. I didn't know security is a big focus since the password is used as note IDs :)

Hash parameters would be safe from the server, and would make more sense for an SPA like this. Although it would also leave a trace on the client's history. Maybe bookmarklet is also an option.