3

I use https://pastebin.com/ to organize some lists. When I select "Paste Exposure: Private" , will it be really private and only accessible via login? I read somewhere in the internet that there are programs that may capture what is inside a private paste and they only need the paste ID. Is that true?

I am also worried because some private pastes from my account have +10 'unique visitors'. That shouldn't be.

Are there alternatives? I need to manage several lists and I like it to be bound to an account but if anybody may read my stuff that would be awful.

Improve this question
5
  • You could use evernote, one note and such services, you get your data bound to your account and it's kept private.
    – Silverfox
    Jan 30, 2016 at 13:20
  • You might consider getting some PHP-capable webspace and setting up Owncloud. It comes with a text file editor.
    – Philipp
    Jan 30, 2016 at 13:46
  • Try Google Drive?
    – Neil Smithline
    Jan 30, 2016 at 22:02
  • pretty sure "unique visits" is glitched. if you come back to your post after a while it will get a +1, and if you refresh it will always get another +1. come back every now and then and it will always gain another 2 "unique" visits.
    – Dave Cousineau
    Feb 26, 2017 at 2:47
  • Use "hastebin," it isn't indexed by search engines.
    – SuperAdmin
    Mar 29, 2017 at 11:50

3 Answers 3

Reset to default
8

Are private pastes on pastebin.com vulnerable?

Absolutely. Remember, if you are using a free service, then you are the product. Pastebin as a free service is definitely vulnerable. Personally, I use pastebin quite often. It's a very good service, and I am not worried about the website owners running off with my private information because I do not provide it.

However, since you are paying... I doubt a company would go out of their way to hurt their customers. Still, we can't see what the admins of the website are able to do, so we likely can't inform you.

I am also worried because some private pastes from my account have +10 'unique visitors'. That souldn't be.

Do not rely on free services like this for things that need to be kept private/safe.

I understand Pastebin.com has a private paste option for paid accounts. Private and unlisted pastes are different.

Are my pastes truly private?

  1. The owner(s) and moderator(s) of the website can easily know what you're pasting. And they can even do this without it showing up on the website counter if they wanted to. They could do something like this: 

    // finds all the latest private pastes first.
LoadFiles(db.Query("SELECT [file_name] from [paste_data] 
where [access_type] = 'Private' ORDER BY [date_posted] ASC"));

  2. If your machine is infected, or your internet connection is being monitored, people can find your pastes and pass them on to others. In the case of private pastes, your login can be shared.

  3. The URLs, even if unlisted, can be enumerated. You can "guess" Urls. If someone stumbles across yours, they may eventually find your paste. This may not work for private pastes.

I think #1 and #2 are the most likely. However, I just wouldn't expect my pastes to be private once they go online. "Unlisted" in the context of Pastebin simply means they won't be listed on the main website, not that you can't visit them or guess the URL.

With private pastes, it's interesting that others can view your pastes. I would suspect website admins at this point.

  • Side note: The extra unique visitors may be an after-effect of you visiting the pastes in question under incognito/VPN. If you have a dynamic IP address or VPN, and the website counts all unique IP addresses visiting the pages, regardless of account, then it will likely update the counter. Why not test this?

Product Recommendations

Unfortunately, this isn't really a place for product recommendations. However, I would not expect anything I post online to be truly private.

If you want some decent privacy, my recommendation is to create your own website, encrypt the pastes you upload, and give people keys; one to to access files, and one to decrypt them. One Key to view them, One Key to decrypt them and on the website unbind them, In the Land of Mordor where the Shadows lie.

Improve this answer
3
  • 1
    One key to rule them all...
    – William Oliver
    Jul 1, 2016 at 13:49
  • "if you are using a free service, then you are the product" is a gross generalization with no evidence to support that position re Pastebin selling your data. Their privacy policy explicitly states that they don't access private pastes (except when legally required, just like any service that isn't end-to-end encrypted) and they don't share them for commercial purposes. If you want to claim that their privacy policy is a lie, then make that claim, but generally that's unlikely because any engineer could easily blow the whistle on that kind of thing. More relevant are comments about security.
    – mgiuffrida
    Dec 4 at 12:55
  • If you're sharing confidential information that could realistically harm your business, then you need to think about security vulnerabilities. But the idea that anyone should just set up their own website and encryption for this is weird -- surely Pastebin has a better idea of what they're doing, has more robust security protocols, and would provide quick responses to security vulnerabilities. Can you say that about a website you built and host yourself? Is it worth spending all the time in energy on something that is most likely more vulnerable than existing services?
    – mgiuffrida
    Dec 4 at 12:59
0

You can't trust most of the softwares out there, if you read privacy policy of PasteFS ( https://www.pastefs.com ) you will notice that though they offer private pastes, they still have mentioned vulnerabilities which are true for every service out there.

for example:

Though your communication with pastefs.com is as safe as this document ensures, but if you are posting/saving sensitive information on pastefs.com then we suggest you to go through your browser's privacy policy too. Because everything you post is eventually going through a web browser. We recommend Firefox over closed source browsers.

So if you're planning to upload something private, use encryption on your end too, for example gpg/pgp

For example: check this post https://www.pastefs.com/pid/39

Improve this answer
-1

The answer is trivially it depends! Here are some guidelines:

  • Can you trust pastebin to honestly protect private data from external accesses?: yes - they want their clients to feel confortable with the service
  • can you trust that this protection is unbreakable? No absolute security is an illusion - no center is currently protected against a strong military-like attack (a true one with real guys and real weapons). On a more realistic point of view, highest security rules come at a cost and you cannot expect a low value service to have them
  • can you trust that pastebin admins and moderator will never look your private data? well here we have real human being and a fired employee can do weird things as a vengeance... and because of the above line you cannot expect any protection against that
  • if you put there high valuable information can you trust pastebin to not use it? You are on your own, but after seeing the above line I would not
Improve this answer
1
  • That site is full of ads. Hell no.
    – BugHunterUK
    Sep 15, 2020 at 11:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .