Are private pastes on pastebin.com vulnerable?
Absolutely. Remember, if you are using a free service, then you are the product. Pastebin as a free service is definitely vulnerable. Personally, I use pastebin quite often. It's a very good service, and I am not worried about the website owners running off with my private information because I do not provide it.
However, since you are paying... I doubt a company would go out of their way to hurt their customers. Still, we can't see what the admins of the website are able to do, so we likely can't inform you.
I am also worried because some private pastes from my account have +10 'unique visitors'. That souldn't be.
Do not rely on free services like this for things that need to be kept private/safe.
I understand Pastebin.com has a private paste option for paid accounts. Private and unlisted pastes are different.
Are my pastes truly private?
The owner(s) and moderator(s) of the website can easily know what you're pasting. And they can even do this without it showing up on the website counter if they wanted to. They could do something like this:
// finds all the latest private pastes first.
LoadFiles(db.Query("SELECT [file_name] from [paste_data]
where [access_type] = 'Private' ORDER BY [date_posted] ASC"));
If your machine is infected, or your internet connection is being monitored, people can find your pastes and pass them on to others. In the case of private pastes, your login can be shared.
- The URLs, even if unlisted, can be enumerated. You can "guess" Urls. If someone stumbles across yours, they may eventually find your paste. This may not work for private pastes.
I think #1 and #2 are the most likely. However, I just wouldn't expect my pastes to be private once they go online. "Unlisted" in the context of Pastebin simply means they won't be listed on the main website, not that you can't visit them or guess the URL.
With private pastes, it's interesting that others can view your pastes. I would suspect website admins at this point.
- Side note: The extra unique visitors may be an after-effect of you visiting the pastes in question under incognito/VPN. If you have a dynamic IP address or VPN, and the website counts all unique IP addresses visiting the pages, regardless of account, then it will likely update the counter. Why not test this?
Unfortunately, this isn't really a place for product recommendations. However, I would not expect anything I post online to be truly private.
If you want some decent privacy, my recommendation is to create your own website, encrypt the pastes you upload, and give people keys; one to to access files, and one to decrypt them. One Key to view them, One Key to decrypt them and on the website unbind them, In the Land of Mordor where the Shadows lie.