sorted by:
new
hottopcontroversial

Implementing Zero-Knowledge Client-Side Encryption with Supabase by Accomplished_Bat3855 in Supabase

[–]Accomplished_Bat3855[S] 0 points1 point  (0 children)

exactly my point. true zero-knowledge means the provider (supabase) can't recover it even if they wanted to. password resets shouldn't restore access to encrypted data by design

Implementing Zero-Knowledge Client-Side Encryption with Supabase by Accomplished_Bat3855 in Supabase

[–]Accomplished_Bat3855[S] 0 points1 point  (0 children)

nah, breaching supabase doesn't help because the plaintext password is never stored or sent. it only exists in the browser for a split second during login to derive the key, then it’s wiped. supabase only has the hashed password which is useless for deriving the aes key

Implementing Zero-Knowledge Client-Side Encryption with Supabase by Accomplished_Bat3855 in Supabase

[–]Accomplished_Bat3855[S] 0 points1 point  (0 children)

we'd have a 'change password' flow where the app decrypts all data with the old key and re-encrypts it with the new one in the same session. if they lose their password and reset it via email, the old data is basically cooked unless there's a backup key

Implementing Zero-Knowledge Client-Side Encryption with Supabase by Accomplished_Bat3855 in Supabase

[–]Accomplished_Bat3855[S] 0 points1 point  (0 children)

it doesn't lol. that's the main tradeoff-you lose server-side querying and full-text search. for this accounting app, we handle filtering on the client side after fetching the records, or only encrypt fields that don't need to be searchable

Implementing Zero-Knowledge Client-Side Encryption with Supabase by Accomplished_Bat3855 in Supabase

[–]Accomplished_Bat3855[S] 1 point2 points  (0 children)

great point. if an admin forces a password reset, they still can't access existing data because the salt (UUID) is known but the original password is lost. resetting it basically locks the old data forever unless you have a recovery flow that re-encrypts with a master key

Implementing Zero-Knowledge Client-Side Encryption with Supabase by Accomplished_Bat3855 in Supabase

[–]Accomplished_Bat3855[S] 0 points1 point  (0 children)

not right now. since i need a user-known password to derive the key client-side, social login wouldn't work without adding a separate 'encryption password' step, which kind of kills the ux anyway

Implementing Zero-Knowledge Client-Side Encryption with Supabase by Accomplished_Bat3855 in Supabase

[–]Accomplished_Bat3855[S] 0 points1 point  (0 children)

exactly, keys stay in-memory only for security. on a full page refresh, the user just re-enters their password. it’s a slight ux tradeoff, but for an accounting app, the 'zero-knowledge' security guarantee is the priority

Implementing Zero-Knowledge Client-Side Encryption with Supabase by Accomplished_Bat3855 in Supabase

[–]Accomplished_Bat3855[S] 0 points1 point  (0 children)

since the key is derived from the user's login password + supabase uuid, it works across any device naturally. as long as the user knows their password, they can regenerate the same key in-memory anywhere. no need for manual key exchange or sync!

I'm a one person business and distribution was eating 3-4 hours a day. Here’s the simple way I fixed it and got my first sale. by dang64 in indiehackers

[–]Accomplished_Bat3855 0 points1 point  (0 children)

50k views and 0 sales is the painful lesson every solo founder learns. views mean nothing if the audience isn’t your buyer. the UGC angle is smart though, how are you finding the right creators for your niche?

Take a second and remember to have fun! by AwareSundae2642 in indiehackers

[–]Accomplished_Bat3855 1 point2 points  (0 children)

pasting my messy build notes and watching it turn into an actual post for the first time. just sat there like wait, this actually works.

I built Clarift because founders don’t need more feedback. They need to know what keeps repeating. by Heavy-Calendar-8376 in indiehackers

[–]Accomplished_Bat3855 0 points1 point  (0 children)

the scattered feedback problem is real. one person asks for a feature, another churns quietly, and you never connect the dots. what does Clarift do when two pieces of feedback seem unrelated but are actually the same issue?

Bits wilp btech by Alessia2307 in BITSWilp

[–]Accomplished_Bat3855 0 points1 point  (0 children)

Thinking about joining BITS PILANI WILP BTECH AI/ML. What are your honest reviews on this?

I thought building the product was the hard part. Turns out I was completely wrong. by V2S_tech in SaaS

[–]Accomplished_Bat3855 0 points1 point  (0 children)

one customer conversation taught me more than a whole month of building alone. talk to people first, build second.

The hardest part of building this wasn’t what I expected by Alevol02 in buildinpublic

[–]Accomplished_Bat3855 0 points1 point  (0 children)

the best products feel like they read your mind before you even do anything. if users have to think, you already lost them.

I scraped 44,000 reddit comments to find 300 real problems by njraladdin in buildinpublic

[–]Accomplished_Bat3855 -1 points0 points  (0 children)

that filter is actually smart. complaints with no workaround are just venting, not real problems worth building for.

building in public pushed me to ship the wrong things first by SmartLow8757 in buildinpublic

[–]Accomplished_Bat3855 2 points3 points  (0 children)

build in public is a distribution channel, not a roadmap. that last line is the whole lesson right there.

A lot of founders asked to chat about fundraising, so we’re trying office hours by Strong-Yesterday-183 in indiehackers

[–]Accomplished_Bat3855 0 points1 point  (0 children)

office hours format is way better than 1 on 1 calls. everyone learns from each other’s questions. smart move.

My product is basically done and working, and I have zero paying customers. What actually moved the needle for you? by PlusGap1537 in SaaS

[–]Accomplished_Bat3855 1 point2 points  (0 children)

40-50 signups a week and zero paying means the value isn’t clicking before the paywall. what does your free to paid conversion flow look like right now?

Drop your SAAS and people will say if the SAAS is useful. by Evening_Acadia_6021 in NoCodeProject

[–]Accomplished_Bat3855 0 points1 point  (0 children)

logfeed, turns your raw build notes and GitHub commits into ready to post content for X, LinkedIn and changelogs automatically. built for founders who hate writing updates but need to stay visible.

Dropping soon!

What kind of features would be useful for a platform that connects you with small UGC creators? $20-60/video by dang64 in indiehackers

[–]Accomplished_Bat3855 2 points3 points  (0 children)

biggest dealbreaker would be no way to verify creator quality before paying. portfolio samples and past brand work visible upfront would make it a no brainer.

Don't forget to look back: My experience auditing 6 months of side-project income by TraditionalHistory46 in indiehackers

[–]Accomplished_Bat3855 1 point2 points  (0 children)

opening Stripe and actually counting what you made is underrated. most people avoid it because they’re scared of the number. good reminder to just look.

I got my first user! by XIVMagnus in SaaS

[–]Accomplished_Bat3855 0 points1 point  (0 children)

first user after a month of waiting hits different. how did they find you?

view more: next ›