About echodrop.net (WORO)
Write once / Read once: a one-time secure note service. The retrieval link contains a
secret that is never stored on the server. Without that secret, ciphertext on disk cannot
be decrypted—even if the long-term server key is obtained.
Zero knowledge (nonce never on disk)
- Each message uses a random nonce that becomes part of the one-time URL only.
- The nonce is never written to disk and cannot be derived from filenames or metadata.
- Filenames are irreversible hashes of the nonce; listing files does not reveal links.
- Metadata on disk holds only the expiration timestamp—not the message or notification details.
Message encryption
- Content is sanitized, Base64-encoded, and padded with random dictionary words before encryption.
- Authenticated encryption uses XChaCha20-Poly1305 with the long-term key and a per-message nonce.
- Plaintext is never written to disk; only ciphertext is stored under the messages directory.
Memory handling
- After a message is encrypted and written, sensitive buffers are wiped.
- Keys and plaintext are not retained longer than needed for the request.
Secure deletion
- After a successful read, the message file is overwritten multiple times with random data longer than the original, then unlinked.
- Expired messages are removed the same way by cleanup.
- On solid-state storage, overwrites are best-effort; treat backups of the messages directory as sensitive.
What is logged (application)
usage — only that a message was created or expired (message created: <ISO8601> or message expired: <ISO8601>). No content, no emails, no ip addresses.security assessment — each request does a security assessment of permissions and file ownerships. If anything is out of scope it fails and logs what failed.- Notification emails (if you opt in) are sent only on successful retrieval. There will be a mail server log entry of the outbound email.
Server (Apache) logging
- HTTP access and error logs are controlled by the web server vhost, separate from application logs.
- This project ships an Apache config with optional lines to send logs to
/dev/null (fully disable server-side request logging).
- Server log status indicators and diagnostic messages are presented. A best effort is made to determine if logging directives are present and whey they are pointed.