About echodrop.net (WORO)
Write once / Read once: a one-time secure note service. The retrieval link contains a
secret that is never stored on the server. Without that secret, ciphertext on disk cannot
be decrypted—even if the long-term server key is obtained.
Zero knowledge (nonce never on disk)
- Each message uses a random nonce that becomes part of the one-time URL only.
- The nonce is never written to disk and cannot be derived from filenames or metadata.
- Filenames are irreversible hashes of the nonce; listing files does not reveal links.
- Metadata on disk holds only the expiration timestamp—not the message or notification details.
Message encryption
- Content is sanitized, Base64-encoded, and padded with random dictionary words before encryption.
- Authenticated encryption uses LibSodium XChaCha20-Poly1305 with the long-term key and the per-message nonce.
- Plaintext is never written to disk; only ciphertext is stored under the messages directory.
Memory handling
- After a message is encrypted and written, sensitive buffers are wiped with
sodium_memzero where available.
- Keys and plaintext are not retained longer than needed for the request.
Secure deletion
- After a successful read, the message file is overwritten three times with random data longer than the original, then unlinked.
- Expired messages are removed the same way by cleanup (per request and optional cron).
- On solid-state storage, overwrites are best-effort; treat backups of the messages directory as sensitive.
What is logged (application)
usage.log — only lines of the form message created: <ISO8601> or message expired: <ISO8601>. No content, no URLs, no emails.securityvalidation.log — path/permission checks (overwritten each run). No message data.- Notification emails (if you opt in) are sent only on successful retrieval, not on expiry.
Server (Apache) logging
- HTTP access and error logs are controlled by the web server vhost, separate from application logs.
- This project ships an Apache config with optional lines to send logs to
/dev/null (fully disable server-side request logging).
- If server logging is still enabled, a red SERVER LOG ENABLED indicator appears next to the site name so users can see it at a glance.