Penza and other online journaling resources

[NancyJ]

I am just curious whether anyone else is using or has used Penzu or other online journaling resources? I just started using it and I am finding it really helpful to write to my Nancy self and to write down my thoughts and feelings about my gender identity, my unique marriage, etc. — all things that I don’t want to save on my hard drive. This service allows me to save them, password protected and encrypted. I am not a computer person, so I do not know if it ends up protecting my privacy. I hope so. I like having the freedom to write what I want, but I am one paranoid girl (about what is left behind for my adult kids or grandkids to find, mostly). Nancy

[bridget thronton]

Make sense and likely at least as secure as putting things on your hard drive (more so if you share the computer)

[AngelaYVR]

I think a leather bound journal hidden in a battered old tin under a floor board is far more romantic (and possibly the source material of a future film.)

[wanabe-Leona]

Just remember everything on the internet stays on the internet.

[Claire M]

I'm with Angela ... i have the old notebook in the workshop. I also find that I get much more feeling out of writing by hand rather than typing.

As for "what's left behind"? Will it really matter? You'll be gone. Usually the effect of things found about someone post mortem have a very short shelf life. Maybe they might even understand or respect your memory more for finding it??

[NancyJ]

Hmmm? As far as staying on the internet, none of my journaling is posted on the internet. None of it is open to public view. This is, instead, a private, password-protected and encrypted cloud storage service that is formatted in journal form. (Saying that it stays on the internet is a little like saying that your online mobile banking stays on the internet.) As far as sharing my secrets, if I was comfortable doing it, I would do it while I am alive, and I guess I do care about my legacy. I lost my parents many years ago and I think of them (and often my grandparents) virtually every day. Guess I do not want memories of me mixed up with not only my musings about my gender dysphoria but some forays into sexual fantasy. As far as handwriting vs typing, I far prefer to type. Faster, and if you saw my handwriting, you would understand. Often, even I can not decipher it.

But, I guess, so far anyway, no one on the forum has used, or seems to be familiar with, an online journal. Thanks, Nancy

[Kelli_cd]

I keep a "journal" in a locked drawer at work. I'll write in it when I have a little downtime. It's mostly about Kelli. When I first wrote about Kelli, I decided I wanted to write left-handed; I'm naturally right-handed. The first week was really tough, her writing was horrible. She started writing about 2 months before the lock down, and then couldn't write during lock down for 18 months.
Since going back to the office last September, she writes about once a week (I've been very busy and her thoughts don't get time to put on paper), but her writing has improved a great deal.

[nancy58]

If you're "out" and don't care who knows about your crossdressing hobby -- or any other intimate details you put in your journal -- that's probably fine. Personally, I stick with a paper journal. I do have a handful of photographs stored on my hard drive, but they're in an encrypted "zip" file so that anyone who wants to see them will have to work at it to get them. My philosophy is not "if" an online service will be hacked but rather "when" it will be hacked. And while I try to practice safe web browsing, I know that anyone can slip up and let the bad guys in.

[DianeT]

From https://classic.penzu.com/content/products/security:

Not Just Encryption When you lock an entry using encryption, we go to extra lengths to protect and store your password and encryption key. Each time you lock an entry, we combine your password with a random password to create a unique "key". This key is what is required to encrypt and decrypt your entry.

Encrypted Encryption *On top of encrypting your entry, we also encrypt the key. Your original password (which we encrypt using one-way encryption), and the random password (which we also encrypt) are also stored in separate places, each behind another layer of security.

Ouch. This means this is not what is called "zero-knowledge" encryption. In zero knowledge solutions (like SpiderOak or Arq Backup), your password and private keys never leave your computer. Here, Penzu is telling you that they are generated on their servers and stored in a supposedly secure way (you have to believe them on that one) that allows them to have access to it. The downside of that is that they can technically decrypt and access your data. The upside is that they can restore access to your data in case you lose your passwords and keys (with zero-knowledge solutions, if you lose them, nobody can recover them for you and your data is gone for good). Even if you trust Penzu with your data, the fact they have access to your data means governments may have access to it as well (Digital Millenium Act and alike). And if they get hacked, then your data can be in the hands of anbody (just like for any other cloud service).

Saying that it stays on the internet is a little like saying that your online mobile banking stays on the internet.

That's right, but the security measures of large bank companies are incredibly stringent (I speak from experience) while I wouldn't say so of the average cloud service. There are zones in their data centers where you simply can't bring a phone or computer with you (clothes are still okay), radio waves are shielded and all network communications must go through secured, point to point, physical cables. The day I hear about this about a Penzu-like cloud service with a mere million of users (most of them with a free account), has not yet come, and I won't be holding my breath either, given the huge cost of such installations. Of course, you can do pretty good security and get very decent certifications with much less money. But I wanted to highlight that we are really speaking of two different worlds there.

About encrypted zip files: to work with files encrypted in the zip files, you need to extract them, which will create a temporary copy on your hard disk or SSD. At this point your data is sitting somewhere, unencrypted, accessible. Even if your method doesn't use a temp disk file, your data will sit in memory, unencrypted, potentially accessible in case of security exploits. Etc. Of course, if you use full disk encryption (FileVault on Macs, Bitlocker on Windows PCs), disconnect your wifi or cable network while working, have a decent antivirus running at all times, set the auto-lock delay of your computer session to 60 seconds (who does that ?), the odds are tiny that any data will leak. But even then, are you using a backup disk? (like Time Machine on Macs) Is it encrypted? Did you transfer files from a smartphone, a USB key? Traces can be everywhere.

In the end you can't have perfect security (even large banks, think for instance human factor). And that's okay since you will rarely need it in this world. I know my way around computers and that doesn't prevent me from doing mistakes sometimes. One can quickly end up paranoid if aiming for perfect. Personally I aim for reasonable enough security. My backups going to cloud storage are encrypted with zero knowledge encryption (but I still have to trust the software I am using for this, since I didn't write it myself). I don't share my smartphone, tablet or my computer with anybody else than my wife (not even friends' children wanting to play that nice game I have on my tablet). My system and secondary disks use full encryption (and backup disks too). If I exchange sensitive data with a USB key, I erase it completely at full capacity (note that even that isn't 100% bullet proof due to wear balancing and spare flash cells in USB keys and SSDs). Am I totally safe? Of course not. I have to write some complicated passwords and keys somewhere to recover my data, since I did not trust Apple iCloud to keep my encryption keys. How one keeps them safe is anyone's own recipe.

And you have to ask yourself one question: how precious is your data? Because if you don't ever, ever want to lose it, maybe you should have a safety net in case you lose your passwords and keys stored in a secret safe location. And that means trusting Apple, or Microsoft, or even Penzu, to keep your keys and allow recovering your data in the event you blew it on your side.
But that's not enough. Cloud services can go down abruptly. Hacking, fires, bankruptcy can make a service crash down or cease business suddenly. All your data can be lost in a wink. That makes one last question to ask, that, frankly, very few people ever think about until it's too late: how to reclaim your data? How to export it back to your computer? Every decent cloud service should let you export your documents and files back to your own devices.

[NancyJ]

Diane, Thank you so, so much. This is the kind of expert advice I was seeking, as well as being interested in whether any other girls are using similar services. I am not so much worried about losing data, as the journal really just contains musings, my thoughts about my gender and my sexuality. If it were lost forever it would not be horrible, but if some of the musings came out publicly and were associated with my name, it would be quite embarrassing.

From what you wrote, I deduce that it comes down to trust in this Penzu outfit. If they or their employees are not scrupulous, they could access my musings for their own titillation. Am I understanding you correctly? What if, instead, I send myself emails from different accounts, like from a Nancy gmail account to a Nancy yahoo account. That way I am, in a sense journaling with anonymous email accounts. Thoughts? Thanks, Nancy