Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I set nvALT to use a single database to store and sync my notes. Using a database has the benefit of having encryption.

I just noticed this warning at the bottom of the synchronization settings window that says "Note contents will be delivered in clear text." This came as a bit of a shock because I do have some personal sensitive information stored in nvALT.

I searched for the syncing APIs of Simplenote which seem to use HTTPS but I'm not sure about that. Can anyone explain how the synchronization works exactly and what the warning message means?

share|improve this question
I almost want to use Wireshark to see what's going on underneath. – shenyl Dec 18 '11 at 5:23
I second that it would be far more direct than looking at the code for nvalt at – Dan D. Dec 18 '11 at 7:23
up vote 1 down vote accepted

HTTPS is hard-coded here to provide the different API URLs. It's the only location in the sources where is used.

All uses of that method outside the same file are in these files:

In neither of them, the basic URL (domain, scheme) is changed.

But the notes themselves are not encrypted. So, while the transport uses SSL, Simplenote will receive and store your notes however they do, and anyone with access to your Simplenote account can access them.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .