3 ms·
> Since the encryption key follows the # symbol, it is never sent to the server. This doesn't seem like a safe idea to me. While it's true that browsers don't
by cyphar 10y ago
> Since the encryption key follows the # symbol, it is never sent to the server.
This doesn't seem like a safe idea to me. While it's true that browsers don't send the # part of a URL when fetching a page, you can use JavaScript to get the value (in fact that's what this webapp is doing).
So what is the mitigation if someone manages to XSS the website and start snarfing the encryption keys for everyone's messages?
Really cool idea BTW.
- chii 10y agoif someone already can XSS your site, then your site is already owned, and there's no need to sniff the key!
- MildlySerious 10y agoPlus, no matter how else you would store the key, it could be retrieved just as easily if the site is compromised on the frontend.