4 ms·

How do we know if the file is really encrypted? How do we really know that the key is not uploaded to the server? Unless there is ability to view the source co

• feross 6y ago
  Auditing a web app is a challenging prospect with current web technologies. We really need a better way to "pin" a site to a current version and only update it with user consent. On wormhole.app, all assets are first-party and directly served by our servers, so there's no risk of third-party JS compromise – there's literally no third-party loaded JavaScript. But we want to do more to re-assure users with concerns about the cryptography itself. We're going to open source the cryptography code and explore building other types of client frontends, including potentially a CLI client, so you can be more sure that the code hasn't changed out from under you when using Wormhole.