3 ms·
Very interesting, but why is the password optional? Doesn't it mean that someone with access to the S3 bucket can decrypt the data?
by laurent123456 4y ago
Very interesting, but why is the password optional? Doesn't it mean that someone with access to the S3 bucket can decrypt the data?
- rahimnathwani 4y agoThe file is encrypted before upload. The decryption key is supplied in an anchor tag. This is the case even if there's no password.
- ebfe1 4y ago100% this but note that the user entered password is not included in the anchor tag so if you add a password, recipient still needs to enter the password to be able to decrypy and download ;)
- ebfe1 4y agoAha that is a great question! There are 2 parts of the key, one is the anchor tag key (the part behind # that you see in download url) and your password. The anchor tag key part is ALWAYS generated randomly in the browser so that your file will be encrypted no matter what even if you forget to enter password and hit upload. Note that the anchor tag part does not leave the browser so it is one of the clever thing firefox send used to share some id/key. You can double check it in the network tab ;) If you are worry about that key being leaked somehow, adding a password ontop is a good measure.
- laurent123456 4y agoThat makes sense, thanks for clarifying!