4 ms·

Nothing new here. Sites like privnote.com have been around much longer. PGP, end-to-end encryption is everywhere now.

by _el1s7 3y ago

tholdem 3y ago
I don't see how privnote.com is the same as this. Privnote seems to use a database and the links themselves should be treated as secrets as anyone with the link can read the note.
asadeddin 3y ago
The end result of sharing the secret is the same. We didn't reinvent secret sharing. What's unique here is there's no server keeping record of a secret, a link or the parties involved. It's the truest form of zero-knowledge because the data doesn't exist in Retriever. With Privnote if you have the link to the secret, then you have the secret. With Retriever, only the requester has it.
- lcnPylGDnU4H9OF 3y ago
  > 2) They add their secret and share the URL Retriever generates. How do you prevent the URL from becoming something which needs to be kept secret?
  - asadeddin 3y ago
    The private keys are in the requester's browser. So if anyone gets a hold of the URL, they'll see nothing. For example, here's a secret I just put into Retriever. Are you able to see it? https://retriever.corgea.io/#eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlIjoiQVFBQiIsImV4dCI6dHJ1ZSwia2V5X29wcyI6WyJlbmNyeXB0Il0sImt0eSI6IlJTQSIsIm4iOiJ5cGdBRzU1R3B1RE5pcDZEN2otdUUxNUZtbDNSc0t0YnhoVHZqUFh4a1phYVRDbGpZUnVGaWFpTlVfMlBpaXFEcUxsVnNoUklyelp1LVlSemNDWkxGQ2FrdURfdTBaMVJKMmdzVmo0YVJFMUtlbWNxRUxELURPeGREVTk2bHB5TTVxcUU2SEstdEpZN1J1UnBUWG4xdllZTmF6dFcyb2RVVEpiZlBTSVNCVk56MHpDZWdUU2NKdWZIeHBnRGs2WUxfdUdiS3BxTnVXU1N2bHh5SkhsVVlaa3B2dmM1aDkwUjhTbzczMm14VENQMnJ1TWVDazhCc1p1UmhlQjhBVjJKd0NSME8tRGM4Vm1JNVpPcEZEakVDQWZVQXV4LUE4aDhMN0Jua2g0eDJTUnl0SEl3VUl5eHIzeXdZOHczclFUMWRIaVZYY1lMMWxrSTRjZHNYQmxJancifQ==;aANiHWmKlL6iAorKwMzIuj6iCLvLguG7shOzE5rx012XQhy8IZU2k1ctmQCey6ih/0DNWjnop7qr428agy63ixTMvwKvPgoeuDJA28vfBBF04CqJl7jFCc1fFum38mN1Jt8A4dQkfa2w1F6y91JviTTRhMQKtpSHwO1HOlWQ/boq+gnXoj38jVh3rzdPaR4I/tdxjzmMqV65mbR2VPBfut1BbhZvq+gqfQRHzh7HGIhS2Ei9Ea/9LKfaLBe0i40ebDTJ7V/30/fv8KMqenMdcj89KGDqoHVOoS/GW1vQi7Up0l9NRe/lFnuqhdj+SlT1rt4bBIa4KNFs83Y0zAl0MA== https://retriever.corgea.io/#eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJ...
    - e12e 3y ago
      This is essentially client side TLS, which browsers cut because the ux was bad? Only now you can backdoor/mitm/typosquat a website, rather than attack the major browsers or the os? And as I understand it, there's no way to verify you're talking to the right person, so sharing a secret via signal is strictly better?
      - andrewaylett 3y ago
        Share the URLs via Signal, then you have a validated identity, and the secret won't pop up in your notifications or be retained in your chat history.

Nothing new here. Sites like privnote.com have been around much longer. PGP, end-to-end encryption is everywhere now.

by _el1s7 3y ago

Nothing new here. Sites like privnote.com have been around much longer. PGP, end-to-end encryption is everywhere now.

I don't see how privnote.com is the same as this. Privnote seems to use a database and the links themselves should be treated as secrets as anyone with the link can read the note.

asadeddin 3y ago

The end result of sharing the secret is the same. We didn't reinvent secret sharing. What's unique here is there's no server keeping record of a secret, a link or the parties involved. It's the truest form of zero-knowledge because the data doesn't exist in Retriever. With Privnote if you have the link to the secret, then you have the secret. With Retriever, only the requester has it.

lcnPylGDnU4H9OF 3y ago
> 2) They add their secret and share the URL Retriever generates. How do you prevent the URL from becoming something which needs to be kept secret?
- asadeddin 3y ago
  The private keys are in the requester's browser. So if anyone gets a hold of the URL, they'll see nothing. For example, here's a secret I just put into Retriever. Are you able to see it? https://retriever.corgea.io/#eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlIjoiQVFBQiIsImV4dCI6dHJ1ZSwia2V5X29wcyI6WyJlbmNyeXB0Il0sImt0eSI6IlJTQSIsIm4iOiJ5cGdBRzU1R3B1RE5pcDZEN2otdUUxNUZtbDNSc0t0YnhoVHZqUFh4a1phYVRDbGpZUnVGaWFpTlVfMlBpaXFEcUxsVnNoUklyelp1LVlSemNDWkxGQ2FrdURfdTBaMVJKMmdzVmo0YVJFMUtlbWNxRUxELURPeGREVTk2bHB5TTVxcUU2SEstdEpZN1J1UnBUWG4xdllZTmF6dFcyb2RVVEpiZlBTSVNCVk56MHpDZWdUU2NKdWZIeHBnRGs2WUxfdUdiS3BxTnVXU1N2bHh5SkhsVVlaa3B2dmM1aDkwUjhTbzczMm14VENQMnJ1TWVDazhCc1p1UmhlQjhBVjJKd0NSME8tRGM4Vm1JNVpPcEZEakVDQWZVQXV4LUE4aDhMN0Jua2g0eDJTUnl0SEl3VUl5eHIzeXdZOHczclFUMWRIaVZYY1lMMWxrSTRjZHNYQmxJancifQ==;aANiHWmKlL6iAorKwMzIuj6iCLvLguG7shOzE5rx012XQhy8IZU2k1ctmQCey6ih/0DNWjnop7qr428agy63ixTMvwKvPgoeuDJA28vfBBF04CqJl7jFCc1fFum38mN1Jt8A4dQkfa2w1F6y91JviTTRhMQKtpSHwO1HOlWQ/boq+gnXoj38jVh3rzdPaR4I/tdxjzmMqV65mbR2VPBfut1BbhZvq+gqfQRHzh7HGIhS2Ei9Ea/9LKfaLBe0i40ebDTJ7V/30/fv8KMqenMdcj89KGDqoHVOoS/GW1vQi7Up0l9NRe/lFnuqhdj+SlT1rt4bBIa4KNFs83Y0zAl0MA== https://retriever.corgea.io/#eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJ...
  - e12e 3y ago
    This is essentially client side TLS, which browsers cut because the ux was bad? Only now you can backdoor/mitm/typosquat a website, rather than attack the major browsers or the os? And as I understand it, there's no way to verify you're talking to the right person, so sharing a secret via signal is strictly better?
    - andrewaylett 3y ago
      Share the URLs via Signal, then you have a validated identity, and the secret won't pop up in your notifications or be retained in your chat history.