4 ms·
It seems key-pair is generated only once. Could be great to get fresh for every request.
by bvrmn 3y ago
It seems key-pair is generated only once. Could be great to get fresh for every request.
- asadeddin 3y agoTotally! Someone was kind enough to issue a PR to allow you to delete the private key and generate a new one. We're going to fold those changes in.
- deoxykev 3y agoA default key expiry of 3 days would be helpful here too, as it would mitigate the threat of someone compromising the endpoint and extracting secrets from browser history.
- prophesi 3y agoCould also see an implementation where you generate a keypair per secret that saves a hashid (or just an incrementing integer) that you add to the URL fragment. The original sender's browser can then retrieve the private key in localstorage by that hashid. Now secrets can be kept or deleted individually, or given separate expirations. The only issue is that you can't magically remove the encrypted data in the URL you sent over, so it's really just removing your _own_ access to the data.