4 ms·
The private keys are in the requester's browser. So if anyone gets a hold of the URL, they'll see nothing. For example, here's a secret I just put into Retriev
by asadeddin 3y ago
The private keys are in the requester's browser. So if anyone gets a hold of the URL, they'll see nothing.
For example, here's a secret I just put into Retriever. Are you able to see it? https://retriever.corgea.io/#eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlIjoiQVFBQiIsImV4dCI6dHJ1ZSwia2V5X29wcyI6WyJlbmNyeXB0Il0sImt0eSI6IlJTQSIsIm4iOiJ5cGdBRzU1R3B1RE5pcDZEN2otdUUxNUZtbDNSc0t0YnhoVHZqUFh4a1phYVRDbGpZUnVGaWFpTlVfMlBpaXFEcUxsVnNoUklyelp1LVlSemNDWkxGQ2FrdURfdTBaMVJKMmdzVmo0YVJFMUtlbWNxRUxELURPeGREVTk2bHB5TTVxcUU2SEstdEpZN1J1UnBUWG4xdllZTmF6dFcyb2RVVEpiZlBTSVNCVk56MHpDZWdUU2NKdWZIeHBnRGs2WUxfdUdiS3BxTnVXU1N2bHh5SkhsVVlaa3B2dmM1aDkwUjhTbzczMm14VENQMnJ1TWVDazhCc1p1UmhlQjhBVjJKd0NSME8tRGM4Vm1JNVpPcEZEakVDQWZVQXV4LUE4aDhMN0Jua2g0eDJTUnl0SEl3VUl5eHIzeXdZOHczclFUMWRIaVZYY1lMMWxrSTRjZHNYQmxJancifQ==;aANiHWmKlL6iAorKwMzIuj6iCLvLguG7shOzE5rx012XQhy8IZU2k1ctmQCey6ih/0DNWjnop7qr428agy63ixTMvwKvPgoeuDJA28vfBBF04CqJl7jFCc1fFum38mN1Jt8A4dQkfa2w1F6y91JviTTRhMQKtpSHwO1HOlWQ/boq+gnXoj38jVh3rzdPaR4I/tdxjzmMqV65mbR2VPBfut1BbhZvq+gqfQRHzh7HGIhS2Ei9Ea/9LKfaLBe0i40ebDTJ7V/30/fv8KMqenMdcj89KGDqoHVOoS/GW1vQi7Up0l9NRe/lFnuqhdj+SlT1rt4bBIa4KNFs83Y0zAl0MA== https://retriever.corgea.io/#eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJ...
- e12e 3y agoThis is essentially client side TLS, which browsers cut because the ux was bad? Only now you can backdoor/mitm/typosquat a website, rather than attack the major browsers or the os? And as I understand it, there's no way to verify you're talking to the right person, so sharing a secret via signal is strictly better?
- andrewaylett 3y agoShare the URLs via Signal, then you have a validated identity, and the secret won't pop up in your notifications or be retained in your chat history.