3 ms·
> Encryption is just obfuscation. This is what you're missing. Obfuscation is not encryption, and anyone with access to the encrypted data in the URL would not
by prophesi 3y ago
> Encryption is just obfuscation.
This is what you're missing. Obfuscation is not encryption, and anyone with access to the encrypted data in the URL would not be able to crack it in a reasonable amount of time unless they know something we don't know about public key encryption and SubtleCrypto's implementation of it.
edit: and the problem it's trying to solve are to reach people that you can't just hand a slip of paper of what you want to tell them.
- rerdavies 3y agoIn this case, you crack the encryption by cutting and pasting the URL into your browser's address bar. Navigate to the link, and you get the decrypted message. It is encryption as theatre. Non-functional encryption. Encryption that hides nothing.
- prophesi 3y agoNo, only if your browser has the right private key. Let's say User A goes to the Corgea site. Their browser generates an RSA keypair, and appends the _public key_ to the URL, which is supposed to be visible. When User B accesses that URL, User B's device generates an RSA keypair, and encrypts their message using User A's public key and User B's private key. User B's generated URL will now contain User B's public key and the aforementioned encrypted message. User A decrypts using User B's public key and User A's private key. tl;dr: Each browser client generates a keypair, and their private key is never exposed. You only ever encrypt/decrypt with _your_ private key, and someone else's public key.