3 ms·

I'm confused. How do you send the request URL, and how do you receive the encrypted secret? If the answer is "email, chat, text, Whatsapp" or whatever, them wh

by SamBam 3y ago

I'm confused. How do you send the request URL, and how do you receive the encrypted secret? If the answer is "email, chat, text, Whatsapp" or whatever, them why not just send the secret plaintext? If anyone can get into any of those systems, then they can easily get your secret from the two urls, so why bother with the encryption?

nielsole 3y ago
If I glean from the landing page correctly, there will be a private key somewhere in the browser e.g. localstorage. This way the sender can encrypt the secret with the public key of the receiver. Mitm attacks are certainly possible, but eavesdropping is not.
- asadeddin 3y ago
  You're correct. While a Mitm is possible, it'll be useless because the actor will have to get access to the private key from the requester'ss browser. They would have to be on the requester's machine
asadeddin 3y ago
You can send the URL in whatever medium is convenient. However, if someone gets a hold of the URL with the secret, they will not be able to see the secret. For example, here's a URL containing the secret. Can you see the secret? https://retriever.corgea.io/#eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlIjoiQVFBQiIsImV4dCI6dHJ1ZSwia2V5X29wcyI6WyJlbmNyeXB0Il0sImt0eSI6IlJTQSIsIm4iOiJ5cGdBRzU1R3B1RE5pcDZEN2otdUUxNUZtbDNSc0t0YnhoVHZqUFh4a1phYVRDbGpZUnVGaWFpTlVfMlBpaXFEcUxsVnNoUklyelp1LVlSemNDWkxGQ2FrdURfdTBaMVJKMmdzVmo0YVJFMUtlbWNxRUxELURPeGREVTk2bHB5TTVxcUU2SEstdEpZN1J1UnBUWG4xdllZTmF6dFcyb2RVVEpiZlBTSVNCVk56MHpDZWdUU2NKdWZIeHBnRGs2WUxfdUdiS3BxTnVXU1N2bHh5SkhsVVlaa3B2dmM1aDkwUjhTbzczMm14VENQMnJ1TWVDazhCc1p1UmhlQjhBVjJKd0NSME8tRGM4Vm1JNVpPcEZEakVDQWZVQXV4LUE4aDhMN0Jua2g0eDJTUnl0SEl3VUl5eHIzeXdZOHczclFUMWRIaVZYY1lMMWxrSTRjZHNYQmxJancifQ==;kcrl00c7C51XiK024WgIwYShS5P8BFGx6yloQWYxGWeK+AGKMFuF/J2zkEYJSZU3XLB7xfK20au7yYghfZyAZ1kKBDcmUwVgUoGPmVmS7N9D1zL7H8AeSbMKpPhkitizKl0NYqdtB+8KBp5mplWQMFG6CZahUW0xeKQpb7tMlfNPqSdfWUYiNY0S9GD7lo/XgGYXzsXu0QHrNkDk0rhAhYaBlWH83VtHZ1cJVzY54r6tDBpxzW/gyw+s8OvjWNjMc2Vh9VNJDof7tk7wzEP3wR9oIbrpHBpsnChja6Ngj9OJa6CWqAc/LS0aqe4LWMLLbRU3XvokwNiFdijvqSIvGA== https://retriever.corgea.io/#eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJ...

by SamBam 3y ago

nielsole 3y ago

If I glean from the landing page correctly, there will be a private key somewhere in the browser e.g. localstorage. This way the sender can encrypt the secret with the public key of the receiver. Mitm attacks are certainly possible, but eavesdropping is not.

asadeddin 3y ago
You're correct. While a Mitm is possible, it'll be useless because the actor will have to get access to the private key from the requester'ss browser. They would have to be on the requester's machine

asadeddin 3y ago

You can send the URL in whatever medium is convenient. However, if someone gets a hold of the URL with the secret, they will not be able to see the secret. For example, here's a URL containing the secret. Can you see the secret? https://retriever.corgea.io/#eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlIjoiQVFBQiIsImV4dCI6dHJ1ZSwia2V5X29wcyI6WyJlbmNyeXB0Il0sImt0eSI6IlJTQSIsIm4iOiJ5cGdBRzU1R3B1RE5pcDZEN2otdUUxNUZtbDNSc0t0YnhoVHZqUFh4a1phYVRDbGpZUnVGaWFpTlVfMlBpaXFEcUxsVnNoUklyelp1LVlSemNDWkxGQ2FrdURfdTBaMVJKMmdzVmo0YVJFMUtlbWNxRUxELURPeGREVTk2bHB5TTVxcUU2SEstdEpZN1J1UnBUWG4xdllZTmF6dFcyb2RVVEpiZlBTSVNCVk56MHpDZWdUU2NKdWZIeHBnRGs2WUxfdUdiS3BxTnVXU1N2bHh5SkhsVVlaa3B2dmM1aDkwUjhTbzczMm14VENQMnJ1TWVDazhCc1p1UmhlQjhBVjJKd0NSME8tRGM4Vm1JNVpPcEZEakVDQWZVQXV4LUE4aDhMN0Jua2g0eDJTUnl0SEl3VUl5eHIzeXdZOHczclFUMWRIaVZYY1lMMWxrSTRjZHNYQmxJancifQ==;kcrl00c7C51XiK024WgIwYShS5P8BFGx6yloQWYxGWeK+AGKMFuF/J2zkEYJSZU3XLB7xfK20au7yYghfZyAZ1kKBDcmUwVgUoGPmVmS7N9D1zL7H8AeSbMKpPhkitizKl0NYqdtB+8KBp5mplWQMFG6CZahUW0xeKQpb7tMlfNPqSdfWUYiNY0S9GD7lo/XgGYXzsXu0QHrNkDk0rhAhYaBlWH83VtHZ1cJVzY54r6tDBpxzW/gyw+s8OvjWNjMc2Vh9VNJDof7tk7wzEP3wR9oIbrpHBpsnChja6Ngj9OJa6CWqAc/LS0aqe4LWMLLbRU3XvokwNiFdijvqSIvGA== https://retriever.corgea.io/#eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJ...