3 ms·
I don't think this service is End-to-End encrypted the way we would like to think it is. If you can share pictures with friends by just giving them a link to a
by prmoustache 3y ago
I don't think this service is End-to-End encrypted the way we would like to think it is. If you can share pictures with friends by just giving them a link to a page, the server app has the encryption keys too.
- icar 3y agoThe link contains the needed keys. It's explained in their FAQ.
- thisgoodlife 3y agoIf the link contains the keys, does that mean the server can also see these keys?
- jeltz 3y agoNope, the secret is in the url fragment. Of course this means you need to trust that they do not change the JS code so that it steaks your keys.
- vishnumohandas 3y agoHey, details on how we're providing E2EE with links has been documented here: https://ente.io/blog/building-shareable-links/ https://ente.io/blog/building-shareable-links/ Some bits of the blog post are outdated, since the feature has matured since then. But the implementation details are roughly the same. TL;DR: The keys are added to the URL fragment (the part that follows the #), and these fragments are not accessible to the server.
- upofadown 3y agoI think a better term for what is happening here is "client side encryption". That reduces the chances of getting things confused with messaging, which is a different sort of a problem. This at least has a user accessible cryptographic identity, so end to end secure key exchange is possible. So if you really wanted to call it end to end encrypted, it would be legitimate to do so. I suspect that the motivation here is still mostly marketing driven.
- claypant 3y agonope, if you put info after `#` on a url, the browser wont share that info with the server. Excalidraw use this technique to allow users to share encrypted data with other users