5 ms·
At the moment an attacker doesn't even need to take control of the servers since all the code is sent without SSL so a MITM attack would be enough. Edit: thoug
by arkem 14y ago
At the moment an attacker doesn't even need to take control of the servers since all the code is sent without SSL so a MITM attack would be enough.
Edit: though of course if the javascript is never requested again it limits the window of opportunity to man-in-the-middle.
- jmah 14y agoThough of course if the HTML is requested again you could just add another script tag.
- sturmeh 14y agoThis was on HN previously, but not at this domain, they said the key generation and link formation was performed client-side, at no point does the key get sent to the server. You send the encrypted message to the server and the javascript serves the url that combines the client side key and the servers uid for the paste. See: http://sebsauvage.net/paste/ http://sebsauvage.net/paste/
- fatjokes 14y agoThis should be a top-level comment.