4 ms·
It's trivial for the host to inject some JavaScript that reads the fragment and phones home. The FISA request writes itself.
by tantalor 2y ago
It's trivial for the host to inject some JavaScript that reads the fragment and phones home.
The FISA request writes itself.
- pcthrowaway 2y agoOh sure, if you're running malicious code in the browser already then Cryptpad can't protect you. I'm saying that in addition to this, Google, Microsoft, and Apple will be able to read your Cryptpad documents because they'll have the URL with the decryption key. The only thing putting the key in the fragment portion of your URL accomplishes is ensuring that the cryptpad server itself (which you control anyway if you're self-hosting) can't access the data