Lavabit code open sourced

Re:Lavabit code open sourced by userbinator on Sunday May 01, 2016 @12:08AM (#11604824)

I've actually looked at the code Mega uses (mainly for downloading without a browser) and the key is not stored on the server but actually part of the URL fragment, which isn't necessary to be sent to Mega, and decryption happens on the client:

https://gist.github.com/KenMacD/6431823

http://julien-marchand.fr/blog/using-the-mega-api-how-to-dow...

I haven't looked at the upload side but that's an interesting datapoint. Not sure how secure AES128-CTR is.

[ Parent | on HN ]

Re:Lavabit code open sourced by pfg on Sunday May 01, 2016 @12:25AM (#11604870)

That would avoid transmitting the key to the server, but in the scenario I mentioned, it would still be accessible to the backdoor via window.location.hash.

[ Parent | on HN ]

Re:Lavabit code open sourced by colejohnson66 on Sunday May 01, 2016 @12:45AM (#11604917)

I meant the key to decrypt the user's own folder. That has to be stored on the server so you can access your files from anywhere. But yes, share files/folders keep the key in the window hash, but that's not what I was talking about.

[ Parent | on HN ]