News for hackers. Stuff that matters.
Re:End-to-end encryption in the browser by marcus_holmes on Monday March 23, 2020 @09:58AM (#22664143)
yeah, this.

Having the key in the url seems insanely insecure to me.

Re:End-to-end encryption in the browser by henriquez on Monday March 23, 2020 @10:03AM (#22664179)
Why? It makes it easy to share a sketch with someone else while still preventing the server from decrypting the data. Anything stored in a location hash (after the # symbol) does not get passed to the server.

The threat model the author tried to work around is not the user dumbly compromising their own work. The author wants to prevent proprietary and PII data from being stored on their own server. End-to-end encryption significantly reduces the author's potential liability hosting something like this in case something goes wrong.

Re:End-to-end encryption in the browser by inetknght on Monday March 23, 2020 @01:39PM (#22666497)
> Why? It makes it easy to share a sketch with someone else while still preventing the server from decrypting the data. Anything stored in a location hash (after the # symbol) does not get passed to the server.

I'll hit the URL bar and hit control-C. That's way better than any javashit which wants to touch my clipboard.

Copying the current URL also copies the key in that case. Now I'm accidentally sharing my encryption information with another user.

Re:End-to-end encryption in the browser by henriquez on Monday March 23, 2020 @03:06PM (#22667506)
That's literally the use-case of pasting the link to your sketch to someone. The app itself is not touching your clipboard. Take a careful look at how this works, it's perfectly innocuous.