Show HN: Encrypt and upload files to IPFS from browser

It's encrypted directly on your browser, you can download the encryption key after file is uploaded. Not content-based (because the header is randomly generated & you keep the encryption key) but you can share to secret file to others and they will be able to download the file.

Files are pinned mainly by NFTStorage.

Currently it's free because NFTStorage is free. If things change I would allow buying storage using Filecoin (~$0.2/TB/month).

This is amazing, great work! I love that it does everything in-browser.

A handful of questions:

Your currently uploading to a gateway and are considering moving to your own gateway backed by filecoin. Have you considered ditching the gateway and using the libp2p WebRTC and/or WebSocket transports to upload directly to the network via the browser tab?

Where are you hosting this and how are you protecting against "supply chain attacks" where your hosting provider (either maliciously or through their service being compromised) injects additional JS that exfiltrates secrets? Have you explored managed/trusted upgrades to the existing user's apps through browser storage and a service worker? I don't know of any surefire ways to protect against the first delivered page being compromised, or a compromised browser environment, but could you lock down the upgrade path for the app for returning users by moving it outside of the page load path? (Not just a question for OP, I've been wondering about this for a bit now, it's kinda critical path for delivering P2P experiences to a browser tab - you need a way to minimize trust of the server hosting the HTML/JS files otherwise it can trivially exfiltrate your secrets)

What is the migration path off of this? If I have this metadata file, how do I use it locally to fetch my encrypted files directly from the IPFS pinning server without having to return to your site?

How does multi-user access work?

What do you think the path to beating Google Drive on UI/UX is with P2P software?

---

We are working on a very similar problem to this right now, using the guts of IPFS and some stuff borrowed from Secure Scuttlebutt et. al. to manage encrypted files, identities, and capabilities. We also have a way to encrypt a file once and share individual per-user encryption keys on-demand bound to the user's private key. This lets the decryption keys be mirrored by nodes (i.e. put it on IPFS!), without the corresponding private key the decryption key is worthless. Next we are exploring UCAN for managing capabilities and granting access. And an overlay network to power it all. I'd love to compare notes with you.

Do you want a job? There is an open spot on my team working on exactly this stuff. Our goal is to make an SDK for building these exact types of apps.

Salary bands max out at $250k. Fully remote team, nomad friendly, 4 day work weeks. Time is spent roughly 50/50 implementing stuff and reading research papers (like Filecoin, IPFS, Scuttlebutt, etc.).

We have an open interview challenge for the team that gives some good insight into what the role is and what a "day in the life" will be like: https://gitlab.com/webai-open/network/interview-challenge

It's hardly unlimited though. I can't even upload a 1.82kB image file to test it. Probably because whatever service it uses to access IPFS is saturated. So that wouldn't be unlimited in my book.

I love selfhosted stuff like IPFS, but keep expectations realistic or people will just leave with a bad impression of them.

What's the use case? If I have files, why should I store them on IPFS and pay someone to pin through all that complexity, rather than just use Google Drive or whatever?

I think curl added some support for ipfs recently. Saw a previous discussion here https://news.ycombinator.com/item?id=37628525