11–20 of 60 posts
So how do you transmit those links securely and why didn't you use that for your passwords in the first place?
What kind of client side encryption does this use?
It's just some symmetric encryption with a randomly generated key (in the hash of the generated url). Meaning you now have to find a way to safely send this URL ... and you are right where you started. It's no safety at all.
so, it doesn't solve every problem, but it does solve most real problems.
This service is begging the question. It encrypts a secret message by ... generating a random password and using symmetric encryption. If only there was a way to safely pass the password that encrypts my password. Or should I recursively use this tool for the job?
This service is begging the question. It encrypts a secret message by ... generating a random password and using symmetric encryption. If only there was a way to safely pass the password that encrypts my password. Or should I recursively use this tool for the job?
One would hope something like Diffie-Hellman was used.
I don't understand the threat model here. The link needs almost the same kind of protection as the original password. The only difference is, that the link expires. So how do you transmit those links securely and why didn't you use that for your passwords in the first place?
The main issues here are:
* You have to trust the client implementation to not surreptitiously record the one-time key (for both sender and receiver).
* You have to trust the site operator to actually expire the message after one use.
* Whatever secret you are transmitting MIGHT get intercepted, but at least you would know about it.
I briefly toyed with the idea of creating almost the exact same service - even down to using the URL hash to hide the secret. But at the end of the day, the concept has too many flaws for the security conscious and is too annoying to use for the layman.
Don't forget to read all of the javascript loaded every time you use this website to verify that it hasn't had `$.get('?secret_msg=' + encodeURIComponent($('#id_text').val()))` or similar added to it. Also, don't forget to let the recipient know to also read all of the javascript so that they can let you know if the plaintext was sent off to the provider the moment they open the link you sent them.
So. Many. Problems. So. Much. Insecure.