Hacker News Reader

Comment by tim333 | Hacker News Reader

I just tried it. Here's one saying Hi HN:

https://send.bitwarden.com/#aSBOPtnJT0qjwqzpAOZM_w/Moum7wc6k...

So the decryption key contained in the url after the “#”? Is it never sent to the server, and instead only used to decrypt the message in-browser?

Right, anything after the # is not sent to the server, like other anchors.

I wonder how they know which message. I guess javascript on the client reads the stuff after # and sends something derived from it to the server?

So I created a test Send:

https://send.bitwarden.com/#j_2g_Uin5kuwZazpASDD2w/vhzdAzIS3...

https://send.bitwarden.com/#VGacXlwPhUSVHKzpASEAyg/VrzFu9aUf...

So, it looks like it's pretty simple.

After the # you have two separate things, separated by /

One is an identifier, the other is likely an encoded key (that may or may not depend on a separate password, if specified).

Just a guess, I assume this is documented somewhere

FYI, your email address is exposed on that page.

What an awful decision made by the developer. It is entirely unnecessary to display any account-related info to recipient(s). Some of us use a unique email address per company/site/account, and I find it unacceptable that my account's login would be exposed like this. It's the first piece of information required to begin brute-forcing or social engineering access to the account. I also use two-factor, but that's beside the point.

Is that a phishing link?

Are you going to follow up with a company-mandated training seminar on not clicking random links on the internet? ;)

Well you can check the link is bitwarden.com but I guess in the message I could have said something iffy.

Update - I see the similar Firefox Send was closed down due to people putting iffy stuff (phishing, malware) in the messages.

Running a public service like this is a genuine commitment to fight spam, malware, phishing, cp, and various other oogy boogies simply because if you don't people will take advantage and your links will start getting flagged as sketchier and sketchier. It's a hard laborious problem to solve when you have to prevent and suss out bad content while also not being able to see it. Bitwarden is gonna be leaning hard into the account requirement and the reputation of the sender.

Reply on news.ycombinator.com