“We’ll encrypt the file, trust us.”
This message can only come from an already-trusted party. Mozilla had an identical service to this except it was for files (Firefox Send) and that one I could trust.
I believe you can earn the necessary trust by being transparent. For this kind of service two things are essential:
- Open source software: Let everyone review your code
- Encryption in the browser. Sensitive information should never leave the browser in plaintext.
I'm considering file transfer - but there are some challenges to meet :)
C.
Front end JavaScript generates a symmetric encryption key that is never shared to the server. User enters message. Message is encrypted with the generated key. You create the scrt sending only the ciphertext to the server which doesn't have the key and so couldn't read the message. You click a button to copy both the link to the scrt and the encryption key. You then share both to your recipient. The recipient visits the link and gets the ciphertext and then copies and pastes in the key to see the message.
If it's all done frontend like this then it should be demonstrably secure and only slightly more complicated for the users.
I'm not accusing you of that - just saying there is no way to prove that's not happening.
Don't take my word for it :) You can check all code that runs in your browser and check all requests made within the network tab.
--
As an aside, I know you are trying to be funny, but your username is tad offensive.