Hacker News Reader

I'm confused. How do you send the request URL, and how do you receive the encrypted secret?

If the answer is "email, chat, text, Whatsapp" or whatever, them why not just send the secret plaintext?

If anyone can get into any of those systems, then they can easily get your secret from the two urls, so why bother with the encryption?

View on HN

You can send the URL in whatever medium is convenient. However, if someone gets a hold of the URL with the secret, they will not be able to see the secret. For example, here's a URL containing the secret. Can you see the secret?

https://retriever.corgea.io/#eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJ...

If I glean from the landing page correctly, there will be a private key somewhere in the browser e.g. localstorage. This way the sender can encrypt the secret with the public key of the receiver. Mitm attacks are certainly possible, but eavesdropping is not.

You're correct. While a Mitm is possible, it'll be useless because the actor will have to get access to the private key from the requester'ss browser. They would have to be on the requester's machine

Reply on news.ycombinator.com