Hacker News Reader

The default is to send your private key in plaintext to the redirector.

SSL was added recently so it's not the default for now. Thanks for calling us out on this, we'll switch to HTTPS/SSL as the default in coming updates.

To enable encryption right now, please see https://www.getbridge.com/docs/gettingstarted/js/advanced

Wait.

"The default is to send your private key in plaintext to the redirector."

What?

Your private API key, not your private SSH key.

That clarifies that it's not a good idea, actually. A secure exchange would involve the server issuing a challenge, and the client producing a response, and not sending the key at all.

Reply on news.ycombinator.com