7 ms·
What I don't get about Ente is their E2E promise. When you share albums with someone else, the key is passed in the URL. Nothing prevents Ente from grabbing th
by koiueo 2mo ago
What I don't get about Ente is their E2E promise.
When you share albums with someone else, the key is passed in the URL. Nothing prevents Ente from grabbing the key and decrypting all the data at this point.
So it's basically "E2E, trust me bro".
Or am I missing something?
- vishnukvmd 2mo agoThe key is passed in the URL fragment. URL fragments do not leave your browser. Implementation details here: https://ente.com/blog/building-shareable-links/ https://ente.com/blog/building-shareable-links/
- ignoramous 2mo agoOP's point is, as a consequence of providing "useable security", the secret keys remain "exportable" (in this case, unwrapped in a URL fragment), which is an undesirable trait in some threat models. Let alone web-based cryptography, which in on itself is perilous: https://news.ycombinator.com/item?id=39436238 https://news.ycombinator.com/item?id=39436238