I’m trying to create a web app that involves sharing of user-generated content, but one of the goals is that the service host operator should be blind to the content. Only authorized users should be able to see the content shared with them. This implies the content must be encrypted at rest, and users must hold custody of their private signing key.

I figure the situation requires an open source browser extension to hold onto a user’s keys and decrypt content for them. The web app would still be able to browse all of the site’s metadata, but any plaintext content must be siloed in the extension. The reason for using an extension is that the source code would be open source and independently verifiable, while building the same functionality into the web app would require trusting the host to serve the code you expect.

Do you think that’s a reasonable tradeoff or is this asking too much from users?

The other option would be just requiring users to download an open source app for content viewing.

EDIT: Perhaps an important followup: are you OK placing trust in the host to never access your confidential data if it means you don’t have to install additional client software or worry about verifying that client software’s authenticity?

  • tatterdemalion@programming.devOP
    3·
    3 days ago

    All your client (whether an independent app or just a script on a web page) needs is the ability to hash the user’s password to be able to reconstruct the key and begin decrypting things.

    This would work as an independent app. But as a web page, it would be delivered by the web server, requiring you to trust that the server is not snooping on your decrypted content (by sending it back to the server post-decryption).

    • OwOarchist@pawb.socialEnglish
      1·
      3 days ago

      But as a web page, it would be delivered by the web server, requiring you to trust that the server is not snooping on your decrypted content

      Anybody interested (and capable) enough could view the web page’s source and verify that the scripts running on it are identical to what they’re supposed to be, and if they want to, they can even go through the entire code line-by-line to verify.

      Honestly, web scripts are easier to verify than a browser extension or stand-alone app, because you can quickly and easily view the (local) source code that you’re actually running.

      I’d say that browser extensions and apps are more difficult to verify. You can, of course, publish the source code, but unless end users are compiling it from source every time, you have an issue with them having a difficult time verifying that the compiled code they download and run is actually the same as the publicly visible source code. A malicious developer could publish clean source code, but then provide compromised compiled versions for download and install.

      I suppose there is a frequency argument to be made, though. With a browser extension or standalone app, you only need to check and re-verify the code each time it’s updated. But a script running on a web page would need to be verified every time you use it.