search

standardnotes / FileSend

Simple, encrypted file sharing. https://filesend.standardnotes.com
GNU Affero General Public License v3.0
110 stars 11 forks source link

Filesend uses its automatically generated key for encryption instead of mine #14

Open tetra900 opened 4 years ago

tetra900 commented 4 years ago

https://filesend.standardnotes.org/ I change key for encryption but it uses its auto generated key instead. It shows different keys to decrypt file on final page - in simple link it uses auto generated key and in separate field for key it shows my manually entered key. Auto generated key is working for decryption and manually entered key is not. I used last version of Firefox in private and not private mode and this bug appeared in both cases. OS is Windows 10

JaspalSuri commented 4 years ago

I wasn't able to reproduce exactly what you've experienced. I noticed that the Simple Link contained the autogenerated key, but was still able to decrypt the file with both the autogenerated key and the key I had set manually. Can you try it once more? I pasted my key for reference just to make sure I was entering the correct characters.

This was on Firefox for macOS Mojave.

moughxyz commented 4 years ago

When you use the simple link it uses a derived version of your inputted key so that the plaintext value of your key is not revealed in the URL. When you use the bare link, and someone then enters your plaintext key to decrypt, that key is then derived to create a similar value as you would see in the simple link. So ultimately the result is the same.