I’m trying to create a web app that involves sharing of user-generated content, but one of the goals is that the service host operator should be blind to the content. Only authorized users should be able to see the content shared with them. This implies the content must be encrypted at rest, and users must hold custody of their private signing key.

I figure the situation requires an open source browser extension to hold onto a user’s keys and decrypt content for them. The web app would still be able to browse all of the site’s metadata, but any plaintext content must be siloed in the extension. The reason for using an extension is that the source code would be open source and independently verifiable, while building the same functionality into the web app would require trusting the host to serve the code you expect.

Do you think that’s a reasonable tradeoff or is this asking too much from users?

The other option would be just requiring users to download an open source app for content viewing.

EDIT: Perhaps an important followup: are you OK placing trust in the host to never access your confidential data if it means you don’t have to install additional client software or worry about verifying that client software’s authenticity?

  • HeHoXa@lemmy.zip
    2·
    15 days ago

    Extensions can have more access.

    They can snoop / manipulate across tabs or even scan the local drive and execute system commands… when given the access.

    I had to make one for work once to let a web app run a legacy command prompt system. The web app’s search was better, but the users wanted to edit with the old tool.

    It was kind of interesting the way it worked. Not remembering the full details, I created an extension and a batch script and had to register the batch script with a group policy and declare the extension’s permission to run that batch script

    Then the users could search a client in the web app and press a button to bring up their profile in the prompt app.

    Not a recommended approach for public facing apps.

    *Edit: No! It wasn’t a batch script… exactly… it was a C# app compiled to .dll that accepted client id as an argument