Damn already working on an app? That’s so cool! Starting E2EE there is definitely a good idea then!

MeroChat is such a nice project, thank you for working on it <3

The server might always send a modified script that just uploads the plaintext private key.

Yeah, you’d need a way to validate the client code before it’s executed to solve that issue

Section “2. Client application security” of MEGA’s Security Whitepaper discusses this exact problem. Their best solution to that issue is to just cram the whole frontend in a signed web extension and not serve any code to the user when the extension is active, which is not very user friendly but works for those who want an extra layer of protection

I just can’t find a good user-friendly implementation, sorry for not being of more help. The web just isn’t E2EE-friendly ig :/

Yeah, I’m not used to E2EE in the browser either and StackExchange seems to agree that there’s no nice solution :/

The sanest option in terms of user practicality to me appears to be storing the private key on the server, maybe encrypted with the user’s password, and sending it to the user on successful login where it would be decrypted client side. It seems like it’s more or less what MEGA is doing since they have a similar issue

If the server having temporary access to the user’s password is an issue maybe the password could be partially pre-hashed before being sent?

It’s be interesting to talk about it with someone with more experience, especially since implementing all of that will be a pain so it can’t be redone every Thursday

I know Matrix has E2EE with some public documentation on its implementation. Maybe it could help you? Idk how familiar you’re with E2EE or what kind of implementation you’d want, anything will have drawbacks :/

No censorship here. Could’ve guess with the instance’s name but still good to know! Thanks :)

Yup, that’s what my dentist recommends. If you do that, just make sure you have a toothbrush and toothpaste which doesn’t hurt your teeth :)

Preposterous.

Just like humans, waffles are social creatures. They simply rely on toppings to become a better version of themselves. They are accepting of all cultures, be it sugar, syrup, chocolate or even strawberry jam. This is because as Friedrich Nietzsche said: “There are no eternal facts, as there are no absolute truths.” One topping simply cannot be the true topping.

Once a topping is placed on the waffle, it becomes part of the waffle. Part of its taste, part of its existence. It completes it. Therefore to say that a waffle is bland because it has no topping is like saying that a human is incapable of anything because you once saw a lone human in nature get eaten by a wolf.

Waffles are a reflection of humanity and you are simply running away.

I mean…