Retriever

Great tool. Secret sharing always felt needlessly complicated and clunky. I love that this lets you securely share secrets with zero barriers to entry in seconds. No need for…

I'm loving it! So simple, yet exactly the thing needed to share a secret quickly in a secure manner over a non-secure channel, e. g. email. Still a fresh idea I've never seen…

Thanks! Yea, that's all you need to do really. It's pretty simple to get it up and running :)

Right, but how do we know that https://retriever.corgea.io faithfully returns the code in that GitHub repo? We still have to trust corgea.io.

> But if we assume this site can be trusted not to send secrets online (which is easy to verify) This would require every sender and recipient to read and understand the…

Generally a good idea, but it’s implementation is not fully thought through. It’s supposed to be a secure place where secrets are shared, but it comes with Remote Code Executions…

I will not use this. It loads too many third party domains. It has a tracker. Something like this should not be this leaky IMHO.

No, I think the question is: if you're passing the URLs via email, WhatsApp, or anything else, then if that system is compromised then you've revealed the secret. If you trust…

Why bother encrypting the fragment of the URL at all? Anyone who has the text of the URL gets the message, whether the fragment is encrypted or not. Encryption is just…

Interesting. I guess the only weakness I can see is that there is no way to know that a request genuinely comes from the person you think is requesting it. On the one hand, that…

It seems key-pair is generated only once. Could be great to get fresh for every request.

great, my browser history is going to be full of secrets now

I don't get it: if you have a canal of communication anyway, why not send the secret directly ? We have many options for E2E encrypted communications, some of which are perfect…

I'm confused. How do you send the request URL, and how do you receive the encrypted secret? If the answer is "email, chat, text, Whatsapp" or whatever, them why not just send the…

People keep reinventing Magic Wormhole, and nobody has really done it better; most of them don't even reach parity. https://github.com/magic-wormhole/magic-wormhole

Haven't found anything better than croc, personally. https://github.com/schollz/croc

We use self-hosted yopass at work. Works great and since the link only works once you can simply send the URL with the decryption key to the receiver. If they can open it, the…

Nothing new here. Sites like privnote.com have been around much longer. PGP, end-to-end encryption is everywhere now.

I generally just use GPG. 1. I share my public key (if not done previously). 2. They encrypt the secret and send the result back, all using whichever tools they'd like. 3. Only I…