1ty.me is a website that allows you to send secret messages (password, nuclear code, etc.) to someone with a one-time link. So when someone receives the link and clicks on it, the secret message is removed permanently.
They say in their FAQ that the link is the key to decrypt the secret message. Their staff cannot decrypt anything.
I'm trying to figure out how they do it. I mean they must identify the data somehow.
That must be pretty obvious...
They claim that the key for decrypting the message is stored in the URL that is generated. [This is similar to how Firefox Send works]. However I did a test, and I noticed that the key in the URL that it generated seem to be very short. In my test, I received the following URL:
https://1ty.me/aMguz
It appears that the key is encoded using just 5 base-64 characters, which means the key is just 30 bits long. I assume that they must be using some type of key-stretching algorithm to derive longer keys from these shorter keys.
Notwithstanding all of the above, I don't see how this method of sending a secret is any more secure than sending the secret by regular email. If an attacker is able intercept the email containing the 1ty.me link, then the attacker can use the link to access the secret message. For a more secure solution, consider using EncryptedSend.com which uses public key encryption.
An encryption key is generated and used to encrypt the secret message you want to store. The secret message is then stored encrypted on their server and they distribute you an URL which contains the decryption key and the id of the secret message. They do not store the decryption key anywhere on their server and thus have no knowledge of the message content.
When someone visit your link, it uses the id to find back the secret message and the decryption key to decrypt it.
This kind of method is called zero-knowledge storage.
