0

1ty.me is a website that allows you to send secret messages (password, nuclear code, etc.) to someone with a one-time link. So when someone receives the link and clicks on it, the secret message is removed permanently.

They say in their FAQ that the link is the key to decrypt the secret message. Their staff cannot decrypt anything.

I'm trying to figure out how they do it. I mean they must identify the data somehow.

That must be pretty obvious...

2

An encryption key is generated and used to encrypt the secret message you want to store. The secret message is then stored encrypted on their server and they distribute you an URL which contains the decryption key and the id of the secret message. They do not store the decryption key anywhere on their server and thus have no knowledge of the message content.
When someone visit your link, it uses the id to find back the secret message and the decryption key to decrypt it.

This kind of method is called zero-knowledge storage.

  • Small correction: "they say they don't store the encryption key" – Conor Mancone Nov 24 '19 at 0:03
  • 1
    With an url like this 1ty.me/1NpheSb: how is the decryption key + id encoded? – Kaymaz Nov 24 '19 at 6:19
  • It must somehow be derived from this. Telling you how would be guessing here, you might have more luck by directly asking them. – Xavier59 Nov 24 '19 at 15:51
1

They claim that the key for decrypting the message is stored in the URL that is generated. [This is similar to how Firefox Send works]. However I did a test, and I noticed that the key in the URL that it generated seem to be very short. In my test, I received the following URL:

https://1ty.me/aMguz

It appears that the key is encoded using just 5 base-64 characters, which means the key is just 30 bits long. I assume that they must be using some type of key-stretching algorithm to derive longer keys from these shorter keys.

Notwithstanding all of the above, I don't see how this method of sending a secret is any more secure than sending the secret by regular email. If an attacker is able intercept the email containing the 1ty.me link, then the attacker can use the link to access the secret message. For a more secure solution, consider using EncryptedSend.com which uses public key encryption.

  • Thanks for providing more info. If the link is invalid, we can tell that someone already clicked it and admin can reset the password for example – Kaymaz Nov 24 '19 at 15:30
  • 1
    Yes, but by that time, it's too late. The attacker has already accessed the secret information. – mti2935 Nov 24 '19 at 16:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.