Why should I trust you with my secrets?

[slavovojacek]

Starting this to answer some of the most commonly asked questions around how we ensure your secrets are secure with us.

[slavovojacek]

Secrets created using the ots new command (as well as the web version at https://ots.sniptt.com) are what we refer to as "one-time secrets". Once they are retrieved by the recipient, they can no longer be viewed even if someone got hold of the URL. Furthermore, each one-time secret gets automatically deleted after specified duration if not viewed. By default, this is 24 hours but you can change this as required, for example ots new -x 2h.

It goes without saying that URL-accessible one-time secrets should be shared with intended recipients only.

Implementation details

Client-side

All secrets are encrypted end-to-end, which means the plaintext values never leave your device. We do not log, track, share, or store the encryption key that protects your secret. You can check the client code to learn more about how we create the encryption key as well as what data is being sent to our servers.

The following happens when a new secret is created:

1. Reads plaintext input from stdin
2. Symmetrically encrypts the plaintext using a 32-byte [cryptographically] random generated key (AES-256 GCM)
3. POSTs the ciphertext and expiry (default 24h) to https://api.ots.sniptt.com/secrets
4. The server responds with a URL to view the secret via a response header
5. Query string "?ref=cli&v=" are appended to the secret URL
6. The decryption key is base64 encoded and appended to the secret URL as a Fragment, "#"
7. The secret URL is printed to stdout

Source: https://news.ycombinator.com/item?id=28119386

Server-side

We are considering making the server and infrastructure repos public in the foreseeable future - most likely once we've agreed on and implemented some sort of self-hosted option(s).

As it stands, the API is rather simple (it creates items with TTL and upon retrieval deletes them in a single transaction), so please let us know whether there is anything specific you'd like us to cover in the comments below.

Useful reading

• Full HackerNews thread
• Security Overview of Amazon API Gateway