Comment

Comment by Retr0id

I inspected the HTTP requests and this is absolutely not E2EE. Clipboard contents are POSTed as plaintext to https://www.quickclip.space/api/encrypt, and can be decrypted later via https://www.quickclip.space/api/decrypt

Encryption appears to be in the openssl "Salted__" format (and base64 encoded). I can't infer the actual encryption algorithm configured, but it's an unauthenticated block cipher with 128-bit blocks, presumably in CBC mode, padded with PKCS7.

Additionally, the same encryption key (whatever it is, I can't see it since it's stored on the server) is shared across all users (I tested this by decrypting a ciphertext from one account on a second account).

parent Retr0id 10 months ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton