Nice work on the zero-knowledge implementation. A few questions from someone working on encrypted document storage:
1. How are you handling key derivation? I see Argon2 mentioned - curious about your iteration counts and memory parameters for the tradeoff between security and UX.
2. For the encrypted link approach, are you storing any metadata server-side (file sizes, timestamps, IP addresses)? Even seemingly innocuous metadata can be surprisingly revealing.
3. What's your threat model around browser-based crypto? We've been wrestling with questions like service worker persistence, CSP headers, and whether users should trust browser storage for keys at all.
The time-limited secret sharing is a great feature. I've found that immigration lawyers and journalists are particularly interested in this kind of temporary, verifiable sharing - curious if you've had similar feedback.
1. How are you handling key derivation? I see Argon2 mentioned - curious about your iteration counts and memory parameters for the tradeoff between security and UX.
2. For the encrypted link approach, are you storing any metadata server-side (file sizes, timestamps, IP addresses)? Even seemingly innocuous metadata can be surprisingly revealing.
3. What's your threat model around browser-based crypto? We've been wrestling with questions like service worker persistence, CSP headers, and whether users should trust browser storage for keys at all.
The time-limited secret sharing is a great feature. I've found that immigration lawyers and journalists are particularly interested in this kind of temporary, verifiable sharing - curious if you've had similar feedback.