Would you use a website that required a browser extension to uphold end-to-end encryption of user content? (programming.dev)

submitted 2 days ago* (last edited 2 days ago) by tatterdemalion@programming.dev to c/asklemmy@lemmy.world

75 comments fedilink hide all child comments

I'm trying to create a web app that involves sharing of user-generated content, but one of the goals is that the service host operator should be blind to the content. Only authorized users should be able to see the content shared with them. This implies the content must be encrypted at rest, and users must hold custody of their private signing key.

I figure the situation requires an open source browser extension to hold onto a user's keys and decrypt content for them. The web app would still be able to browse all of the site's metadata, but any plaintext content must be siloed in the extension. The reason for using an extension is that the source code would be open source and independently verifiable, while building the same functionality into the web app would require trusting the host to serve the code you expect.

Do you think that's a reasonable tradeoff or is this asking too much from users?

The other option would be just requiring users to download an open source app for content viewing.

EDIT: Perhaps an important followup: are you OK placing trust in the host to never access your confidential data if it means you don't have to install additional client software or worry about verifying that client software's authenticity?

you are viewing a single comment's thread
view the rest of the comments

[-] lemmyng@piefed.ca 6 points 2 days ago

You're saying you don't want users to have to trust the website code that the server offers. So why would the user trust the extension instead?

[-] Limitless_screaming@kbin.earth 4 points 2 days ago

Maybe because you can't make sure the server uses the code it advertises without modification (The source code could be open and safe, but how can you make sure the website is actually using that?), while the extension is open source and could be downloaded directly from Github by the user. And if enough websites start using this system, it could gradually stop being an extra extension for that one website.

[-] lemmyng@piefed.ca 2 points 1 day ago

Maybe because you can’t make sure the server uses the code it advertises without modification

You'd have the server provide the code to your browser, and do the encryption/decryption client-side.

while the extension is open source and could be downloaded directly from Github by the user.

I would not install an arbitrary browser extension from Github. That's just bad security hygiene. Extensions have way too many privileges, there's not enough mechanisms to ensure that an extension is used only on the site that it's intended for, and there's no safe way to maintain updates. Heck, even extensions distributed on browser's official marketplaces have been shown to be ridden with malware.

If you're going to distribute code to run client-side for encryption/decryption, you may as well consider WASM. At least that's sandboxed...

[-] Limitless_screaming@kbin.earth 1 points 1 day ago

You'd have the server provide the code to your browser, and do the encryption/decryption client-side.

Yes, OP has a problem with this part. You'd have to trust the website to serve you the clean client side JS each time you use it. The proposal requires you to check the source code (which is plain un-minified JS) of the extension to make sure it's doing what's advertised when you download it the first time and with each update, instead of having to check the client side (obfuscated / minified) JS of every website each time you use it.

I would not install an arbitrary browser extension from Github. That's just bad security hygiene. Extensions have way too many privileges, there's not enough mechanisms to ensure that an extension is used only on the site that it's intended for, and there's no safe way to maintain updates.

That's true, but auditing that one extension (even on every update), which may be used by other websites in the future, giving it more attention and audits, is a lot easier than checking the client side JS of every website.

this post was submitted on 15 Aug 2026

60 points (100.0% liked)

Ask Lemmy

40982 readers

989 users here now

A Fediverse community for open-ended, thought provoking questions

Rules: (interactive)

1) Be nice and; have fun

Doxxing, trolling, sealioning, racism, toxicity and dog-whistling are not welcomed in AskLemmy. Remember what your mother said: if you can't say something nice, don't say anything at all. In addition, the site-wide Lemmy.world terms of service also apply here. Please familiarize yourself with them

2) All posts must end with a '?'

This is sort of like Jeopardy. Please phrase all post titles in the form of a proper question ending with ?

3) No spam

Please do not flood the community with nonsense. Actual suspected spammers will be banned on site. No astroturfing.

4) NSFW is okay, within reason

Just remember to tag posts with either a content warning or a [NSFW] tag. Overtly sexual posts are not allowed, please direct them to either !asklemmyafterdark@lemmy.world or !asklemmynsfw@lemmynsfw.com. NSFW comments should be restricted to posts tagged [NSFW].

5) This is not a support community.

It is not a place for 'how do I?', type questions. If you have any questions regarding the site itself or would like to report a community, please direct them to Lemmy.world Support or email info@lemmy.world. For other questions check our partnered communities list, or use the search function.

6) No US Politics.

Please don't post about current US Politics. If you need to do this, try !politicaldiscussion@lemmy.world or !uspolitics@lemmy.world

7) No Hit-and-Run questions.

Please don't delete your post for no apparent reason. If you plan on deleting a question later, say so in the post, or if you feel that you have a good reason to remove it, message a mod beforehand. It's not fair to the ones who took their time to answer, and it's not in the spirit of the community.

8) No Bots.

Posts or comments from bots, LLM's, AIs, Neural Networks, Transformers, or Marvin the Paranoid Android are not welcome in AskLemmy. Real humans only please.

Reminder: The terms of service apply here too.