Edit: This information is apparently outdated, see discussion below.

> # Why should I trust you with my secrets?

> All secrets are encrypted end-to-end, which means the plaintext values never leave your device. We do not log, track, share, or store the encryption key that protects your secret. You can check the client code to learn more about how we create the encryption key as well as what data is being sent to our servers.

Those are all good, but ultimately don't really answer the question when the decryption key is part of the URL. If you wanted to avoid the necessity to trust secure.sniptt.com the decryption key should at least have been placed inside the fragment. Then you could at least verify if it's being sent to the server or not. As it is it's definitely sent to the server, you'll just have to trust them that they wont use it for anything nefarious

Man, I would love a self-hosted version of this. I've worked at a lot of tiny startups and it often goes like this:

1. Sam needs to send some sensitive credentials to Alex

2. Well, we know we shouldn't use slack or email

3. We should probably use a shared password manager, but that'd be a much larger conversation with the whole dev team

4. There are a ton of options if I search "share secrets securely," but I'd have to dig into a few to figure out if I trust A. that company and B. their security model

5. Fuck it, just share it on slack, delete the message later, and hope for the best. We'll figure out a better solution "next time."

I'd love something simple and self-hosted that I could throw onto heroku, or deploy as a ready-made container, that'd provide one-time-use urls like this. It'd be a great way to have slightly better secret delivery over insecure channels (like slack) in the early days of an eng team before we get around to setting up a unified system for secret sharing. And easy self-hosting means we don't have to solve the trust problem every time.

If anyone is curious like I was, here's a quick review of what the linked code does:

- Reads plaintext input from stdin

- Symmetrically encrypts the plaintext using a 32-byte [cryptographically] random generated key (AES-256 GCM)

- POSTs the ciphertext and expiry (default 24h) to https://api.ots.sniptt.com/secrets

- The server responds with a URL to view the secret via a response header

- Query string "?ref=cli&v=<version>" are appended to the secret URL

- The decryption key is base64 encoded and appended to the secret URL as a Fragment, "#<key>"

- The secret URL is printed to stdout

The problem with these one-time URL's is that most people share them in places where the "one-time" is usually a cloud provider. If you share over IM, the IM service will check the URL to provide preview, or virus scan it. Same for many email providers. By the time you try to open it, it's already been burned.

You can whitelist those parties, but it somewhat defeats the purpose of a secure one-time link.

Hi all, since we've had a bit of traction today I thought I'd ask whether there are any additional features you'd like to see added?

For example, some sort of "self-serve" UI where you could get an API key which would allow users/teams have dedicated rate-limits and not use the default/public limits? Or a self-hosted option where the API could be deployed to the company's cloud of choice?

Or.. leave as is?

Please let us know! :)

I'm surprised nobody has created a sort of s3 service that only serves files once. It would be useful to enable services like this or other things like leaving a trail of files that reference future urls.

I have been wondering recently - how secure are URLs? For example Telegram's bot API is authenticated with a token which has to be included in the URL for any request.

What kind of failure modes are there regarding this?

Hi, I am one of the co-creators of Sniptt.

We faced this ourselves countless times, and it is exactly why we created both OTS and Snip (https://github.com/sniptt-official/snip - like OTS but with the ability to persist secrets and also create shared vaults etc.).

Pleased to say that self-hosted options for both OTS and Snip are currently top of our roadmap.

Keep an eye on the repos for updates! :)

I built this for my company. It’s create-react-app with Redis. Redis works great in this instance because it has built-in functionality for timed expiration (no cron needed). I use Node’s crypto to cipher it in the browser with a randomly generated short passphrase, generate a random ID, insert the ciphered message into the DB with the aforementioned ID, and then use the ID and passphrase to build a URL (passphrase as fragment) that is given to the user to share.

Onceler is one option based on Ruby, in-memory storage only:

https://github.com/ab/onceler

Both S/MIME (encrypted email) and OMEMO (signal style encrypted IM for XMPP with keys generated and verified client side) have been around for quite a while. That your organization doesn't have one of these is a complete failure of whoever is running IT.

For the last couple of years my org has been self-hosting Yopass https://github.com/jhaals/yopass. We use it to share secrets (with one time URLs) with each other.

What about option 6?

Create a GPG key and encrypt / decrypt your messages.

It takes about 10 minutes once to set up your key and then it's easy to send and receive encrypted messages with no central server since you could send the encrypted text over whatever transport mechanism you prefer (gist, email, etc.).