Comments (3)
The URL you see in the browser bar is never sent over the network. Of course Threema IDs and more are submitted e2e-encrypted via SaltyRTC/WebRTC from your phone to your browser - that's how the system works.
Additionally the web client (or the server where the web client is running on) uses different techniques (referrer policy e.g.) to prevent that this URL is sent as a referrer when you click on a link.
I've also created a PR for better support of this policy: #49
One might only sniff the URL when one can access your local browser history (or when this history is uploaded somewhere with a sync service or nasty browser add-ons (link to a German article)).
from threema-web.
Question because for normal websites one can sniff which websites I visit even if I use HTTPS.
That should not be the case. With TLS, the URL should be encrypted, only the host and port should be visible.
As @rugk wrote, everything after the hash symbol (#) is never sent through the network. All data transmitted is end-to-end encrypted with SaltyRTC and sent through the WebRTC data channel.
You can find some more technical details in the whitepaper: https://threema.ch/en/blog/posts/threema-web-whitepaper
from threema-web.
Thanks for your explanations! :)
from threema-web.
Related Issues (20)
- Wrong trailing semicolon on URL HOT 3
- Build Instructions Don't Work for Windows 10 HOT 4
- "Uncaught ReferenceError: WebAssembly is not defined" in Microsoft Edge HOT 2
- Chats scrolls down when trying to scroll up and older content loads in HOT 3
- Chrome: Password filling doesn't work anymore
- Threema desktop preventing standby on Windows HOT 6
- User Interface: Could not switch to "Minimal" user interface HOT 3
- CI feature: integrate pull request preview environments HOT 1
- Image quality is bad HOT 1
- App does not start/install anymore (on W7) - says instead "GetpackageFamilyName()" in "KERNEL32.dll" couldn't be found HOT 1
- Big files won't upload HOT 3
- Editing of posts HOT 1
- Agree/disagree feature HOT 1
- Replace cryptography with something better
- Please document the required node version HOT 2
- Version 2.5.3's marking of read messages is incompatible with non-current Firefox versions HOT 3
- Strange linkification for path to python script
- Compose area with multiple lines cannot be scrolled fully to the top
- Missing placeholder text in compose area when deleting multiple lines HOT 1
- Latest update not released, getting annoyed by update pop-up HOT 6
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from threema-web.