I’m trying to create a web app that involves sharing of user-generated content, but one of the goals is that the service host operator should be blind to the content. Only authorized users should be able to see the content shared with them. This implies the content must be encrypted at rest, and users must hold custody of their private signing key.
I figure the situation requires an open source browser extension to hold onto a user’s keys and decrypt content for them. The web app would still be able to browse all of the site’s metadata, but any plaintext content must be siloed in the extension. The reason for using an extension is that the source code would be open source and independently verifiable, while building the same functionality into the web app would require trusting the host to serve the code you expect.
Do you think that’s a reasonable tradeoff or is this asking too much from users?
The other option would be just requiring users to download an open source app for content viewing.
EDIT: Perhaps an important followup: are you OK placing trust in the host to never access your confidential data if it means you don’t have to install additional client software or worry about verifying that client software’s authenticity?
Just as an anecdote, I wrote professional medical software that people purchased. At one point there was a browser API change that would negatively affect customers in a critical workflow, I forget the specifics. I think it had something to do with file uploads. Anyway, I worked around this by creating a small browser extension that people could install that would restore previous functionality.
Less than 0.01% of customers installed it. Maybe 10 people. Not even the loudest complainers installed it. It was a massive waste of time.
In the post mortum, we discovered that it’s a complicated and strange process for average people to install an extension at all. They have no experience with it, and they don’t know how to do it, and they didn’t want to do it. It’s not like installing an app, which is a more familiar process.
The only analogue I can think of in a similar situation is something like Steam Inventory Helper which is widely used with over a million users. But the demographic is vastly different, these people are PC gamers and used to modding files and such.
So really it depends on your demographic, and whether you truly need it. Just realise it will be a great filter.