It'd be unlikely to have much use outside the one specific situation I find myself in, but it'd be interesting to have a variant on a one-click hoster that works by setting up a temporary one-off SFTP account. Like, you sign up to provide a file named X, and you can securely upload a thing and it gets stored in a server, which won't let you download X back.
Someone else creates an account to download the same-named file, and it gives them a similar temporary SFTP account
so the username/password you're given is one use only, the whole thing is fully encrypted the entire upload and download, and for someone else to MITM it, they'd either need to control the server, or spy on your conversation and sign up to receive it before the intended recipient could
and since only one person can sign up to get the file, this MITM would be obvious: the intended recipient would go "hey wait I can't sign up because someone else got it"
@foone Oddly enough, this is something that we've had exactly the need for at work recently. We've sort of shuffled around it without implementing all of what you just described for now, but you nailed our requirements.
@foone uggggh you're describing GXS (now OpenText)'s "trading grid", https://www.opentext.com/products/trading-grid-messaging-service , which is basically an access control list database in the middle, some replicated disk storage lumped up around it, and a bunch of FTP and web portals duck taped to the lumps. It's used by financial companies that don't trust each other but do trust GXS to send "CSV" (mostly actually twisted BAIv2) files to each other that represent transactions. It's terrible and the whole baking world runs on it.
Add comment