Build your own Secure Messenger
summary
A working static-site chat that implements end-to-end encryption in the browser using OpenPGP.js and stores public keys in Supabase while persisting private keys in user metadata behind an identity provider. Messages encrypt once to multiple public keys (single ciphertext) and decrypt only with matching private keys; adding a late participant requires existing members to decrypt and re-encrypt history or use a rotated symmetric key wrapped per recipient. Demo runs but flags XSS, storage and UX risks (passphrases, key backup).
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:11Speaker credentials
- 2:56Build secure messenger from scratch
- 4:43End-to-end encryption explained
- 8:40Asymmetric encryption tools
- 12:11OpenPGP JS for web app
- 12:52Key pair generation
- 18:14Decrypting with passphrases
- 19:59Secure key storage in web
- 26:47Keys in database metadata
- 31:19Encrypting messages
- 35:14Decrypting user messages
- 38:42Adding chat participants
- 43:17Live demo
- 48:24Security risks
- 50:31Key takeaways
- 53:41Q&A
related talks
59mBuild a simple encrypted messaging application with Sendbird Chat
01h 49mBuilding Decentralised Chat with Next.js
01h 07mBuilding Rock-Solid Encrypted Applications
45mZero Knowledge; Meeting the Growing Demand for Security and Privacy
34mEncrypting Data in the Browser - Exploring Web Crypto APIs
42mSecurity of Push Messaging
50mBuilding Production-Grade End to End Encrypted App...
27mA privacy first period tracker? Is it even possible?