Security
Files are encrypted on the device that sends them and can only be opened by the device that receives them. Our relay forwards sealed data it can't read, and never stores it.
Device keys
Each time you install Requesto, the app creates its own X25519 key pair. The private key never leaves the device. The device's ID is derived from its public key, so one device can't pretend to be another, and every sign-in proves the device holds its private key.
On the same Wi-Fi
- Your devices find each other on the local network and only accept files from devices on your own account.
- Every file gets a fresh one-time key, combined with both devices' keys so only the real sender could have made it.
- Files are sealed with ChaCha20-Poly1305 in 1 MiB pieces. Any change on the way, or a cut-off ending, is detected and the file is rejected.
- If the connection drops, the transfer resumes from where it stopped instead of starting again.
Over the internet
- The same sealed file travels through a relay connection that only the two devices can join. Its ID is a 128-bit random number that expires after 10 minutes if unused.
- The relay forwards the encrypted pieces one at a time and writes nothing to disk. It sees neither the contents nor the file names.
- Messages that set up a transfer are also end-to-end encrypted. The server only routes them between your devices.
Codes and links for guests
- A guest code like 7-tiger-orbit is a mailbox number and two words. The words never leave the two devices.
- The devices use the words to agree on a key with CPace, a password-authenticated key exchange, so the server never learns the key.
- A wrong guess uses the code up. Someone guessing has one chance in about 4 million, and then the code is gone.
- With a guest link, the key sits after the
#, which browsers never send to a server. - The guest web page uses the audited open-source @noble cryptography libraries, and nothing is downloaded until the guest accepts.
Accounts and sign-in
- There's no password to steal. You add devices with one-time codes that work once and expire after 10 minutes.
- Email sign-in codes expire after 10 minutes and allow 5 tries.
- Sessions and codes are stored only as hashes, and attempts are rate-limited.
- You can sign out any device, and its connection closes immediately.
Reporting a problem
If you think you've found a security issue, please write to hello@reques.to with "Security" in the subject. We'll reply quickly, keep you updated, and credit you if you'd like.