Sync trusted websites

[szl1973]

Description

Paused website list not synced between devices

Expected Behavior

I’d like to see on any Apple device the same list of paused webpages.

Actual Behavior

Not the same list on all devices

Versions

• Browser: Safari (latest)
• OS: iOS, iPadOS, MacOS (latest)
• Node:
• NPM:

[smalluban]

Hi @szl1973! Thanks for the proposal. We are already investigating the feature, and we are in the development process of generally a syncing feature (for now not private data) for Safari (#1161).

However, as paused domains are strictly private data, we are figuring out how to implement syncing them in a private way (like encryption with a passcode only set on the client, and not saved anywhere).

[smalluban]

For myself: investigate https://web.dev/articles/passkey-registration for authentication.

[philipp-classen]

The type of problem, where clients store data on a server, but the server cannot read it, is called "Zero knowledge encryption". (An alternative would be a P2P approach, but it has different trade-offs: the biggest drawback is that there is no single source of truth, but also establishing P2P communication is hard. Overall, I do not think it would make sense here.)

The idea with a server is conceptually simple: the data that is stored on the server is always encrypted by the clients using symmetric encryption. As often, the practical problem is the key management.

All clients need to share the secret. Either they generate a random value and the user has to copy it over somehow. Or you can to derive it from the password, but then the problem is what happens if you change the password (they need to migrate it once, having to know the old and new password).

Another practical issue is what happens if the user loses access to the secret (or to the password if it was derived)? In general, the data is then lost (unless there is some extra mechanism like a recovery key).

All in all, it is possible; but there are some practical challenges.

(Some background: https://security.stackexchange.com/questions/236686/recovery-possibilities-with-zero-knowledge-encryption)