The life-changing magic of WKD

Nothing is leaked to https://i.delta.chat. i.delta.chat can be down and you can firewall it away, the link will still work. https://i.delta.chat is a static website that is only used as a fallback for users who click on it while having no Delta Chat installed, it then gives them instruction to install delta chat and open the link with it. Even when you open it in a browser, the web server does not receive any email addresses because this data is after the # symbol (in the URI fragment). This is also written in GitHub - deltachat/invite: Invite links for deltachat README.

It is # instead of ? specifically to avoid sending the data to the server. Data after ? is sent to the server, data after # is only available to JavaScript running locally when the page is open in the browser.

You can replace i.delta.chat with OPENPGP4FPR if you really want, it works for pasting from the clipboard. For an example, I created a test profile and got this invite link: https://i.delta.chat/#701B491C602CA7FA9F5EA50875E3AFB6C61DBF30&i=yRb8i2EYhKKQvPAR6VPmutcN&s=r-k_CrzioiiYrFlxPGlLgRSv&a=hzg7psx64%40nine.testrun.org&n=Alice. I changed it like this: OPENPGP4FPR:701B491C602CA7FA9F5EA50875E3AFB6C61DBF30#i=yRb8i2EYhKKQvPAR6VPmutcN&s=r-k_CrzioiiYrFlxPGlLgRSv&a=hzg7psx64%40nine.testrun.org&n=Alice. This works for pasting from the clipboard, I tested.

3 Likes