The Fishcake🐶🐾 on Nostr: Just thinking out loud. To safely (for the host and the user) support transfer of ...

Just thinking out loud.

To safely (for the host and the user) support transfer of encrypted data between two parties using an intermediary, I can think of one way.

Client encrypts the media
Client uploads the media to the media host (blossom or nip96)
Client notifies media host about intended recipient (hex npub or some derived verifiable public key)
When client tries to fetch the media, they submit a signed request in the header
Host verifies that the key is valid and that the client can decode the data
Host still doesn’t know the content or even potential recipient or sender
Host served the data as is
Client decodes the data

This will help with protection against random bits of data just linked from the host, reduce liability, and not serve as a place to spread infected payloads and so on.

Still some more thinking needs to happen in this space