Unverified50% confidenceFactExact time
The otpauth:// link itself contains no encryption; anyone who can read that string can reconstruct the authenticator from it, and exposing that URI has exactly the same consequences as directly leaking the setup key.
1
Sources
50%
Confidence
Long-term
Relevance
10/13/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedCryptPad的文档URL通过URL fragment（#号后的部分）传递解密密钥片段，根据HTTP协议规范fragment不会随请求发送到服务器68% similarUnverifiedHTTPS加密后观察者仍能看到部分连接元数据，如服务器IP地址和通过SNI扩展暴露的域名，但无法读取或篡改HTTP报文本身64% similarUnverifiedHTTPS加密只能保护数据在传输链路上不被第三方截获，但不能阻止中间层平台运营方读取和存储明文内容64% similarUnverified由于服务器不记录调用方身份的历史状态，单凭一串API Key字符串就足以代表完整的身份权限，Key一旦泄露即可被无限制滥用64% similarUnverifiedIn the OHTTP architecture, the relay can see the client's IP but cannot see the encrypted request content, while the gateway can decrypt and process the request content but can only see the relay's IP.64% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1015722API
curl https://kongchang.com/api/v1/knowledge/claims/1015722MCP
get_claim(id=1015722)