[koiueo]

What I don't get about Ente is their E2E promise.

When you share albums with someone else, the key is passed in the URL. Nothing prevents Ente from grabbing the key and decrypting all the data at this point.

So it's basically "E2E, trust me bro".

Or am I missing something?

[vishnukvmd]

The key is passed in the URL fragment. URL fragments do not leave your browser.

Implementation details here: https://ente.com/blog/building-shareable-links/

[ignoramous]

OP's point is, as a consequence of providing "useable security", the secret keys remain "exportable" (in this case, unwrapped in a URL fragment), which is an undesirable trait in some threat models. Let alone web-based cryptography, which in on itself is perilous: https://news.ycombinator.com/item?id=39436238