id	summary	reporter	owner	description	type	status	priority	milestone	component	version	resolution	keywords	cc	launchpad_bug
3876	Generate upload secret per bucket	itamarst	GitHub <noreply@…>	"Right now the `IStorageClient` HTTP emulator has a single upload secret per server. This is not too bad, but can leak information for people using Tor/I2P because the server can correlate uploads.

This was caused by the HTTP server validating the upload secret across all in-progress uploads (==buckets). If two clients ever used a different upload secret for different shares of the same storage index, they couldn't do parallel uploads. This seems wrong, shares are independent.

So the HTTP API should be changed so that upload secrets are not checked at bucket creation time. It should be fine to have different upload secrets for different shares of the same storage index."	defect	closed	normal	HTTP Storage Protocol	unknown	n/a	fixed