Quote from: sendbit.io on May 09, 2020, 03:10:54 PM

It is standard practice to send "plaintext" passwords over HTTPS. The passwords are ultimately not plaintext, since the client-server communication is encrypted as per TLS.

You are avoiding my argument.

You claimed that you don't have access to the private keys.
But you have access to the encrypted file AND the password. And therefore to the private keys.

And additionally, you didn't comment on this:

Quote from: bob123 on May 09, 2020, 02:44:19 PM

You claim that you prevent CSRF with "SQL Injection filters":

Quote from: https://sendbit.io/page/our_security

We use SQL injection filters to prevent CSRF attacks [...]

So, my question still stands:
Are you incompetent or do you have malicious intend? Or maybe both?