1. Chrome will write TLS keys to a file specified by the `SSLKEYLOGFILE` environment variable, so install a launchd plist to set it. Create a file at `~/Library/LaunchAgents/setenv.SSLKEYLOGFILE.plist` with contents similar to the following (edit at least the path in the last ProgramArgument): ``` Label setenv.SSLKEYLOGFILE ProgramArguments /bin/launchctl setenv SSLKEYLOGFILE /Users/andre/.keys/sslkeyfile RunAtLoad ServiceIPC ``` 3. Load the launchd plist: ``` launchctl load ~/Library/LaunchAgents/setenv.SSLKEYLOGFILE.plist ``` 4. Did it work? This command should show the path declared in the plist: ``` launchctl getenv SSLKEYLOGFILE ``` *NOTE* This configuration is persistent until you remove it (e.g. ditch the plist and log out, or `launchctl bootout gui/\${UID}/setenv.SSLKEYLOGFILE`) 5. Tell Wireshark where to look for TLS keys by configuring `tls.keylog_file`. ${await FileAttachment("wireshark-tls-keylog-file.png").image()}

Stunning photo of Wireshark's advanced preferences

7. Start capturing in Wireshark, then restart Chrome. 8. In Wireshark, use a display filter something like: ``` ip.dst!=192.168.1.0/24 and http2 ``` 9. Make a plain text file with a secret word in it. 10. Make a new notebook (or fork this one). 11. Click the paperclip icon and attach your file. 12. Find your secret word in Wireshark ${await FileAttachment("plain-text-upload.png").image()}

not actually my secret word

If you're having trouble finding it, hit command-F in Wireshark, change the menu on the left from 'packet list' to 'packet details'; change the right-most menu from 'display filter' to 'string' - now you can search for the ascii representation of your secret word. 13. Make a new secret file with a different secret word, and add it to the notebook, this time using [Inputs.file](https://observablehq.com/@observablehq/input-file) instead of the paperclip. * Click the button right there to select your new secret file * The cell below it should display the file text. * At no time should your secret word be seen by Wireshark.