Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Peer-to-peer secure file transfer using WebRTC

bitf.ly

Post reply on HN
Print view View original

11–20 of 65 posts

Re: Show HN: Peer-to-peer secure file transfer using WebRTC

#12

Post by 0x0 »

nlightcho wrote: post #10
Rhapso wrote: post #7

Earlier quoted context omitted.

A big problem is that webRTC is highly MITM-able. You have to exchange initial connections using a server. So no party has any way of knowing if you are MITM attacking. You might be able to do something diffie-helman shaped at the javascript level (hard to ensure it actually works) to show a fingerprint of the shared secret that could be confirmed via outside channels. But all-in-all this does not offer ANY security…

These are very good points. I believe that adding any real crypto to the JS code to be a doomed path so I probably won't go for that. My only argument right now is couldn't one verify that the IP of the recipient is the same as the address of the expected receiving device (or router) and be somewhat sure it's not MITM?

You can't trust IP addresses for anything. A MITM-ing wifi router can and will pretend to be "all the IP addresses".

Re: Show HN: Peer-to-peer secure file transfer using WebRTC

#13

Post by Rhapso »

nlightcho wrote: post #10
Rhapso wrote: post #7

Earlier quoted context omitted.

A big problem is that webRTC is highly MITM-able. You have to exchange initial connections using a server. So no party has any way of knowing if you are MITM attacking. You might be able to do something diffie-helman shaped at the javascript level (hard to ensure it actually works) to show a fingerprint of the shared secret that could be confirmed via outside channels. But all-in-all this does not offer ANY security…

These are very good points. I believe that adding any real crypto to the JS code to be a doomed path so I probably won't go for that. My only argument right now is couldn't one verify that the IP of the recipient is the same as the address of the expected receiving device (or router) and be somewhat sure it's not MITM?

that might work well.

I'm a little worried, that because the browser get it's own address from the server there might be a way to build a lie that looks plausible to both users, but I can't think of a way to do that off the top of my head.

Re: Show HN: Peer-to-peer secure file transfer using WebRTC

#14

Post by endergen »

crcastle wrote: post #8

With some sort of peer discovery functionality, this could be a pretty cool open, cross-platform replacement for Apple's AirDrop. ...but would probably need WebRTC functionality in Safari to work on iOS devices

I was thinking this exact use case last in year in some experiments but just got to busy to finish it. I had auto discovery of local computers and a nice name: browserdrop.it.

I had it working too casting a chromecast with a system for displaying various file formats and basically file sharing your phone.

Not enough time in the world to finish every side project. Also once I found out about AirDroid I kind of felt they had my main use case pretty covered. Not quite but close. https://www.airdroid.com/

Re: Show HN: Peer-to-peer secure file transfer using WebRTC

#16

Post by Rhapso »

nlightcho wrote: post #10
Rhapso wrote: post #7

Earlier quoted context omitted.

A big problem is that webRTC is highly MITM-able. You have to exchange initial connections using a server. So no party has any way of knowing if you are MITM attacking. You might be able to do something diffie-helman shaped at the javascript level (hard to ensure it actually works) to show a fingerprint of the shared secret that could be confirmed via outside channels. But all-in-all this does not offer ANY security…

These are very good points. I believe that adding any real crypto to the JS code to be a doomed path so I probably won't go for that. My only argument right now is couldn't one verify that the IP of the recipient is the same as the address of the expected receiving device (or router) and be somewhat sure it's not MITM?

The way I would make this work:

- Build a DHT style overlay network of "meet in the middle" servers

- Have a standalone html file, that uses websockets to connect to the network of servers.

- Have both clients generate keys, exchange them via other channels.

- Both users have a shared key, they both lookup the server that hosts the shared key on the DHT network (that actually can be done without leaking the key to every server) then they use that server to exchange NAT-busting messages

Ideally, you would have a lot of different use cases using the same network in such a way that it is hard for a server to figure out what you are using it for, and it is essentially impossible for a server to target MITM a specific pair. What this does leave open is sybil attacking and MITM-ing everything opportunistically. At this point we essentially start to build TOR via websockets and WebRTC and it all breaks down.

Re: Show HN: Peer-to-peer secure file transfer using WebRTC

#17

Post by quartz »

Very cool! We built something similar using flash and RTMFP back in 2010 and actually got into YC W11 with the project (with dreams of building something like airdrop until Apple went and actually built airdrop causing us to pivot into high speed data transport instead).

It's great to see this being implemented using WebRTC now, which was just popping onto the radar back then. I envy you building this without having to write any action script or flex code! Best of luck with the project.

Re: Show HN: Peer-to-peer secure file transfer using WebRTC

#20

Post by tjohns »

crcastle wrote: post #8

With some sort of peer discovery functionality, this could be a pretty cool open, cross-platform replacement for Apple's AirDrop. ...but would probably need WebRTC functionality in Safari to work on iOS devices

I mentioned it in another comment upthread, but http://sharedrop.io is exactly this. WebRTC file transfer with LAN peer discovery.
Post reply on HN