Cryptpad: Zero Knowledge, Collaborative Real Time Editing

#1

Post by zerognowl » Fri, Sep 23, 2016, 5:23 PM UTC

Cryptpad: Zero Knowledge, Collaborative Real Time Editing
beta.cryptpad.fr

Re: Cryptpad: Zero Knowledge, Collaborative Real Time Editing

#2

Post by zmanian » Fri, Sep 23, 2016, 5:41 PM UTC

This is a cool implementation of this idea.

Proof of work is probably an acceptable solution for proof of concept but anonymous consensus isn't needed for for collaborative document editing.

I'm still thinking if this use cases needs timestamping or atomic broadcast.If timestamping is sufficient, Google's new roughtime protocol would do the job well. Otherwise you need a proper atomic broadcast algorithim like RAFT, Tendermint, Honeybadger etc.

Great work.

Re: Cryptpad: Zero Knowledge, Collaborative Real Time Editing

#3

Post by t0mbstone » Fri, Sep 23, 2016, 5:51 PM UTC

Ok, now this is cool.

Re: Cryptpad: Zero Knowledge, Collaborative Real Time Editing

#4

Post by celticninja » Fri, Sep 23, 2016, 6:12 PM UTC

Sharing the URL is essentially giving out the key, so there is no digitally safe way to do this unless you encrypt the initial message, at which stage you are using encrypted communication anyway and the URL just leaves open an attack vector. Please correct me if I am wrong.

Re: Cryptpad: Zero Knowledge, Collaborative Real Time Editing

#5

Post by no_protocol » Fri, Sep 23, 2016, 6:16 PM UTC

I have often seen claims that doing any kind of crypto in (browser) javascript is dangerous. Does this fall into that trap?

How can I safely share the URL to someone without already using an established encrypted communication method?

Is the encryption key stored in my browser history?

Re: Cryptpad: Zero Knowledge, Collaborative Real Time Editing

#6

Post by Diederich » Fri, Sep 23, 2016, 6:19 PM UTC

This is pretty cool, but I believe that you still have to trust cryptpad.fr to send you javascript that won't leak.

Re: Cryptpad: Zero Knowledge, Collaborative Real Time Editing

#7

Post by no_protocol » Fri, Sep 23, 2016, 6:22 PM UTC

Diederich wrote: post #6

This is pretty cool, but I believe that you still have to trust cryptpad.fr to send you javascript that won't leak.

From a glance at the GitHub page, it looks like you can self-host the project. Is "bower install" a possible attack vector as well? I'm unfamiliar with it.

Re: Cryptpad: Zero Knowledge, Collaborative Real Time Editing

#8

Post by mxuribe » Fri, Sep 23, 2016, 6:27 PM UTC

Seems cool.

Re: Cryptpad: Zero Knowledge, Collaborative Real Time Editing

#9

Post by the_duke » Fri, Sep 23, 2016, 6:28 PM UTC

no_protocol wrote: post #7

Diederich wrote: post #6

This is pretty cool, but I believe that you still have to trust cryptpad.fr to send you javascript that won't leak.

From a glance at the GitHub page, it looks like you can self-host the project. Is "bower install" a possible attack vector as well? I'm unfamiliar with it.

Bower is a package manager for Javascript libraries.

So the only attack vector would be a MIT attack, intercepting the requests to the Bower registry.

Re: Cryptpad: Zero Knowledge, Collaborative Real Time Editing

#10

Post by Canada » Fri, Sep 23, 2016, 6:30 PM UTC

I'd love something similar, but implemented as a browser extension.