Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Magic-Wormhole – Get things from one computer to another, safely

github.com

Post reply on HN
Print view View original

91–100 of 192 posts

Re: Magic-Wormhole – Get things from one computer to another, safely

#91

Post by ubernostrum »

falcolas wrote: post #80
bb88 wrote: post #74

Earlier quoted context omitted.

Okay. Step 1. Open ports on your router. It's your job to figure out which ports those may be. Step 2. Redirect said ports to the box in question, hopefully you'll know the ip address that was assigned by your home router's DHCP Step 3. Make sure rssh is installed. Step 4. If rssh is not installed, please simply follow the simple instructions to get it installed for your system. Step 4a. If it's a mac, use brew. Type…

Instead you get to pip install. But pip isn't installed. easy-install pip? What's easy-install - it's not there? (brew|yum|apt-get) disttools. Forget this... download get_pip.py, run python get_pip.py... Some error about libsodium now? Where do I get gcc for Windows 10 again? Python's greatest weakness is its packaging and distribution, and this project makes no effort to make it simple.

But pip isn't installed.

It's been bundled with Python for years now, and even if you don't have it, it's easy to get:

https://pip.pypa.io/en/latest/installing/

Re: Magic-Wormhole – Get things from one computer to another, safely

#92

Post by [deleted] »

bhenc wrote: post #60

> Copying files with ssh/scp is fine, but requires previous arrangements and an account on the target machine, and how do you bootstrap the account?~ Assuming that you have openssh and rssh installed, you bootstrap like this: useradd -m -g users -s /usr/bin/rssh tmp passwd tmp edit /etc/rssh.conf and uncomment allowscp Share the password with the party you want to exchange data with. Make sure your ports are open. Se…

[deleted]

Re: Magic-Wormhole – Get things from one computer to another, safely

#93

Post by pmontra »

the_cat_kittles wrote: post #3

the motivations are great: "Moving a file to a friend's machine, when the humans can speak to each other (directly) but the computers cannot Delivering a properly-random password to a new user via the phone Supplying an SSH public key for future login use" i had never even thought about those, and this is a great solution afaik

> Supplying an SSH public key for future login use

It's public so it can be emailed in cleartext to the admin of the server, copied in any instant messenger or painted on walls. It's the secret key that ensures all the security of the connection.

Re: Magic-Wormhole – Get things from one computer to another, safely

#94

Post by YC2017 »

falcolas wrote: post #79
lotharrr wrote: post #40

Earlier quoted context omitted.

If I did things right, the rendezvous server shouldn't get any advantage over a network attacker: one guess per invocation of the program, 1-out-of-65536 chance of getting it right, 65535-out-of-65536 chance of giving you a WrongPasswordError. FWIW, there's also a --verify option, which causes the program to print out a hex hash of the session key, and wait for you to approve it before sending anything. Not as ergono…

Call me a nerdy hipster, but I prefer my 1-in-2^256 chance with AES encryption. Then I can put it, well, anywhere. Including a thumb drive, google drive, S3, email, or even some random public newsgroup. I realize this complicates things a touch - you need a program to encrypt and decrypt the file - but that seems much more secure.

google drive, S3, and similar storage options are easier than wormhole. Not sure you need AES: How secure is google drive over https?

Re: Magic-Wormhole – Get things from one computer to another, safely

#95

Post by vacri »

bb88 wrote: post #83
falcolas wrote: post #80

Earlier quoted context omitted.

Instead you get to pip install. But pip isn't installed. easy-install pip? What's easy-install - it's not there? (brew|yum|apt-get) disttools. Forget this... download get_pip.py, run python get_pip.py... Some error about libsodium now? Where do I get gcc for Windows 10 again? Python's greatest weakness is its packaging and distribution, and this project makes no effort to make it simple.

On the mac, you can: brew install magic-wormhole [1] And that covers 90% of the people that care. Granted I think you're right that software packaging and distribution is still generally broken in 2017, but that's a problem across the board. It's a problem with java, node.js, python, etc. [1] https://github.com/warner/magic-wormhole

So... 'brew install rssh' is bad and kludgy, but 'brew install magic-wormhole' is easy and light? And hey, if you're not on a mac, you have to also install a bunch of other deps too.

You probably shouldn't have tried to pad out your steps by taking a detour into package management.

Re: Magic-Wormhole – Get things from one computer to another, safely

#96

Post by vacri »

lotharrr wrote: post #59
daxorid wrote: post #50

So, basically, scp (with a 16-bit session key that has to be exchanged oob)?

Yeah, if you've already gotten a public key set up (and an account on the target machine), then scp is much easier and completely secure. magic-wormhole is more aimed at situations where you don't yet have that pubkey copied over. Or where your receipient doesn't want to give you an entire account just to receive a single file. In fact there's a mode (kinda experimental right now) to use magic-wormhole to transfer an…

scp requires additional network routing config to get it past a NAT, which is most residential internet.

Re: Magic-Wormhole – Get things from one computer to another, safely

#97

Post by Ferofluid »

lotharrr wrote: post #18
schoen wrote: post #5

This reminds me of the great tool http://www.fefe.de/ncp/ , which seems like the same thing only without the cryptographic authentication!

Nifty.. I'll look at the network side of that, maybe we can steal some ideas. At the moment magic-wormhole depends upon one of: * at least one side has a public IP address * both sides are on the same (private) LAN * a TURN-like "Transit Relay" server that I run That transit server hasn't gotten a worrysome amount of traffic yet, but it's a potential scaling problem. (Fortunately the two sides can offer their own tra…

Why don't you piggy back on Mainline DHT or try using PEX? Or maybe Local Peer Discovery( to multicast group 239.192.152.143:6771)?

Re: Magic-Wormhole – Get things from one computer to another, safely

#98

Post by vbernat »

pmontra wrote: post #93
the_cat_kittles wrote: post #3

the motivations are great: "Moving a file to a friend's machine, when the humans can speak to each other (directly) but the computers cannot Delivering a properly-random password to a new user via the phone Supplying an SSH public key for future login use" i had never even thought about those, and this is a great solution afaik

> Supplying an SSH public key for future login use It's public so it can be emailed in cleartext to the admin of the server, copied in any instant messenger or painted on walls. It's the secret key that ensures all the security of the connection.

It still needs to be authenticated. It could be replaced by an attacker public key.

Re: Magic-Wormhole – Get things from one computer to another, safely

#100

Post by miles »

ReverseCold wrote: post #87

I expected something local, like airdrop, but cross platform. (someone, please)

Sounds like Dukto: http://www.msec.it/blog/?page_id=11

Supports Windows (XP and up), OS X/macOS (10.6 and up), Linux (packages for Ububtu and Fedora), and Symbian. Ports available for iOS, Blackberry, and more.

Post reply on HN