Earlier quoted context omitted.
But pip isn't installed. It's been bundled with Python for years now, and even if you don't have it, it's easy to get: https://pip.pypa.io/en/latest/installing/
This is true but not completely. You will only get pip when you install the binary downloaded from python.org. On osx, people use brew, on Debian, they use apt. It is most likely only Windows people will download those binaries but actually they use Anaconda, WinPython instead
Magic-Wormhole – Get things from one computer to another, safely
121–130 of 192 posts
Re: Magic-Wormhole – Get things from one computer to another, safely
#122Earlier quoted context omitted.
> Supplying an SSH public key for future login use It's public so it can be emailed in cleartext to the admin of the server, copied in any instant messenger or painted on walls. It's the secret key that ensures all the security of the connection.
It still needs to be authenticated. It could be replaced by an attacker public key.
Re: Magic-Wormhole – Get things from one computer to another, safely
#123Re: Magic-Wormhole – Get things from one computer to another, safely
#124Earlier quoted context omitted.
Interesting.. I'll take a look at it. My first thought is that magic-wormhole needs a canonical way to allocate "nameplates" (the numeric channel identifier at the start of the wormhole code), and that's tricky to do in a DHT (I'm assuming syncthing's relay server behaves like a DHT). We've got a ticket open ( https://github.com/warner/magic-wormhole/issues/72 ) about distributing this rendezvous server.. I'll add a…
Why would I use magic worm-hole instead of Syncthing or Signal? They are both user-friendly and easy to install for the person I want to send the file to. The only shortcomings I can imagine: _AFAIR Signal has a size limit on the file you can send _you need a phone number and a smartphone to use Signal _The Synching key you have to share is complicated, but sending it via email and making sure you add the hosts quick…
In Signal, the security of the initial message exchange depends upon the phone network (did somebody spoof caller-id to claim Alice's phone number?) and the Signal servers (did they report the correct key for Alice's phone number)? Once you've verified keys in person, those concerns go away. In magic-wormhole, the security of the initial message exchange depends just upon the wormhole code.
For Syncthing, if I remember right, you have to exchange "Device IDs", which are like public keys. You can send them over email, but the security depends upon the email servers (did any of the servers along the path replace that DeviceID with a false one?). The window of opportunity for that attacker is basically the same as it would be for a wormhole code sent via email. And Syncthing gets you long-term/repeated sharing of a folder, whereas magic-wormhole is one-shot.
My goal for magic-wormhole is to offer it as a provisioning protocol for other tools (with better UI and more functionality). Imagine if Syncthing had an "Invite A New Device" button, and pushing it gave you a wormhole code, and the other Syncthing instance had an "Accept Invitation" button where you type in that code. Then you could get all the nice UI and workflow of Syncthing, but you wouldn't have to transcribe the large Device ID (pubkey), and you could do it over something safer than email (like a phone call or just speaking the code to the coworker sitting next to you).
Re: Magic-Wormhole – Get things from one computer to another, safely
#125> The wormhole library requires a "Rendezvous Server": a simple WebSocket-based relay that delivers messages from one client to another. This allows the wormhole codes to omit IP addresses and port numbers. The URL of a public server is baked into the library for use as a default, and will be freely available until volume or abuse makes it infeasible to support. why not make use of https://docs.syncthing.net/users/st…
Interesting.. I'll take a look at it. My first thought is that magic-wormhole needs a canonical way to allocate "nameplates" (the numeric channel identifier at the start of the wormhole code), and that's tricky to do in a DHT (I'm assuming syncthing's relay server behaves like a DHT). We've got a ticket open ( https://github.com/warner/magic-wormhole/issues/72 ) about distributing this rendezvous server.. I'll add a…
Re: Magic-Wormhole – Get things from one computer to another, safely
#126Earlier quoted context omitted.
Why would I use magic worm-hole instead of Syncthing or Signal? They are both user-friendly and easy to install for the person I want to send the file to. The only shortcomings I can imagine: _AFAIR Signal has a size limit on the file you can send _you need a phone number and a smartphone to use Signal _The Synching key you have to share is complicated, but sending it via email and making sure you add the hosts quick…
Signal and Syncthing are great. magic-wormhole is more about setting up that initial connection: when two humans know each other, but their computers haven't met yet (i.e. know each others pubkeys). In Signal, the security of the initial message exchange depends upon the phone network (did somebody spoof caller-id to claim Alice's phone number?) and the Signal servers (did they report the correct key for Alice's phon…
...and upon third-party rendezvous/relay server, doesn't it?
Re: Magic-Wormhole – Get things from one computer to another, safely
#127Earlier quoted context omitted.
Okay. Step 1. Open ports on your router. It's your job to figure out which ports those may be. Step 2. Redirect said ports to the box in question, hopefully you'll know the ip address that was assigned by your home router's DHCP Step 3. Make sure rssh is installed. Step 4. If rssh is not installed, please simply follow the simple instructions to get it installed for your system. Step 4a. If it's a mac, use brew. Type…
Instead you get to pip install. But pip isn't installed. easy-install pip? What's easy-install - it's not there? (brew|yum|apt-get) disttools. Forget this... download get_pip.py, run python get_pip.py... Some error about libsodium now? Where do I get gcc for Windows 10 again? Python's greatest weakness is its packaging and distribution, and this project makes no effort to make it simple.
I'm hoping to get beyond that, once I get the protocol and feature set stabilized. Using something like PyInstaller or py2app to get a single-file executable will be the first step. Porting it to other languages (I've started on SPAKE2 in Rust) might help too.
FWIW, "apt install magic-wormhole" now works on Debian (stretch) and Ubuntu (zesty). Also homebrew, as mentioned before.
Quick survey: what packaged form would be most useful to you (for desktop usage.. having some kind of iOS/Android app is a whole other beast). PPA? .dmg? .exe? .msi?
Re: Magic-Wormhole – Get things from one computer to another, safely
#128When I want to give things, I use ssh to put it in the static part of my website in a directory with a random name, then I send the url by mail. My sftp client is already configured with ssh keys. When the things I have to send is a collection of jpeg files, I use fgallery.
Re: Magic-Wormhole – Get things from one computer to another, safely
#129This reminds me of the great tool http://www.fefe.de/ncp/ , which seems like the same thing only without the cryptographic authentication!
Nifty.. I'll look at the network side of that, maybe we can steal some ideas. At the moment magic-wormhole depends upon one of: * at least one side has a public IP address * both sides are on the same (private) LAN * a TURN-like "Transit Relay" server that I run That transit server hasn't gotten a worrysome amount of traffic yet, but it's a potential scaling problem. (Fortunately the two sides can offer their own tra…
Re: Magic-Wormhole – Get things from one computer to another, safely
#130I see you guys arguing what is easier, wormhole, syncthing, ssh. I'll argue that Keybase is by far the easiest. Just but the files in /Keybase/private/person0,person2
magic-wormhole can help you in the case where you're sitting next to someone at a conference and they don't have a github/twitter account, or if you want don't want to depend on github/twitter/etc access control (e.g. if some bug in github allowed gists to be published under other people's usernames, that aspect of the keybase security story would fail).
It might also appeal to folks who don't care for centralized identity providers. When we worked on Mozilla Persona, we tried to make it possible for individuals to run their own IdPs and "own your own identity". Keybase can sorta do that (by proving ownership of an HTTP or HTTPS URL), but magic-wormhole is "better" in the sense that it doesn't have any concept of identity at all. The file goes-to/comes-from the person who knew the same code, end of story.
I'm interested in some sort of combination: maybe a confirmation step that uses a wormhole code to exchange the expected public keys with a Keybase peer, to make sure they're the same, without needing to type or read the full RSA key. (There's a protocol named SAS, "Short Authenticated Strings", that can be useful in this case).