Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Magic-Wormhole – Get things from one computer to another, safely

github.com

Post reply on HN
Print view View original

131–140 of 192 posts

Re: Magic-Wormhole – Get things from one computer to another, safely

#131

Post by lotharrr »

falcolas wrote: post #79
lotharrr wrote: post #40

Earlier quoted context omitted.

If I did things right, the rendezvous server shouldn't get any advantage over a network attacker: one guess per invocation of the program, 1-out-of-65536 chance of getting it right, 65535-out-of-65536 chance of giving you a WrongPasswordError. FWIW, there's also a --verify option, which causes the program to print out a hex hash of the session key, and wait for you to approve it before sending anything. Not as ergono…

Call me a nerdy hipster, but I prefer my 1-in-2^256 chance with AES encryption. Then I can put it, well, anywhere. Including a thumb drive, google drive, S3, email, or even some random public newsgroup. I realize this complicates things a touch - you need a program to encrypt and decrypt the file - but that seems much more secure.

You also need to read the full AES key to your recipient. If you've already got a secure channel to your recipient, great: you can just paste them the key. But if you're sitting next to a new friend at a conference and want to throw them a copy of your secret file without worrying about who else might be able to see it in the future, you might want something more.. ergonomic :).

Re: Magic-Wormhole – Get things from one computer to another, safely

#132

Post by lotharrr »

falcolas wrote: post #82
lotharrr wrote: post #47

Earlier quoted context omitted.

The two sides exchange IP addresses (inside the encrypted channel), and try to connect to all of them. If that fails to produce a successful handshake, they fall back to a "Transit Relay Server" that I run. So they'll manage a direct connection if one of the machines has a public IP address, or if they're both on the same LAN. I'm hoping to add NAT/UPnP support, but it's not there yet.. still looking for an easy libr…

What happens when your transit server's bandwidth bill gets out of hand because someone is transferring a few TB of data to their backup host? (see article a few days back about someone griping about their 13 TB backups on Backblaze if you aren't sure this is a real thing)

It'll probably just break for the remainder of that month. I'm hosting that transit server on Linode, and I think (does anyone know for sure?) that their policy is to just turn off the interface if you go over your monthly allowance, which is like 4TB or 6TB on that instance.

Eventually I'm planning to have the client ask the transit server ahead of time for the size it intends to use, and the server can tell them to go away or make a donation or something.

"wormhole --transit-helper=tcp:HOST:PORT send" is how you can use a different server: the sender will tell the receiver about it in-band, so the receiver doesn't need to do anything special. The receiver accepts that argument too.

Re: Magic-Wormhole – Get things from one computer to another, safely

#134

Post by Piskvorrr »

pferde wrote: post #122
vbernat wrote: post #98

Earlier quoted context omitted.

It still needs to be authenticated. It could be replaced by an attacker public key.

This is a scenario where "the humans can speak to each other (directly) but the computers cannot". Key authenticity is not a problem, the other party can verify that the fingerprint is correct.

True, but have you actually tried to verify even a short SSH pubkey over a human communication channel? It can be done, but the horrible, horrible UX!

Re: Magic-Wormhole – Get things from one computer to another, safely

#136

Post by pveierland »

https://transfer.sh/ is another neat service which allows you to upload a file easily using a tool such as curl and get a shareable link. There was one time when I only had Chrome Remote Desktop access to a machine without root, where this was a convenient way to share some files.

  $ curl --upload-file ./hello.txt https://transfer.sh/hello.txt
  https://transfer.sh/66nb8/hello.txt

Re: Magic-Wormhole – Get things from one computer to another, safely

#137

Post by reacweb »

Piskvorrr wrote: post #128
reacweb wrote: post #123

When I want to give things, I use ssh to put it in the static part of my website in a directory with a random name, then I send the url by mail. My sftp client is already configured with ssh keys. When the things I have to send is a collection of jpeg files, I use fgallery.

"My sftp client is already configured with ssh keys." Well, one of the use cases is "how do you get the SSH pubkeys from here to there ?"

My point is that everybody should have a website somewhere (my C1 at cloudscale is 3.59€ per month). Everybody should have a ftp client configured to access it without hassles.

Re: Magic-Wormhole – Get things from one computer to another, safely

#138

Post by ubernostrum »

nailer wrote: post #121
hvnsweeting wrote: post #119

Earlier quoted context omitted.

This is true but not completely. You will only get pip when you install the binary downloaded from python.org. On osx, people use brew, on Debian, they use apt. It is most likely only Windows people will download those binaries but actually they use Anaconda, WinPython instead

Why are the packages removing pip?

Anaconda provides its own separate package-management world, so it makes sense that it doesn't include pip. But you can always still install it.

Re: Magic-Wormhole – Get things from one computer to another, safely

#139

Post by ubernostrum »

hvnsweeting wrote: post #119
ubernostrum wrote: post #91

Earlier quoted context omitted.

But pip isn't installed. It's been bundled with Python for years now, and even if you don't have it, it's easy to get: https://pip.pypa.io/en/latest/installing/

This is true but not completely. You will only get pip when you install the binary downloaded from python.org. On osx, people use brew, on Debian, they use apt. It is most likely only Windows people will download those binaries but actually they use Anaconda, WinPython instead

It's still very easy to install. And as of Python 3.4 it's even easier since you can 'python -m ensurepip'.

Re: Magic-Wormhole – Get things from one computer to another, safely

#140

Post by usernam »

pveierland wrote: post #136

https://transfer.sh/ is another neat service which allows you to upload a file easily using a tool such as curl and get a shareable link. There was one time when I only had Chrome Remote Desktop access to a machine without root, where this was a convenient way to share some files. $ curl --upload-file ./hello.txt https://transfer.sh/hello.txt https://transfer.sh/66nb8/hello.txt

In a similar vein[1], using the python client:

    $ dl-cli some/files
    https://dl.example.com/t=
additionally, the file is automatically cleared when it goes unused for a while. There is also FEX[2], which is geared more towards power-users and includes bi-directional transfers. Both are fully self-hosted and trivial to set-up.

[1] https://www.thregr.org/~wavexx/software/dl/ [2] https://fex.rus.uni-stuttgart.de/

Post reply on HN