Seems likely the use of the "Rendezvous" term is going to get you a cease-and-desist just like Apple got over what is now known as "Bonjour" (aka mDNS)
Magic-Wormhole – Get things from one computer to another, safely
171–180 of 192 posts
Re: Magic-Wormhole – Get things from one computer to another, safely
#172Seems likely the use of the "Rendezvous" term is going to get you a cease-and-desist just like Apple got over what is now known as "Bonjour" (aka mDNS) https://en.wikipedia.org/wiki/Bonjour_(software)
RNDZ, and RV are two well understood abbreviations :)
Re: Magic-Wormhole – Get things from one computer to another, safely
#173Earlier quoted context omitted.
You have no way to verify that the rendezvous server you're connecting to isn't playing the role of the client or server.
That doesn't make sense. The client needs the passcode to read the file, and that passcode is sent out of band. The Relay server can't simply "play the role of the client" and steal the file.
Of course, you're right. I was thinking the rendezvous server generated the key. Thanks for the correction.
Re: Magic-Wormhole – Get things from one computer to another, safely
#174Hey everyone! I just did a quick video on Magic Wormhole showing how it works: https://www.youtube.com/watch?v=1SXCLAlpD70
Re: Magic-Wormhole – Get things from one computer to another, safely
#175Cool, seems like AirDrop which I find very useful.
Re: Magic-Wormhole – Get things from one computer to another, safely
#176Anybody know how the author generated the word-list? I generated one for my own passphrase use; I took the 2000 most common english words and used metaphone to prune any similar sounding words, which got me down to around 600; I then truncated the list to 512 yielding 9 bits per word.
Re: Magic-Wormhole – Get things from one computer to another, safely
#177What's wrong with S/MIME? Email doesn't have to be unencrypted. Also, you only need to send the public part of an SSH key to the remote end to set up future keyed connections to that system. This seems like a solution with very narrow problems to solve.
Ok, I'll bite. From the project page: "Copying files through email first requires transcribing an email address in the opposite direction, and is even worse for secrets, because email is unencrypted. Copying files through encrypted email requires bootstrapping a GPG key as well as an email address." And S/MIME is essentially PGP/GPG, except you bootstrap the key from a central Certificate Authority. So yes, it's stil…
Since it's a public key, how about via unencrypted email?
Re: Magic-Wormhole – Get things from one computer to another, safely
#178Hey everyone! I just did a quick video on Magic Wormhole showing how it works: https://www.youtube.com/watch?v=1SXCLAlpD70
Re: Magic-Wormhole – Get things from one computer to another, safely
#179Earlier quoted context omitted.
Ok, I'll bite. From the project page: "Copying files through email first requires transcribing an email address in the opposite direction, and is even worse for secrets, because email is unencrypted. Copying files through encrypted email requires bootstrapping a GPG key as well as an email address." And S/MIME is essentially PGP/GPG, except you bootstrap the key from a central Certificate Authority. So yes, it's stil…
Since it's a public key, how about via unencrypted email?
Even then, the email would need to be signed and verified to ensure the key wasn't modified. You wouldn't want an attacker replacing it with their own public key.
Re: Magic-Wormhole – Get things from one computer to another, safely
#180Earlier quoted context omitted.
Since it's a public key, how about via unencrypted email?
Even then, the email would need to be signed and verified to ensure the key wasn't modified. You wouldn't want an attacker replacing it with their own public key.
But you would want tab completion of the shared secret so all an attacker needs is to guess the first character?
Why not email the ssh public key in plaintext and verify the md5sum, sha1sum, fingerprint, and / or first and last X characters of the key itself over the phone?
... or... Why not just put the public key on a web server with SSL and a free cert and speak the URL, then scp the payload file over? Or go ahead and get the free S/MIME cert from Comodo for your email since you can sign without the other end sending a signed email first and attach the payload file itself or an ssh public key and then scp? Or use Pidgin or a similar client with the OTR plugin on any XMPP server and send the payload file in the first place? Or issue SSL keys from your own local CA and communicate the fingerprint orally? Or send the public ssh key plaintext and only allow ssh through the firewall from the IP of your friend?
... or ... allow ssh via password rather than key for a small timeframe and communicate a password out of band rather than a shared secret for this thing?
... or ... put your ssh public key on a well-known account of yours like GitHub, Facebook, HN, etc and let your friend install it from there?