Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Darkwire.io – instant encrypted web chat (Socket.io and Web Crypto API)

darkwire.io

Post reply on HN
Print view View original

21–30 of 48 posts

Re: Show HN: Darkwire.io – instant encrypted web chat (Socket.io and Web Crypto API)

#21

Post by zaarn »

rqs wrote: post #18
zaarn wrote: post #13

Earlier quoted context omitted.

What you describe is MtE (Mac Then Encrypt), which is generally not recommended because you have to decrypt ciphertext before you can check the MAC. This can lead to various timing or padding oracle vulnerabilities. The recommended, more safer and sturdier method is EtM (Encrypt then MAC), in which you encrypt the plaintext then MAC the ciphertext. This way you can verify the cipher before you operate on it. EtM is […

I implemented a protocol that uses MtE on a CFB mode cipher. And that's why I asked that question. Now, it seems like I may did it horribly wrong, I'm going to fix it right now. Thank you! EDIT: After I read an answer[0] on StackExchange, I realized I maybe did it right (Because of the CFB mode is different than CBC). Looks like I need to learn a whole lot more before start that fixing. Next time I'll just use GCM an…

MtE isn't the worst choice, I've seen way worse.

The best I can recommend is to take NaCl and then just using secret box. That picks the good defaults for you. Anything after that needs some research as even seemingly harmless naive implementations can ruin the entire cryptography of a program.

Re: Show HN: Darkwire.io – instant encrypted web chat (Socket.io and Web Crypto API)

#23

Post by lawl »

marknadal wrote: post #19
gurgus wrote: post #11

Earlier quoted context omitted.

> - Signal and Whatsapp, as others have pointed out, are far from being comfortable as being private (they already know too much, phone number, etc.), and don't have the convenience of a browser based app. Whatsapp does have a browser based app. web.whatsapp.com

I get a "download the app to scan QR code and login" wall / lock-out. This wouldn't count as being browser-based!

This is because the private key to en/decrypt messages never leaves your phone. So the 'browser based' version still routes messages to your phone first (to presumably re-encrypt them with a different key that you got from scanning that QR code).

You can argue semantics if that counts as browser based or not, but I think that's actually a pretty sane way to to things, security wise.

Re: Show HN: Darkwire.io – instant encrypted web chat (Socket.io and Web Crypto API)

#24

Post by alanfriedman »

guy98238710 wrote: post #17

How does it differ from wire.com in terms of privacy? Besides, wouldn't you have to transfer the chatroom name over another chat service since it changes all the time and users have no identity of their own?

Darkwire is more for ephemeral chat rooms, where the name doesn't change as long as the room is occupied. We also don't require sign up, so you can use it instantly and anonymously.

Re: Show HN: Darkwire.io – instant encrypted web chat (Socket.io and Web Crypto API)

#26

Post by alanfriedman »

Ros2 wrote: post #2

Neat app, but curious why you aren't using WebRTC p2p? I've always thought something like this using WebRTC + a (simple) way to independently check that no data is being sent elsewhere would be really cool. Btw you could declare a content security policy for just your site since you don't load anything off domain https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP Good luck!

Thanks! We actually need the server intermediary to handle storing and locking rooms, and adding and removing members. Also IIRC WebRTC data channel doesn't have great cross browser support.

Re: Show HN: Darkwire.io – instant encrypted web chat (Socket.io and Web Crypto API)

#28

Post by 0xJRS »

sleavey wrote: post #22

The name makes it sound dodgy: "dark" reminds me of "dark web" and all the negative connotations. Not great for trustworthiness which is especially important for crypto.

I'm assuming their target market is people who have the opposite feeling when reminded of "dark web"

Re: Show HN: Darkwire.io – instant encrypted web chat (Socket.io and Web Crypto API)

#29

Post by kirillseva »

kuceram wrote: post #9
Veratyr wrote: post #5

Earlier quoted context omitted.

Those implementations both require phone numbers and registration through a mobile app (hence lack anonymity) and are useless for many use cases. I think Matrix (Riot) would be a better choice. It's e2e encrypted like Signal but doesn't have any nonsense reliance on phones or phone numbers. It also has extra features like true multiple device support, a federated protocol and an open server implementation.

And what is the use-case for this? I probably somehow miss it.

same reason you would host a gitlab or github enterprise instance instead of using github.com, only this time applied to encrypted messaging
Post reply on HN