Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Lofi.cafe

lofi.cafe

Post reply on HN
Print view View original

221–230 of 237 posts

Re: Show HN: Lofi.cafe

#222

Post by cambaceres »

catlifeonmars wrote: post #214
ryanyl wrote: post #197

Earlier quoted context omitted.

Thanks for catching that! One thing I really wanted for the project was not having to sign in to use, but that's been causing a lot of security holes like this. Gonna try to fix everything soon

Out of curiosity, what are the motivation(s) for not requiring users to sign in? Is it just lowering the barrier to entry, or are you concerned with privacy? I’m curious to know how the solution would work.

If I would have been required to sign up, I would have closed the browser. Good choice!

Re: Show HN: Lofi.cafe

#223

Post by pfundstein »

ryanyl wrote: post #197
rnotaro wrote: post #196

Earlier quoted context omitted.

I love breaking things and I've noticed that user are able to intercept the UID / ID of the received messages in the Websocket and edit / spoof past messages from other users. edit: And editing other user names and rooms settings. Just letting you know. :)

Thanks for catching that! One thing I really wanted for the project was not having to sign in to use, but that's been causing a lot of security holes like this. Gonna try to fix everything soon

just tie it to the session cookie or a url identifier, no signup needed

Re: Show HN: Lofi.cafe

#226

Post by catlifeonmars »

rnotaro wrote: post #218
catlifeonmars wrote: post #214

Earlier quoted context omitted.

Out of curiosity, what are the motivation(s) for not requiring users to sign in? Is it just lowering the barrier to entry, or are you concerned with privacy? I’m curious to know how the solution would work.

I'm really not knowledgeable about firestore, firebase or even authentification systems but couldn't an user request a secret key that the user will use to authentificate itself when sending a message into the websocket (that will not be transmitted to the other users)? For the login-gate, I'm pretty sure 99%+ of the visitor would have not created an account. Even without the login, the HN room shared in that thread…

Yes you could generate a rsa key pair in the browser and send a tuple of user id (or just a nonce) and public key to the server as a form of automatic registration. The client could prefix each chat with the user if/nonce and sign it with the private key before sending it to the server. From then on the server could simply retrieve the public key it has associated with the user id prefix and reject any messages that fail signature validation.

This could also work in a peer-to-peer context by only using the server for public key registration (i.e. by chat room). All messages would go directly between clients and the server would never receive chat messages.

Re: Show HN: Lofi.cafe

#230

Post by linuz90 »

zelphirkalt wrote: post #12

Could the CPU load be reduced? If I am only on the page, not even playing any music yet (probably because something is blocked), I get 1 core up at 100% CPU load. This can't all be for an animated background image, can it?

Hey, just wanted to let you know I've just pushed a "low-energy" mode that will remove some elements and effects on screen. On my Mac (MBP with M1 chip) it makes the webview go from 40% CPU to around 10-15%.

You can activate it by pressing "l".

Post reply on HN