Live data from Hacker News

Show HN: Share It, Anonymously with Self Destruct Messages

pastenow.me

31–40 of 68 posts

Re: Show HN: Share It, Anonymously with Self Destruct Messages

#31
post #12

I never really got the point of (digital) self destructing messages, since the reader can easily just copy the text/data, i.e. destruct only means not available anymore after future point in time. So you're just relying on the receiver of the message to follow protocol -- as always.

Current reader and future reader are different people. Spouses get divorced, business partners fall out, friends lose touch, etc.

There is also value in a message that the reader would have to knowingly and immediately violate the writer's trust in order to keep.

Re: Show HN: Share It, Anonymously with Self Destruct Messages

#32
post #26
post #24

for the longest time we had issues with people pasting passwords in slack to share them within the org. one hackathon later we had a one time secret sharing slash command (which you can only reveal the message once and is then lost/deleted). self-hosted. it's the thing i'm asked most about if it was OSS after i left the company (by other ex-colleagues looking to have the same thing elsewhere).

That’s a great product by the way. Feels like a Freemium model based on number of unique users could be pretty effective.

yeah, was thinking about rebuilding it as OSS just now.

the biggest problem is that a security-minded org is going to want control over the server storing their secret messages (otherwise, you're literally giving away which org you are (slackbots get your org id) and your deepest secrets to a third party)

to self-host, i think the slash command setup is more complicated/annoying. but i will look in to it again.

edit: and you can't really do E2E encryption with slack as a middleman to your API

Re: Show HN: Share It, Anonymously with Self Destruct Messages

#33

Taking advantage of this post to ask about this -- can anyone explain to me why Signal can't be implemented as a completely offline-first/PWA web-app. If we throw away the more advanced requirements of perfect forward secrecy, non repudiation, ratcheting for groups, non repudiation, why is it a bad idea to get 80% of the way there with basic offline-first/WPA (+/- secure enclave, WebAuthN, whatever else) messages tha…

I don't get it. Why would a messaging app be offline? Do you mean you could send out messages even while you're offline, and the app would wait until it has a connection and send those messages out immediately?

[deleted]

Re: Show HN: Share It, Anonymously with Self Destruct Messages

#34

Taking advantage of this post to ask about this -- can anyone explain to me why Signal can't be implemented as a completely offline-first/PWA web-app. If we throw away the more advanced requirements of perfect forward secrecy, non repudiation, ratcheting for groups, non repudiation, why is it a bad idea to get 80% of the way there with basic offline-first/WPA (+/- secure enclave, WebAuthN, whatever else) messages tha…

> can anyone explain to me why Signal can't be implemented as a completely offline web-app

It's a messaging app. What's the point of a messaging app if you're never connected to anyone else to message them?

Re: Show HN: Share It, Anonymously with Self Destruct Messages

#35

Taking advantage of this post to ask about this -- can anyone explain to me why Signal can't be implemented as a completely offline-first/PWA web-app. If we throw away the more advanced requirements of perfect forward secrecy, non repudiation, ratcheting for groups, non repudiation, why is it a bad idea to get 80% of the way there with basic offline-first/WPA (+/- secure enclave, WebAuthN, whatever else) messages tha…

The problem with web apps is that doing timing sensitive stuff such as encryption and decryption in javascript is risky and difficult. Javascript also takes a serious toll on performance and battery life.

I'm assuming "completely offline" means that it still sends some data somewhere, otherwise the messenger wouldn't make any sense.

I don't really understand the need for it to be a web app other than developer convenience. Electron and friends are a solution to the problem "I don't want to write Qt code", but a good platform for applications they are not.

Adding encryption (proper encryption) to the Telegram client would net you a fully native experience that works cross-platform without issues. Going native also allows you access to stuff like TPMs, although you can assume most desktop machines still don't have them. You also have much more control over the security properties of the code if you stick to native code.

The folks over at Matrix are experimenting with running their Matrix servers in a peer to peer configuration on the device itself. Stuff that server into a cross platform client like Fluffychat or Element and you've got yourself a chat app with federation and cross platform chat support without relying on any specific server.

If you want to stick to a browser only solution, I'm not entirely sure how you'd go about making that talk to other clients. IPFS requires access to a third party gateway, as do most peer to peer solutions. I think you can make WebRTC work as a means of full P2P through a DHT but I'm not entirely sure how.

The problem with a simple, offline, encrypted chat client is that it's not simple. Security is very hard; if you're willing to give that up, there's plenty of IRC web clients for you to choose from. If you've got any good ideas on how to build this, I encourage you to work it out and make a proof of concept, because it sounds like it could be very useful.

Re: Show HN: Share It, Anonymously with Self Destruct Messages

#36
post #27

I ll be honest here: I litreally did this because i was getting tired of not being able to find a platform where i can be confident that: Yes, from an end to end there is no middleman snooping etc. I ll publish the code on github too. The idea is that on every startup, system generates a new keys to encrypt data. This site is hosted on a single docker instance and there is no output (logs etc) for now. I dont intend…

well now you have your platform where you can be confident that no one is snooping but if anyone else would like to use one too, they would have to make it themselves (or deploy your source code when you publish them)

Re: Show HN: Share It, Anonymously with Self Destruct Messages

#37

Taking advantage of this post to ask about this -- can anyone explain to me why Signal can't be implemented as a completely offline-first/PWA web-app. If we throw away the more advanced requirements of perfect forward secrecy, non repudiation, ratcheting for groups, non repudiation, why is it a bad idea to get 80% of the way there with basic offline-first/WPA (+/- secure enclave, WebAuthN, whatever else) messages tha…

I don't get it. Why would a messaging app be offline? Do you mean you could send out messages even while you're offline, and the app would wait until it has a connection and send those messages out immediately?

Sorry the offline there is "offline-first", you need offline-first (AKA modern PWA type technology/architecture) for websites to work well in patchy internet/etc. The "offline-first" phrase/terminology is well known in frontend circles but maybe not as widely as I thought.

Generally offline-first/PWAs can be made "installable" by setting metadata on the page that hosts them and doing other things.

Re: Show HN: Share It, Anonymously with Self Destruct Messages

#38
post #21
post #2

Hi, normally i dont post at all. But this is my attempt to share pieces of information anonymously that expires in a certain time. Site is made in Angular and and the backend is a simple thread safe dictionary that resets every 24 hours. It is by no means a commercial solution to any problem. This is something i came up with half an hour of dev work, coz i could not find anything similar.

Since this is your own project, 'Show HN' [0] would be more appropriate. [0] https://news.ycombinator.com/showhn.html

Agreed, how do i edit this

Re: Show HN: Share It, Anonymously with Self Destruct Messages

#39
post #2

Hi, normally i dont post at all. But this is my attempt to share pieces of information anonymously that expires in a certain time. Site is made in Angular and and the backend is a simple thread safe dictionary that resets every 24 hours. It is by no means a commercial solution to any problem. This is something i came up with half an hour of dev work, coz i could not find anything similar.

Just fyi, going to „ https://pastenow.xn--me-x2t without the „www“ just gets me to a „Hi“ page without any content.

Sorry. as i said, i just did it in little time with only www mappings.

Re: Show HN: Share It, Anonymously with Self Destruct Messages

#40
post #25
post #3

Earlier quoted context omitted.

It looks very good for something whipped up in an hour. Did you consider using Redis as a data store for this? Seems like it would be quite easy to just generate a UUID as a key and set it with an expire time in redis. If you did consider Redis, any reason why you didn't end up using it?

If you want privacy and anonymity, be careful about how you're generating your UUID. Some flavors of UUID are just the MAC address, process ID, and timestamp, which makes them trivially guessable (and poorly scalable). Instead of a UUID, just read 16 bytes from /dev/urandom (getentropy() if you've got it). Base85 or Base64 encode the bytes if you need a string.

Any resource about this?

Someone mentioned it before and it seems false. UUIDS are made to scale and i think it's mostly about a lack of understanding of UUIDS.

Eg. some versions of UUIDS are meant to be deterministic, some for sortability, ...

https://en.m.wikipedia.org/wiki/Universally_unique_identifie...

Post reply on HN