Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: LANDrop – A cross-platform AirDrop-like file transfer tool

landrop.app

Post reply on HN
Print view View original

81–90 of 101 posts

Re: Show HN: LANDrop – A cross-platform AirDrop-like file transfer tool

#81

Post by yvbbrjdr »

opheliate wrote: post #79
yvbbrjdr wrote: post #64

Earlier quoted context omitted.

The reason I "rolled my own" key exchange is that I'd want to use the IETF variant of Chacha20-Poly1305 in my protocol and there doesn't seem to be helper functions for key exchange for this algo.

Unless I'm misunderstanding you, the crypto_secretstream construction [1] that I (and others) have recommended uses ChaCha20Poly1305-IETF as its symmetric cipher. There wouldn't be a key exchange for this algorithm, since it's symmetric. However, the crypto_kx functions [2] generate a 256 bit shared secret, which should work for a ChaCha20Poly1305 key I believe? 1: https://doc.libsodium.org/secret-key_cryptography/se…

Probably should have used higher-level functions. Maybe next time :). I don't think I can change the protocol and break compatibility at this time lol.

The crypto_kx functions seem to generate 2 symmetric keys for 2 directions. That creates complications in the code and that's why I didn't use it initially..

Re: Show HN: LANDrop – A cross-platform AirDrop-like file transfer tool

#82

Post by opheliate »

yvbbrjdr wrote: post #81
opheliate wrote: post #79

Earlier quoted context omitted.

Unless I'm misunderstanding you, the crypto_secretstream construction [1] that I (and others) have recommended uses ChaCha20Poly1305-IETF as its symmetric cipher. There wouldn't be a key exchange for this algorithm, since it's symmetric. However, the crypto_kx functions [2] generate a 256 bit shared secret, which should work for a ChaCha20Poly1305 key I believe? 1: https://doc.libsodium.org/secret-key_cryptography/se…

Probably should have used higher-level functions. Maybe next time :). I don't think I can change the protocol and break compatibility at this time lol. The crypto_kx functions seem to generate 2 symmetric keys for 2 directions. That creates complications in the code and that's why I didn't use it initially..

Yeahhh, that's a fair point about unnecessary complexity. The docs say if only one symmetric key is necessary, you can just set one of tx/rx to null, and the other will still be the requisite 256 bits, but I appreciate why that's a bit ugly.

Re: Show HN: LANDrop – A cross-platform AirDrop-like file transfer tool

#84

Post by [deleted] »

fulafel wrote: post #12

Glancing at your crypto implementation[1], it seems to contain newbie mistakes - eg no public key crypto involved in your public keys, usage of low level raw crypto algorithm primitives from libsodium without session, replay etc related security concerns, no signs of design requiremnts re what security guarantees it's trying to provide, no PK key management, etc. You're also hand rolling wire protocol code in C++, ma…

[deleted]

Re: Show HN: LANDrop – A cross-platform AirDrop-like file transfer tool

#85

Post by api »

eps wrote: post #22
fulafel wrote: post #12

Glancing at your crypto implementation[1], it seems to contain newbie mistakes - eg no public key crypto involved in your public keys, usage of low level raw crypto algorithm primitives from libsodium without session, replay etc related security concerns, no signs of design requiremnts re what security guarantees it's trying to provide, no PK key management, etc. You're also hand rolling wire protocol code in C++, ma…

If you feel like throwing "newbie" accusations around, it'd be prudent to back your list of grievances up with more than a single link to crypto.cpp. Chances are you misread the code, didn't grok what the op was doing, etc. As it stands your comment reads like a common variety abrasive and dismissive gatekeeping... rant, basically, which is unfortunately so popular in crypto circles. Edit - the project does dearly ne…

Crypto people: “programmers really need to get better at using crypto!”

Also crypto people: “how DARE ye mere mortal even touch crypto!!!”

This doesn’t help. The only people who will listen to “don’t roll your own crypto” are the very people who ought to be learning how to do it. The arrogant types who should never touch crypto will ignore this advice and still write bad crypto.

The most effective thing would be to just tell programmers why crypto is hard in ways other code is not.

Crypto is hard because you can’t simply unit test for vulnerabilities. “Anyone can write a crypto system they themselves can’t break.”

For the majority of code it’s good code if it works and is fast and lacks things like memory safety bugs.

For crypto it can work perfectly and still be grossly insecure. The only way to tell is to deeply understand cryptanalysis and do academic mathy stuff.

As a result if you use crypto it’s best to write boring conservative crypto and use it the way pro cryptographers suggest. Try to use a peer reviewed library or if you can’t and must implement then try to ape a peer reviewed library exactly.

Don’t even try to invent new stuff in crypto unless your understanding is very thorough and don’t use anything new without peer review.

Edit: another example of abnormally hard code is distributed databases. They can be unit tested but adequately doing so is extremely difficult. It’s easy to write one that seems to work but loses data at scale or under edge case failure scenarios. Crypto is even worse.

Re: Show HN: LANDrop – A cross-platform AirDrop-like file transfer tool

#86

Post by GekkePrutser »

yvbbrjdr wrote: post #76
GekkePrutser wrote: post #46

Some things I'm missing are: - Who is behind this? A company or is it completely free? - Is there any cloud service used? - What does the UI look like? And please fix the "celluar" spelling mistakes (in different places), it just makes it look less professional :)

- It's mainly me and some friends that does non-code stuff. No companies involved at this moment. - No cloud service is used. Your app doesn't connect to the Internet. See the privacy policy. - :) will post screenshots when I have time. Will fix the typo!

Ah cool, no company involvement makes it much more interesting to me. Because sooner or later they'll always want to monetise and that has privacy impacts generally.

I missed the internet part, sorry! It doesn't say so explicitly, just that the info is not collected. But how do the peers find each other then?

Re: Show HN: LANDrop – A cross-platform AirDrop-like file transfer tool

#87

Post by _1tan »

fulafel wrote: post #20
_1tan wrote: post #18

Earlier quoted context omitted.

Any pointers to good sources on crypto protocol design?

https://blog.cryptographyengineering.com/useful-cryptography... this link page is from 2012, but still pretty good.

Thank you

Re: Show HN: LANDrop – A cross-platform AirDrop-like file transfer tool

#88

Post by fulafel »

opheliate wrote: post #52
fulafel wrote: post #45

Earlier quoted context omitted.

Well, it's about 2 screefuls of very simple code. Eg for the PK part, if you ctrl-f for publicKey and remotePublicKey, you see there are no usages that could plausibly be doing public key crypto or PK key generation based on crypto 101 from school. Not sure how to respond about gatekeeping. What do you think would be a good way to write a comment pointing out these kinds of security problems? Or do you think it's unf…

I’m not sure what you mean by there being no public key cryptography here. In the Crypto constructor, a random secret key is generated, and then the generator for Curve25519 is scalar multiplied on the elliptic curve by this secret key to generate a public key. That’s the standard process for X25519 key generation, and it’s what Libsodium does to generate a secret key/public key pair [1]. To establish a shared secret…

I see. I stand corrected - apologies, @yvbbrjdr. Clearly my crypto 101 was too long ago! But my other points still stand I think.

Re: Show HN: LANDrop – A cross-platform AirDrop-like file transfer tool

#89

Post by mkl »

slim wrote: post #55
tjohns wrote: post #6

First off, this looks like a nice project. So please take this as constructive criticism: 1. This really should have screenshots published. Especially when comparing with something polished like AirDrop, the UX is important. You even call this out as one of the features, so it's really odd not seeing the screenshots to support that statement. 2. "Uses state-of-the-art cryptography algorithm" isn't very reassuring. It…

Re 3. This is from the repo under control of the author. What makes you think that you will be safer if the author submits the same apk to the google store?

Google does some vetting. Also, if the author doesn't get in first, someone else could put it in the store, claiming the name and making it hard for the author to update.

Re: Show HN: LANDrop – A cross-platform AirDrop-like file transfer tool

#90

Post by sgt »

yvbbrjdr wrote: post #67
AM1010101 wrote: post #48

Just tested out with my iPhone to Ubuntu 20.04. Works nicely with photos. Tried to sending some videos (iPhone to Linux) and some of them fail. A short 30 second video worked fine but longer 4 and 8 minute ones failed. Those longer videos may have also been stored on iCloud and not locally. Within the iOS app it doesn’t “select” the longer video files to be able to send them. Hope this helps. Nice tool and I can see…

Thx for your report! Yeah it's a known issue on iOS that it takes a long time to process videos.. especially long ones..

That could be due to having to download from iCloud if the video is not present on the device.
Post reply on HN