Croc: Easily and securely send things from one computer to another • Hacker News Board

Re: Croc: Easily and securely send things from one computer to another

#11

Post by LinuxBender » Sat, Sep 23, 2023, 2:21 AM UTC

johng wrote: post #4

Freedom2 wrote: post #2

I have a few qualms with this app. I've easily and securely sent things from one computer to another using a simple FTP server, with all of the features that croc has listed. As for CLI support, I've written a small helper tool that allows me to transfer via CLI - giving me more security since I don't pull in any dependencies in my own code.

Isn't FTP still plaintext?

Isn't FTP still plaintext?

It can be or it can be encrypted. FTPS(i|e) implements encryption over FTP. I prefer SFTP as it just uses one port which I can define. SFTP also works better through firewalls and NATs.

VSFTPD is an example of an FTP server that supports encryption or FTPS.

Re: Croc: Easily and securely send things from one computer to another

#12

Post by auxfil » Sat, Sep 23, 2023, 2:48 AM UTC

tptacek wrote: post #8

A more popular and, I think, carefully analyzed alternative, from which croc was inspired, is Magic Wormhole; a good Golang implementation that compiles down to a single binary is wormhole-william: https://github.com/psanford/wormhole-william/releases I believe croc has some features wormhole doesn't (and some anti-features, like being able to pick curves and hashes). But also just that it's worth knowing that Magic…

What does "carefully analyzed" mean in this context? Who analyzed it?

Re: Croc: Easily and securely send things from one computer to another

#13

Post by auxfil » Sat, Sep 23, 2023, 2:49 AM UTC

jdironman wrote: post #10

jdironman wrote: post #9

I am having a hard time understanding. Does this allow you to send / receive anywhere? Across the internet I mean. what external server does it use for 'stapling' the connection or is it also expected that you self host a relay server + set up the necessary ports etc. Do both ends require a relay server?

>I am having a hard time understanding. Does this allow you to send / receive anywhere? Across the internet I mean. what external server does it use for 'stapling' the connection or is it also expected that you self host a relay server + set up the necessary ports etc. Do both ends require a relay server? Sorry, I have spoke too soon. I see now it uses a public relay by default, and you can self host as needed. Sorry…

[dead]

Re: Croc: Easily and securely send things from one computer to another

#14

Post by gregschlom » Sat, Sep 23, 2023, 2:50 AM UTC

Haven't tried this but I recently started using syncthing.net and I highly recommend it.

Like rsync, it only sends the chunks of the file that changed, so it can be extremely fast for small changes in large files. It's able to use a variety of methods to connect including good through relay servers if the machines can't directly talk to each other.

Re: Croc: Easily and securely send things from one computer to another

#15

Post by carterschonwald » Sat, Sep 23, 2023, 2:55 AM UTC

So one thing is that this by default uses a specific public relay server to setup the handshake. So there’s a little mitm by default.

Re: Croc: Easily and securely send things from one computer to another

#16

Post by cphoover » Sat, Sep 23, 2023, 3:05 AM UTC

tptacek wrote: post #8

A more popular and, I think, carefully analyzed alternative, from which croc was inspired, is Magic Wormhole; a good Golang implementation that compiles down to a single binary is wormhole-william: https://github.com/psanford/wormhole-william/releases I believe croc has some features wormhole doesn't (and some anti-features, like being able to pick curves and hashes). But also just that it's worth knowing that Magic…

There is also https://wormhole.app

Which looking at your link I guess is unrelated

Re: Croc: Easily and securely send things from one computer to another

#17

Post by mc10 » Sat, Sep 23, 2023, 3:07 AM UTC

carterschonwald wrote: post #15

So one thing is that this by default uses a specific public relay server to setup the handshake. So there’s a little mitm by default.

magic-wormhole (which croc was inspired by) also uses a public relay server: https://magic-wormhole.readthedocs.io/en/latest/welcome.html...

Any tool that wants to reliably connect two clients P2P is going to need something like a TURN server to traverse restrictive NATs. See for instance Tailscale's use of DERP servers: https://tailscale.com/blog/how-tailscale-works/#encrypted-tc...

Re: Croc: Easily and securely send things from one computer to another

#18

Post by mc10 » Sat, Sep 23, 2023, 3:09 AM UTC

cphoover wrote: post #16

tptacek wrote: post #8

A more popular and, I think, carefully analyzed alternative, from which croc was inspired, is Magic Wormhole; a good Golang implementation that compiles down to a single binary is wormhole-william: https://github.com/psanford/wormhole-william/releases I believe croc has some features wormhole doesn't (and some anti-features, like being able to pick curves and hashes). But also just that it's worth knowing that Magic…

There is also https://wormhole.app Which looking at your link I guess is unrelated

This looks very different; it requires having a server to temporarily store the file, while croc and magic-wormhole directly connect two peers (via a relayer) to send the file.

Re: Croc: Easily and securely send things from one computer to another

#19

Post by ajot » Sat, Sep 23, 2023, 3:15 AM UTC

rajamaka wrote: post #7

Freedom2 wrote: post #2

I have a few qualms with this app. I've easily and securely sent things from one computer to another using a simple FTP server, with all of the features that croc has listed. As for CLI support, I've written a small helper tool that allows me to transfer via CLI - giving me more security since I don't pull in any dependencies in my own code.

Your qualm with the app is that you like FTP?

Why would anyone use Dropbox?

Re: Croc: Easily and securely send things from one computer to another

#20

Post by rurcliped » Sat, Sep 23, 2023, 3:17 AM UTC

a recent audit claims the author "doesn't have enough resources to address" security issues: https://www.openwall.com/lists/oss-security/2023/09/08/2 https://github.com/schollz/croc/issues/594 etc.