There have been plenty trusted battle tested open source implementations of WebRTC-based p2p transfer. Why would I use this one instead of them?
Could you please name these implementations?
Show HN: I built a website to share files and messages without any server
81–90 of 112 posts
Re: Show HN: I built a website to share files and messages without any server
#82Earlier quoted context omitted.
I mean the data people send through the app. You say: > It is a p2p files and messages sharing platform without involvement of any server. It has end-to-end encryption, ensuring your messages and files remain confidential. However the clients get the JS code from the web server. Since you control that server, you can change the code to disable the encryption, or send a copy of the messages somewhere else. You can eve…
Got you so you want to say that the place where I have hosted is a centralised place and yes you are right. But I won't do that ~~~
Ah yes, we should completely trust the anonymous person who registered to the site 23 days ago and has done nothing other than submit half a dozen chrome extensions to the site since then
Re: Show HN: I built a website to share files and messages without any server
#83TURN and P2P are incompatible things.
OP reply says they use STUN, not TURN.
Re: Show HN: I built a website to share files and messages without any server
#84You’ve done nothing but submit half a dozen random extensions in the 3 weeks that all collect different personal information on browsing history at a minimum. Your README’s look AI generated, and you’re a completely anonymous account. Additionally, your responses on how files are encrypted here is severely lacking.
All I can say is: There are a lot of red flags here.
Re: Show HN: I built a website to share files and messages without any server
#85Earlier quoted context omitted.
That is true, but unless you develop an application yourself, it is always coming from somewhere else. Web apps are better than native apps from a security perspective. Browsers have fairly decent built-in debugging tools that you could use to verify that data isn't being uploaded to a 3rd party. On the other hand, to do the same with a native application you would need to use a separate network protocol analyzer app…
> Web apps are better than native apps from a security perspective. This isn't true. Sure, they have less access to the host system, but verifying the integrity and authenticity of a web app is harder than that of a native app, where code signing is commonplace (not that code signing is a whole solution, but it's a great start). Extensions[0] exist to improve the situation but it's not yet broadly applicable. A compr…
1) For ~everyone, the authenticity check for an app is simply whether it exists on an app store. I think the only time I ever checked the signature on software outside the app store is for my bitcoin wallet.
2) Legit trusted applications are already what siphons everyone’s content, not malware. At least in the browser there’s uBlock Origin and even a dev console.
Just some things to keep in mind when comparing the differences.
Re: Show HN: I built a website to share files and messages without any server
#86Earlier quoted context omitted.
The signature doesn't mean much on the mobile store though, Apple and Google could modify anything they want, resign it and push a new app. With the web you have to trust the app developer and with mobile you have to trust the app developer plus Google or Apple on top of that. Fdroid is maybe the only exception to that.
With web you have to trust the developer on every visit of the website. With mobile you can pin the trust (with some effort) to a single point in time, big positive difference
I'm not aware of any major mobile platform which works like that though, maybe in theory it could be done but in practice it's all powers to the manufacturer which can modify or remove your apps at any time silently.
Unless maybe you are on some things like GrapheneOS and only install apps though fdroid, that's not really a mainstream configuration though.
Re: Show HN: I built a website to share files and messages without any server
#87Earlier quoted context omitted.
Telegram is not end to end encrypted, and thus not suitable for such uses due to insecurity.
Telegram has cloud encryption via MTProto 2.0. The servers use a distributed key generation mechanism.
Cloud encryption is just HTTPs + encryption at rest (only claimed, not verified).
They hold the keys, irrespective of how many proprietary protocols they wrap over the message.
A great product tho! I used saved messages extensively!
Re: Show HN: I built a website to share files and messages without any server
#88There have been plenty trusted battle tested open source implementations of WebRTC-based p2p transfer. Why would I use this one instead of them?
Could you please name these implementations?
Re: Show HN: I built a website to share files and messages without any server
#89Earlier quoted context omitted.
> Web apps are better than native apps from a security perspective. This isn't true. Sure, they have less access to the host system, but verifying the integrity and authenticity of a web app is harder than that of a native app, where code signing is commonplace (not that code signing is a whole solution, but it's a great start). Extensions[0] exist to improve the situation but it's not yet broadly applicable. A compr…
1) For ~everyone, the authenticity check for an app is simply whether it exists on an app store. I think the only time I ever checked the signature on software outside the app store is for my bitcoin wallet. 2) Legit trusted applications are already what siphons everyone’s content, not malware. At least in the browser there’s uBlock Origin and even a dev console. Just some things to keep in mind when comparing the di…
Right, and your device knows it came from the app store because of code signing.
Re: Show HN: I built a website to share files and messages without any server
#90There have been plenty trusted battle tested open source implementations of WebRTC-based p2p transfer. Why would I use this one instead of them?
Could you please name these implementations?
Just a few that are both open source and have the hosted public versions available:
https://github.com/RobinLinus/snapdrop