Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: I built a website to share files and messages without any server

neighbor-share.vercel.app

Post reply on HN
Print view View original

101–110 of 112 posts

Re: Show HN: I built a website to share files and messages without any server

#101

Post by eviks »

realusername wrote: post #100
eviks wrote: post #99

Earlier quoted context omitted.

Your explanation confuses the store with the device .Yes, at the time of download from the store you trust two parties, but that's still only "a single point in time"

No it's anytime you use your device. The stores can push silent updates and change your apps or access anything at any point. The only exception I'm aware of is GrapheneOS where that's not possible. Otherwise if you are using iOS or any other Android rom than GrapheneOS, you are vulnerable to that.

Do you have a source for the silent remote app install for iOS by Apple, only heard of a remote disabling (but not removal) of an app there?

Though even in that case the dev can't do that, so your trust is :

web: dev every time you load an app

native: dev once you install an app, OS vendor any time

Re: Show HN: I built a website to share files and messages without any server

#104

Post by stevenicr »

d-z-m wrote: post #64
dkraj wrote: post #29

Earlier quoted context omitted.

WebRTC it is: https://webrtc.org/ Yes only the network layer encryption. No file encryption as it will cost client browsers a lot in case of encrypting and then decrypting that at other end. I have written more about it here: https://dikshantraj2001.medium.com/nat-stun-turn-and-ice-466... Currently, I am using the public STUN servers only. If the IPs are not reachable, it would show an error and won't work as setting…

Ideally I would not have to trust the signalling server to ensure I'm transferring files to who I think I am[0]. Not as much of a knock against your project as a knock against webRTC in general. [0]: https://webrtchacks.com/webrtc-and-man-in-the-middle-attacks...

Has anyone considered a passphrase that splits into three words, where the middle server can decrypt one word and deliver a word and get a response then provide the whole phrase three words to prove it is the messenger that Bob sent?

Or something like that?

Re: Show HN: I built a website to share files and messages without any server

#105

Post by dkraj »

Retr0id wrote: post #59
dkraj wrote: post #46

Earlier quoted context omitted.

Sorry I missed it. but can you elaborate on compare please

What makes it different? (I'd personally like to know the details of how the cryptography works)

In terms of differentiation, I have not explored much solutions available out there so can not comment much on that. About the encryption part, WebRTC communications over browsers are encrypted using Datagram Transport Layer Security (DTLS). All WebRTC sessions are encrypted.

You can found more in depth details in this article: https://telnyx.com/resources/webrtc-encryption-and-security

And sorry for not replying I was not on the platform lately

Re: Show HN: I built a website to share files and messages without any server

#106

Post by dkraj »

scrose wrote: post #84

You’ve done nothing but submit half a dozen random extensions in the 3 weeks that all collect different personal information on browsing history at a minimum. Your README’s look AI generated, and you’re a completely anonymous account. Additionally, your responses on how files are encrypted here is severely lacking. All I can say is: There are a lot of red flags here.

Yes you are absolutely right. I had replied on other threads. Files are not encrypted. WebRTC provides encryption on all sessions

Re: Show HN: I built a website to share files and messages without any server

#107

Post by dkraj »

meiraleal wrote: post #16
d-z-m wrote: post #8

I looked around and couldn't find a description of the protocol by which two peers authenticate to each other/transfer files. Also, is the E2EE encryption referred to simply whatever is being used to encrypt the transport(DTLS/SRTP/etc)? or are you doing additional encryption/decryption of files? Also I'm curious like others, does this only work if no nat traversal is required? or are you leveraging public stun/turn…

It's webrtc, no?

yes it is using webRTC. will open source the repo soon. BTW there are all information about it in different threads

Re: Show HN: I built a website to share files and messages without any server

#110

Post by dkraj »

siamese_puff wrote: post #58

No offense, but why would people use this without associated source code for anyone to scrutinize? Why keep it private? WebRTC based tools like this exist so it’s only a red flag IMO to keep it private.

Had open sourced it. You can check it at: https://github.com/dikshantrajput/neighborHoodShare
Post reply on HN