Live data from Hacker News

Magic Wormhole: Get things from one computer to another, safely

magic-wormhole.readthedocs.io

11–20 of 107 posts

Re: Magic Wormhole: Get things from one computer to another, safely

#11
I use magic wormhole when I first install a computer to send an SSH key. At that point, I have ssh. Also if you use a mesh VPN, your devices are already connected and there are several ways to transfer files.

I like to use it more. What is your use case for this?

BTW, I haven’t found a good iOS app.

Re: Magic Wormhole: Get things from one computer to another, safely

#12
post #6

AFAIK, Web Wormhole is the only one of those tools that can be used both as a command-line tool and from a browser. It looks like the site is down at the moment though. https://github.com/saljam/webwormhole https://webwormhole.io/

The website doesn’t work on my phone.

Re: Magic Wormhole: Get things from one computer to another, safely

#13
I prefer https://localsend.org/ nowadays. Nice cross-platform GUI, "just works". Requires being on the same lan, but discovery of other devices is automatic and there are no alphanumeric codes that have to be shared. It's a good QoL improvement to have "airdrop" between Android and Linux

Re: Magic Wormhole: Get things from one computer to another, safely

#14
This project made me learn about and attempt to implement the SPAKE2 protocol and HKDF as an exercise. It's quite fascinating. It lets you upgrade a short password to a long key, but requires trusting a server to rate limit attempts on brute-forcing that short password. It seems difficult to find a practical use case for it tho. Because it's only relevant when it is impractical to send a long key. But if you think for a second, lets say you are transferring from a desktop to a phone, you can show a QR code and scan in with your phones camera, thus achieving a secure handshake bypassing the need for SPAKE2 all together. Maybe it would defeat the simplicity of the tool, but if it also provided a long string of words for the key, a user could optionally send all the words instead of just the first few and get themselves a secure key without needing to trust the server.

Re: Magic Wormhole: Get things from one computer to another, safely

#15
post #4

A simple encrypted channel for file transfer. A great way to send a file to a stranger who is near you but shares nothing with you, e.g. at a conference. /* A modern version should, of course, work in a browser, so that there'd be no Python packages to install. But the browser security model does not allow listening, so a signaling server would be needed to create a WebRTC connection. It could run on one of the devic…

They don't have to be near you, they can be over the internet. Relatedly, the Magic Wormhole CLI also depends on a signaling server (referred to in the documentation as the "mailbox"), so I don't think it's doing anything you couldn't do with WebRTC.

Re: Magic Wormhole: Get things from one computer to another, safely

#16
post #14

This project made me learn about and attempt to implement the SPAKE2 protocol and HKDF as an exercise. It's quite fascinating. It lets you upgrade a short password to a long key, but requires trusting a server to rate limit attempts on brute-forcing that short password. It seems difficult to find a practical use case for it tho. Because it's only relevant when it is impractical to send a long key. But if you think fo…

I was reading about MW yesterday and had the same question about the short password. Here's a doc I found about it: https://magic-wormhole.readthedocs.io/en/latest/attacks.html...

Re: Magic Wormhole: Get things from one computer to another, safely

#17
post #4

A simple encrypted channel for file transfer. A great way to send a file to a stranger who is near you but shares nothing with you, e.g. at a conference. /* A modern version should, of course, work in a browser, so that there'd be no Python packages to install. But the browser security model does not allow listening, so a signaling server would be needed to create a WebRTC connection. It could run on one of the devic…

They don't have to be near you, they can be over the internet. Relatedly, the Magic Wormhole CLI also depends on a signaling server (referred to in the documentation as the "mailbox"), so I don't think it's doing anything you couldn't do with WebRTC.

"Near you" physically only matters in coordination, not the network. I can beside someone and it will still go towers and space before we establish a connection.

Re: Magic Wormhole: Get things from one computer to another, safely

#18
post #6

AFAIK, Web Wormhole is the only one of those tools that can be used both as a command-line tool and from a browser. It looks like the site is down at the moment though. https://github.com/saljam/webwormhole https://webwormhole.io/

Their TURN and STUN servers are down too.

Re: Magic Wormhole: Get things from one computer to another, safely

#19
post #11

I use magic wormhole when I first install a computer to send an SSH key. At that point, I have ssh. Also if you use a mesh VPN, your devices are already connected and there are several ways to transfer files. I like to use it more. What is your use case for this? BTW, I haven’t found a good iOS app.

I think you should create a new ssh key for every computer so you only have to share the public key .
Post reply on HN