Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: ShadowCat – file transfer through QR Codes in a Browser

github.com

Post reply on HN
Print view View original

11–20 of 74 posts

Re: Show HN: ShadowCat – file transfer through QR Codes in a Browser

#11

Post by MattCruikshank »

I've wanted to use this for an air-gapped communication device.

I have a device with a camera and a touch-screen that only uses capacitive charging. I type a message. Bytes are encrypted. I hit send. QR codes flash on my screen. I use my PC or my normal phone to receive the encrypted bytes, and transmit them to you. You have the same device. You have your PC or phone flash encrypted QR codes. You use your device to receive, and then decrypt.

I've daydreamed about also buying several different hardware random noise generators. XOR all of their bits together. Save a huge one time pad to each of our devices. And then also use public key crypto on top of it.

I'm not really sure why I want this. But, it's my answer for how to reduce attack surface as much as possible, and have truly secret messages.

Re: Show HN: ShadowCat – file transfer through QR Codes in a Browser

#13

Post by thedougd »

I've done this exact approach before. It's a good way to exfiltrate data. Post the software on GitHub pages, or a popular CDN that co-hosts other shared libraries and you've got a very difficult to block method.

Really goes to show that it's very difficult to stop a motivated and informed actor.

Re: Show HN: ShadowCat – file transfer through QR Codes in a Browser

#14

Post by hootz »

xnx wrote: post #9
hootz wrote: post #4

I love this type of stuff. Some years ago I did something similar, but instead of QR Codes it used a convoluted mess of audio frequency modulation to send data through sound between devices. This is much more practical if you have two cameras.

> a convoluted mess of audio frequency modulation Like a modem

I guess lmao, but much more rudimentary, less reliable and with loads of issues, as it had to blast piercing sounds through a speaker and then capture those with a microphone. But it was pretty cool when it worked!

Re: Show HN: ShadowCat – file transfer through QR Codes in a Browser

#16

Post by skinfaxi »

MattCruikshank wrote: post #11

I've wanted to use this for an air-gapped communication device. I have a device with a camera and a touch-screen that only uses capacitive charging. I type a message. Bytes are encrypted. I hit send. QR codes flash on my screen. I use my PC or my normal phone to receive the encrypted bytes, and transmit them to you. You have the same device. You have your PC or phone flash encrypted QR codes. You use your device to r…

> I have a device with a camera and a touch-screen that only uses capacitive charging. I type a message. Bytes are encrypted. I hit send. QR codes flash on my screen. I use my PC or my normal phone to receive the encrypted bytes, and transmit them to you. You have the same device.

Why do you need a separate device for this and not just an airgapped computer?

Re: Show HN: ShadowCat – file transfer through QR Codes in a Browser

#17

Post by skinfaxi »

thedougd wrote: post #13

I've done this exact approach before. It's a good way to exfiltrate data. Post the software on GitHub pages, or a popular CDN that co-hosts other shared libraries and you've got a very difficult to block method. Really goes to show that it's very difficult to stop a motivated and informed actor.

If you can connect to Github pages couldn't you exfil that way? This takes 2 mins for 100KB.

Re: Show HN: ShadowCat – file transfer through QR Codes in a Browser

#18

Post by skinfaxi »

hootz wrote: post #14
xnx wrote: post #9

Earlier quoted context omitted.

> a convoluted mess of audio frequency modulation Like a modem

I guess lmao, but much more rudimentary, less reliable and with loads of issues, as it had to blast piercing sounds through a speaker and then capture those with a microphone. But it was pretty cool when it worked!

Did you explore using frequencies outside the range of human hearing?

Re: Show HN: ShadowCat – file transfer through QR Codes in a Browser

#19

Post by MattCruikshank »

skinfaxi wrote: post #16
MattCruikshank wrote: post #11

I've wanted to use this for an air-gapped communication device. I have a device with a camera and a touch-screen that only uses capacitive charging. I type a message. Bytes are encrypted. I hit send. QR codes flash on my screen. I use my PC or my normal phone to receive the encrypted bytes, and transmit them to you. You have the same device. You have your PC or phone flash encrypted QR codes. You use your device to r…

> I have a device with a camera and a touch-screen that only uses capacitive charging. I type a message. Bytes are encrypted. I hit send. QR codes flash on my screen. I use my PC or my normal phone to receive the encrypted bytes, and transmit them to you. You have the same device. Why do you need a separate device for this and not just an airgapped computer?

Me, in my life, I have a PC that's connected to the internet. I have a phone that's connected to the internet.

I want another device, which I imagine to be a Pi or Esp32 or something with a camera and a touchscreen display, and capacitive charging. After I program it and give it the public/private keypair and the OTP, I imagine physically breaking off a USB port, or sealing one with some hardening resin.

I don't want an entire airgapped computer. Maybe you do, that's fine. For me, I'd love it to be a credit-card sized doodad.

Re: Show HN: ShadowCat – file transfer through QR Codes in a Browser

#20

Post by hootz »

skinfaxi wrote: post #18
hootz wrote: post #14

Earlier quoted context omitted.

I guess lmao, but much more rudimentary, less reliable and with loads of issues, as it had to blast piercing sounds through a speaker and then capture those with a microphone. But it was pretty cool when it worked!

Did you explore using frequencies outside the range of human hearing?

No, but that's a cool idea. I think the main problem is that consumer hardware usually gets kinda inconsistent outside our hearing range.
Post reply on HN