Bonchat - client-side encrypted web chat for the truly paranoid
1–10 of 51 posts
Re: Bonchat - client-side encrypted web chat for the truly paranoid
#2For any HN crypto nerds: I made a little web chat that even the server can't read.
Besides boring old SSL, bonchat.org uses a javascript implementation of AES to encrypt chat client-to-client. There are no cookies, no sessions, and no account registration. You never even send your password or plaintext username to the server.
If you chat with someone who knows the same password, you get a simple HTML/Markdown web chat. If you chat with someone using a different password you get gibberish. That's it. :)
It has a number of glaring flaws and no marketability, but by golly it's secure!
Re: Bonchat - client-side encrypted web chat for the truly paranoid
#3I'm having troubles with it in Firefox on two different Ubuntu machines. The page is all red, and the javascript source code is showing up inside the web page.
Then I tested it in the Epiphany web browser. It worked fine on one Ubuntu machine, showing up all nice and blue. But on the other Ubuntu machine I got the red page with the javascript source code showing up, just like Firefox.
Re: Bonchat - client-side encrypted web chat for the truly paranoid
#4For any HN crypto nerds: I made a little web chat that even the server can't read. Besides boring old SSL, bonchat.org uses a javascript implementation of AES to encrypt chat client-to-client. There are no cookies, no sessions, and no account registration. You never even send your password or plaintext username to the server. If you chat with someone who knows the same password, you get a simple HTML/Markdown web cha…
"It has a number of glaring flaws and no marketability, but by golly it's secure!"
Everything has a market. Some things just have a very, very narrow market :)
In seriousness though, in its current form it may not be that appealing but the idea probably has merit to some.
Re: Bonchat - client-side encrypted web chat for the truly paranoid
#5It seems broken for me; if I go to the url, bonchat treats it like a new chat each time, prompting for a password and my name.
Re: Bonchat - client-side encrypted web chat for the truly paranoid
#6I'm having troubles with it in Firefox on two different Ubuntu machines. The page is all red, and the javascript source code is showing up inside the web page. Then I tested it in the Epiphany web browser. It worked fine on one Ubuntu machine, showing up all nice and blue. But on the other Ubuntu machine I got the red page with the javascript source code showing up, just like Firefox.
Yikes, thanks for pointing this out! I fixed a rendering bug in MobileWebkit and wound up breaking Firefox. It should work now.
Gotta love web development.
Re: Bonchat - client-side encrypted web chat for the truly paranoid
#7It seems broken for me; if I go to the url, bonchat treats it like a new chat each time, prompting for a password and my name.
That's the point. :)
Your password is never sent to the server or stored in any cookies. You have to enter it every time because it only lives in browser memory while you view the page.
A cute side-effect of this is that you can chat with yourself under two different names by opening the same chat in multiple tabs. (You can also try chatting with two different passwords to watch the decryption fail.)
Re: Bonchat - client-side encrypted web chat for the truly paranoid
#8Cute, but unless you have some way to verify the client code every time you use it, it's only a bit more secure than a regular web chat site over HTTPS.
Re: Bonchat - client-side encrypted web chat for the truly paranoid
#9A couple folks have kindly pointed out that it's wide open to to XSS attacks, since it allows full HTML posting.
This is 100% true ... and doesn't matter one bit. The only information to steal via XSS is the password, and anyone who can submit an attack necessarily already knows the password.
You can exploit this to annoy friends you're chatting with. Try, for example, submitting:
body { background: #cc3333; } a { color: #cc3333 }
Re: Bonchat - client-side encrypted web chat for the truly paranoid
#10No, it's not as secure as your browser and AES. It's exactly as secure as Bonchat's servers and application code, because your browser is going to trust any Javascript fed to it from Bonchat.org, whether or not that code subtly destroys the security of the AES encryptor.
Why even bother with JS AES? If you're served a court order, you can be forced to transparently record everything being said on the site anyways, without anyone being the wiser.