Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Minibone: practical end-to-end encryption for web apps

github.com

Post reply on HN
Print view View original

11–20 of 73 posts

Re: Minibone: practical end-to-end encryption for web apps

#12

Post by kpdemetriou »

djbusby wrote: post #11

What about using the libsoduim JS? It seems pretty OK to me. It's from a pretty source too.

It's much more bare-bones. Minibone exposes a more approachable and misuse-resistant higher-level API including support for things like opportunistic key rotations and groundwork for forward evolution!

Re: Minibone: practical end-to-end encryption for web apps

#13

Post by kpdemetriou »

_dwtv wrote: post #9

Lack of streaming support in the API makes this DOA for many use cases. Fully buffered APIs like these are an unideal abstraction and should be avoided for any large or streamed resources.

One of the authors here. Streaming is actually in the works.

Re: Minibone: practical end-to-end encryption for web apps

#14

Post by kpdemetriou »

SahAssar wrote: post #3

Would it be possible to use this with something like webauthn/passkeys instead of passwords?

In principle, yes. In practise it's not widely supported (yet). Here's a relevant blog post: https://levischuck.com/blog/2023-02-prf-webauthn

Re: Minibone: practical end-to-end encryption for web apps

#15

Post by kpdemetriou »

sroussey wrote: post #6

Is there anything like this for yjs or similar?

The team behind this project (read: we) developed an expansive SDK for multi-user collaborative apps, including realtime docs. We use it to power many of the features of https://backbone.dev/

The multi-user scenario is significantly harder to get right without running into nasty vulnerabilities. We plan to write more about how we built it and what to look out for.

Re: Minibone: practical end-to-end encryption for web apps

#16

Post by codetrotter »

dbingham wrote: post #8

This looks... Interesting and also weirdly suspicious. It's "made by Backbone". Backbone appears to be an enterprise security startup (?) but it's unclear because the website tells you almost nothing about the companies history, finances, or who makes up the company. The committers appear to be "Backbone Authors". The organizations membership is not visible. With something like this, trust is vital. I need to be able…

> zero transparency

> could be a state actor trying to lay the foundation for future backdoors

idk if presence of “names” are a good signal to indicate otherwise either

https://www.wired.com/story/jia-tan-xz-backdoor/

Re: Minibone: practical end-to-end encryption for web apps

#18

Post by kpdemetriou »

dbingham wrote: post #8

This looks... Interesting and also weirdly suspicious. It's "made by Backbone". Backbone appears to be an enterprise security startup (?) but it's unclear because the website tells you almost nothing about the companies history, finances, or who makes up the company. The committers appear to be "Backbone Authors". The organizations membership is not visible. With something like this, trust is vital. I need to be able…

I'm one of the authors. We built Minibone as a community contribution because we realized how unnecessarily vulnerability-prone E2EE app development is today - after seeing app after app repeatedly making the same mistakes.

Minibone is an initial attempt to address this challenge in the single-user setting (that allows a concise and easily auditable implementation).

This is all part of our broader work that you can read about here: https://backbone.dev/company

Re: Minibone: practical end-to-end encryption for web apps

#19

Post by kpdemetriou »

tptacek wrote: post #17

This isn't actually end-to-end encryption, right? You have to trust the server not to corrupt the JS context to exfiltrate secrets. If that's the case (if I haven't misread something here), what is this buying you over just TLS?

Think of it this way: if your database gets breached, your app won't leak user data if your users aren't all targeted by active attackers. It's not a substitute for transport security.

If active attackers are an important part of your threat model, you do want to assure the integrity of the payload - and you can ship Minibone in things like Tauri (or Electron) apps, like we do at Backbone.

Post reply on HN