Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Magic Wormhole: get things from one computer to another, safely

github.com

Post reply on HN
Print view View original

131–140 of 262 posts

Re: Magic Wormhole: get things from one computer to another, safely

#131

Post by zzo38computer »

loloquwowndueo wrote: post #116
zzo38computer wrote: post #112

To send a file from one computer to the other by internet (although often internet should not be needed for this), I think netcat should do. Use tar or something else like that if you want to send multiple files. Use programs to calculate the hash if you want to verify the hash of the file. For large files, it does help to make resumable transfer; fortunately, that can be done easily, too (you can see what the file s…

How do you transfer between computers behind NAT or firewalls without an intermediary? If you have to install software anyway why not install wormhole directly? Netcat works in some circumstances and it’s fine to use it in those. But wormhole covers different scenarios and your netcat proposal doesn’t cover or have advantages in some of them.

It is unfortunate that you would have to install netcat on Windows (I don't know why they don't include functions such as that built-in, perhaps it could be included as a function in PowerShell); but on some other systems it is likely to already be installed, and such a thing really ought to be included by default if the computer has TCP/IP included by default. This does not necessarily need to be netcat; it can be any program that does the same thing, and it is simple enough to include with TCP/IP based systems that other kinds of operating systems could potentially have their own variant, if they have the ability to connect to the internet.

However, it is true about considering NAT. Then you will need to set up the intermediary (which further affects compatibility), if you cannot connect the computers directly (which also ought to be possible with a null modem cable, but that also is often not available).

It also does not consider multiple files at once; how that should need to be handled will be different on different computers anyways though, since the files are different on a different computers.

Due to such things, other programs such as Magic Wormhole might help, although even then it will not necessarily work with all computers anyways, because then you will need a computer that is compatible with Magic Wormhole.

Another alternative, that might sometimes be suitable, would be LAN connections. This is not always suitable, but if they are, then you can use the LAN addressing directly, too.

Re: Magic Wormhole: get things from one computer to another, safely

#132

Post by foresto »

bootlegbilly wrote: post #128
foresto wrote: post #114

Earlier quoted context omitted.

It was useless for large files when I tried it, at least on Firefox. It seemed to be trying to pull the entire file into RAM.

As someone who's been working on a file upload service for a while, this is the only real way to download very large files on Firefox. The file system access API is a great way to write chunks of a file at a gime, but for now Firefox doesn't support it https://wicg.github.io/file-system-access/ https://mozilla.github.io/standards-positions/#native-file-s...

That makes sense, and their reasoning looks sound. Here's hoping the file read/write parts get broken apart from the rest.

Thanks for the link.

Re: Magic Wormhole: get things from one computer to another, safely

#133

Post by layer8 »

__MatrixMan__ wrote: post #108
layer8 wrote: post #55

Earlier quoted context omitted.

Both problems can be worked around by having a third, general-purpose host where both source/destination hosts can scp to/from. Not quite as straightforward because you have to copy twice and do it from both sides, but has the benefit of not having to install bespoke software.

I think you could use an ssh tunnel between the intermediary and the destination such that the scp connection from the source makes it all the way through in one go, rather than leaving files on the intermediary. You'd be forwarding to the ssh port via ssh, so it would be a confusing bit of sshception. If I tried to actually come up with the actual commands for this, I'm sure I'd burn a whole afternoon on fiddling wi…

This either requires the destination to accept inbound connections, or you'd need a permanent SSH tunnel, both of which you'd probably want to avoid.

Re: Magic Wormhole: get things from one computer to another, safely

#134

Post by lotharrr »

panarky wrote: post #127
lotharrr wrote: post #48

author here.. happy to answer any questions!

I use wormhole a lot, but I've been too lazy to figure out if it's as secure as ssh/scp, so I always gpg the file I'm transferring before putting it into wormhole. Is that paranoid behavior?

It can't hurt, but it shouldn't be necessary. The client-side software establishes an encrypted connection with its peer, using an encryption scheme that should be just as secure [but see below] as what GPG or SSH will give you.

For GPG to add security, you also have to make sure the GPG key is transferred safely, which adds work to the transfer process. Either you're GPG-encrypting to a public key (which you must have copied from the receiving side to the sending side at some point), or you're using a symmetric-key passphrase (which you must generate randomly, to be secure, and then copy it from one side to the other).

I should note that magic-wormhole's encryption scheme is not post-quantum -secure. So if you've managed to get a GPG symmetric key transferred to both sides via PQ-secure pathways (I see that current SSH 9.8 includes "kex: algorithm: sntrup761x25519-sha512@openssh.com", where NTRU is PQ-secure), then your extra GPG encryption will indeed provide you with security against a sufficiently-large quantum computer, whereas just magic-wormhole would be vulnerable.

Re: Magic Wormhole: get things from one computer to another, safely

#135

Post by TheRealPomax »

lotharrr wrote: post #41
TheRealPomax wrote: post #8

Earlier quoted context omitted.

Just set up a VPN if that's what you want?

(author here) The protocol enumerates all the IPv4 addresses on each side, and attempts to connect to all of them, and the first successful handshake wins. So if your VPN arrangement enables a direct connection, `wormhole send` will use that, which will be faster than going through the relay (and cheaper for the relay operator). A basic VPN gets you safe connectivity between the two sides, but transferring a file sti…

Right, I'm more commenting on the "have my friend slurp files" part: that sounds more like they want to set up a VPN with normal file sharing (e.g. full network shares) so their friend can just grab literally anything as long as it's in a network share. It didn't sound like they needed individual file transfers.

Re: Magic Wormhole: get things from one computer to another, safely

#136

Post by lotharrr »

bredren wrote: post #109

Is there a wrapper for wormhole that shares the phrase with a counterparty and their client auto requests it? I have a pal where we want this kind of auto accept style behavior.

Magic-wormhole is really intended to help with the first-step "introduction" phase of a tool like that: start with two humans that can yell a codephase at each other, and finish with two computers that have a secure encrypted connection. Once you've got that connection, you can send whatever you want through it.

The `wormhole send` tool is a good demonstration of what you can do with that API, and a convenient tool in its own right, but wasn't designed to be the end-all-be-all of the file transfer universe, nor to be a building block for other tools layered on top.

The application you describe would be pretty cool (the UI might look more like dropping a file into a Slack DM chat window). But I'd recommend against using automated calls to `wormhole send` to accomplish it: you'd be cutting against the grain, and adding load to the mailbox server that everyone else uses. Instead, build a separate app or daemon, which can use the magic-wormhole API to perform just the introduction step. You'd push the "invite a peer" button on your app, it would display a wormhole code, you speak that to your pal, they push the "accept invitation" button on their app, type in the code, and then the two apps exchange keys/addresses. All subsequent transfers use those established keys, and don't need to use the wormhole code again. You should never need to perform a wormhole dance more than once per peer.

Re: Magic Wormhole: get things from one computer to another, safely

#137

Post by annoyingnoob »

I feel like this project could use a diagram. Maybe I'm a visual learner. I looked at the github link and the docs. It mentions that is uses a couple of servers. Without reading through the Installation steps I didn't grok how it works. A simple diagram with a couple of endpoints and how they connect would go a long way.

Re: Magic Wormhole: get things from one computer to another, safely

#139

Post by panarky »

lotharrr wrote: post #134
panarky wrote: post #127

Earlier quoted context omitted.

I use wormhole a lot, but I've been too lazy to figure out if it's as secure as ssh/scp, so I always gpg the file I'm transferring before putting it into wormhole. Is that paranoid behavior?

It can't hurt, but it shouldn't be necessary. The client-side software establishes an encrypted connection with its peer, using an encryption scheme that should be just as secure [but see below] as what GPG or SSH will give you. For GPG to add security, you also have to make sure the GPG key is transferred safely, which adds work to the transfer process. Either you're GPG-encrypting to a public key (which you must ha…

When I ask if wormhole is as secure as ssh/scp I'm not really thinking about post-quantum security, I'm thinking about the number of brilliant people looking at the code and the number of brilliant people attempting to break it.

Re: Magic Wormhole: get things from one computer to another, safely

#140

Post by meejah »

samstave wrote: post #115
lotharrr wrote: post #93

Earlier quoted context omitted.

Yes, it relies on two servers, both of which I run. All connections use the "mailbox server", to exchange short messages, which are used to do the cryptographic negotiation, and then trade instructions like "I want to send you a file, please tell me what IP addresses to try". Then, to send the bulk data, if the two sides can't establish a direct connection, they fall back to the "transit relay helper" server. You onl…

Can you turn the magic wormhole into an API for receiving a JSON payload directly into your magic wormhole ontop of whatever youre running in a fastAPI to route that incoming wormhole listener?

Yes.

A technique like this is used to do "invites" in Magic Folder, and also in Tahoe-LAFS. That is, they speak a custom protocol over just the Mailbox server in order to do some secrets-exchanging. They never set up a "bulk transport" link.

There is also a Haskell implementation, if that's of interest.

I love to learn about "non-file-transfer" use-cases for Magic Wormhole, so please connect via GitHub (or https://meejah.ca/contact)

Post reply on HN