Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Magic Wormhole: Get things from one computer to another, safely

magic-wormhole.readthedocs.io

Post reply on HN
Print view View original

71–80 of 107 posts

Re: Magic Wormhole: Get things from one computer to another, safely

#71

Post by bobbylarrybobby »

Etheryte wrote: post #40
brendyn wrote: post #14

This project made me learn about and attempt to implement the SPAKE2 protocol and HKDF as an exercise. It's quite fascinating. It lets you upgrade a short password to a long key, but requires trusting a server to rate limit attempts on brute-forcing that short password. It seems difficult to find a practical use case for it tho. Because it's only relevant when it is impractical to send a long key. But if you think fo…

That's all nice and dandy, but what about sending data the other way, from a phone to a desktop? Meticulously typing in long strings of text with no mistakes is not really a practical solution for the vast majority of users.

Start web server on desktop, show QR on desktop, scan with phone, phone posts key to route in QR code

Re: Magic Wormhole: Get things from one computer to another, safely

#72

Post by Arubis »

Strong recommend. When I’m bouncing around getting onboarded on new client/customer machines that disallow syncing (justifiably), magic wormhole is a fabulous way to get my dot files and local env set up in a jiffy. Works well for secure transfer of _large_ files ad hoc, too, so a great fit for db dumps.

Re: Magic Wormhole: Get things from one computer to another, safely

#73

Post by tjjfvi »

brendyn wrote: post #14

This project made me learn about and attempt to implement the SPAKE2 protocol and HKDF as an exercise. It's quite fascinating. It lets you upgrade a short password to a long key, but requires trusting a server to rate limit attempts on brute-forcing that short password. It seems difficult to find a practical use case for it tho. Because it's only relevant when it is impractical to send a long key. But if you think fo…

> requires trusting a server to rate limit attempts on brute-forcing that short password

This isn't true. Particularly, if an attacker attempts to connect with the wrong password, this will be seen by the client, which then aborts the connection. So an attacker can only try one password. You can test this yourself:

    A: $ wormhole send foobar
    A: Wormhole code is 1-whimsical-klaxon

    B: $ wormhole receive 1-klaxon-whimsical # wrong password
    B: ERROR:  Key confirmation failed. Either you or your correspondent
    B: typed the code wrong, or a would-be man-in-the-middle attacker guessed
    B: incorrectly. Try sending the file again.
    B: 

    A: ERROR:  Key confirmation failed. Either you or your correspondent
    A: typed the code wrong, or a would-be man-in-the-middle attacker guessed
    A: incorrectly. Try sending the file again.
    A:
So if you receive this error (potentially repeatedly), you learn that there is an attacker trying to guess passwords. You can then choose to increase code length or simply stop using that channel.

The CLI also has an option to further mitigate MITM attacks with the `--verify` flag -- this shows to both clients a hash of the transcript, which can be verbally verified before proceeding with the transfer. This allows detecting an attack even if the attacker gets the password right on the first try (which has probability 1/65536).

Re: Magic Wormhole: Get things from one computer to another, safely

#74

Post by ikeashark »

mikae1 wrote: post #23

croc[1] has worked better for me. It supports resuming transfers, which is a must. It is very wormhole like and written in Go. [1] https://github.com/schollz/croc

100% endorse croc, you can use croc in any GPU renting service (e.g Runpod).

Re: Magic Wormhole: Get things from one computer to another, safely

#75

Post by mumak »

brendyn wrote: post #14

This project made me learn about and attempt to implement the SPAKE2 protocol and HKDF as an exercise. It's quite fascinating. It lets you upgrade a short password to a long key, but requires trusting a server to rate limit attempts on brute-forcing that short password. It seems difficult to find a practical use case for it tho. Because it's only relevant when it is impractical to send a long key. But if you think fo…

Me too! A few years back I ported magic-wormhole to Haskell and wrote a few posts about what I learned (https://jml.io/posts/spake2-begins/, https://jml.io/posts/what-is-spake2/). The good folk at Least Authority took over the Haskell implementation: https://github.com/leastauthority/haskell-magic-wormhole

Re: Magic Wormhole: Get things from one computer to another, safely

#76

Post by aniviacat »

tjjfvi wrote: post #73
brendyn wrote: post #14

This project made me learn about and attempt to implement the SPAKE2 protocol and HKDF as an exercise. It's quite fascinating. It lets you upgrade a short password to a long key, but requires trusting a server to rate limit attempts on brute-forcing that short password. It seems difficult to find a practical use case for it tho. Because it's only relevant when it is impractical to send a long key. But if you think fo…

> requires trusting a server to rate limit attempts on brute-forcing that short password This isn't true. Particularly, if an attacker attempts to connect with the wrong password, this will be seen by the client, which then aborts the connection. So an attacker can only try one password. You can test this yourself: A: $ wormhole send foobar A: Wormhole code is 1-whimsical-klaxon B: $ wormhole receive 1-klaxon-whimsic…

Does that mean if 100 people send files over a server, and out of the 100 recipients a single one spells the code wrong, all 100 transfers get cancelled?

Re: Magic Wormhole: Get things from one computer to another, safely

#77

Post by doublerabbit »

Etheryte wrote: post #40
brendyn wrote: post #14

This project made me learn about and attempt to implement the SPAKE2 protocol and HKDF as an exercise. It's quite fascinating. It lets you upgrade a short password to a long key, but requires trusting a server to rate limit attempts on brute-forcing that short password. It seems difficult to find a practical use case for it tho. Because it's only relevant when it is impractical to send a long key. But if you think fo…

That's all nice and dandy, but what about sending data the other way, from a phone to a desktop? Meticulously typing in long strings of text with no mistakes is not really a practical solution for the vast majority of users.

LANDrop

https://landrop.app/

There are some forks since the software was originally opensource but then closed it.

Re: Magic Wormhole: Get things from one computer to another, safely

#80

Post by rahimnathwani »

For sending files between my phone (Android) and my son's iPad, I use:

Wormhole William (Android): https://github.com/psanford/wormhole-william-mobile

Destiny (iOS): https://github.com/LeastAuthority/destiny

For interoperability, don't use Destiny's default servers. After you install Destiny, change the config to the standard Magic Wormhole servers:

Mailbox: ws://relay.magic-wormhole.io:4000/v1

Transit Relay: tcp://transit.magic-wormhole.io:4001

Post reply on HN