[flagged]
Magic Wormhole: Get things from one computer to another, safely
81–90 of 107 posts
Re: Magic Wormhole: Get things from one computer to another, safely
#82Earlier quoted context omitted.
> requires trusting a server to rate limit attempts on brute-forcing that short password This isn't true. Particularly, if an attacker attempts to connect with the wrong password, this will be seen by the client, which then aborts the connection. So an attacker can only try one password. You can test this yourself: A: $ wormhole send foobar A: Wormhole code is 1-whimsical-klaxon B: $ wormhole receive 1-klaxon-whimsic…
Does that mean if 100 people send files over a server, and out of the 100 recipients a single one spells the code wrong, all 100 transfers get cancelled?
No, the key negotiation occurs between two clients.
In the Magic Wormhole protocol, the number at the beginning of the Magic Wormhole phrase specifies a "nameplate" used to negotiate the "mailbox" which both clients (sender and receiver) use. If a recipient specifies a _matching_ nameplate but a _non-matching_ key phrase, the file transfer transaction between the sender and receiver with a matching nameplate will fail (since they cannot correctly produce a shared key), but nobody else is affected in any way.
An evil attacker could DoS the magic-wormhole mailbox server by spamming mailbox nameplates with bad keys, since there isn't much entropy at all there, but they would affect only single transactions at a time.
Re: Magic Wormhole: Get things from one computer to another, safely
#83And its lesser known component, the mailbox server used for signaling to connect the two computers. If you’ve ever installed and used magic wormhole, you’ve likely used the default public mailbox server unless you configured and set up your own. https://github.com/magic-wormhole/magic-wormhole-mailbox-ser...
I usually use the Debian one and never had problems.
(magic-wormhole author here)
Debian was kind enough to configure their distribution's copy with a distinct hostname for the transit relay helper (the bit that forwards bulk encrypted traffic when both parties are behind NAT). "magic-wormhole-transit.debian.net" is currently a CNAME for "transit.magic-wormhole.io" (which is what the upstream source uses), so all this currently costs them is some DNS maintenance. Both sides exchange transit server hostnames, so they don't need to use the same one, but Debian does this so we could switch Debian-based clients off to a different server if/when my costs of running transit.magic-wormhole.io grow too large.
The "mailbox relay server" for all mutually-communicating clients must be the same. Both upstream and Debian (and most of the other distributions I've seen) use "relay.magic-wormhole.io". The mailbox server helps the clients exchange tiny key-exchange and setup messages, so its costs are trivial.
Re: Magic Wormhole: Get things from one computer to another, safely
#84Been using it from time to time to transfer secrets; out of curiosity, when I'm sending something to some via this tool, do you known what machines is it relayed through? I am sure it's not peer-to-peer; would not be as reliable!
It attempts to communicate peer-to-peer but falls back to a relay if necessary.
Re: Magic Wormhole: Get things from one computer to another, safely
#85Been using it from time to time to transfer secrets; out of curiosity, when I'm sending something to some via this tool, do you known what machines is it relayed through? I am sure it's not peer-to-peer; would not be as reliable!
(author here)
Both sides connect to the "mailbox relay server" to perform key exchange and setup. That's a host named "relay.magic-wormhole.io".
If either side has a public IP address, the encrypted data is transferred directly (they exchange IP addresses through the encrypted pipe, and attempt to connect to all of them, so this also covers two peers on the same LAN). If neither do, they both connect to a public "transit helper" relay named "transit.magic-wormhole.io" which acts like a TURN server to get the encrypted bytes from one connection to the other. I run both services.
Re: Magic Wormhole: Get things from one computer to another, safely
#86Earlier quoted context omitted.
Googled. > Because of firewall network address translation (NAT) issues, rendezvous protocols generally require that there be at least one unblocked and un-NATed server that lets the peers locate each other and initiate concurrent packets at each other. So probably cant help with a VPC unless you pierce a hole for it. I guess this makes sense, since by design this shouldn't be possible.
The point of the intermediate server is so that you can NAT hole punch, otherwise it has little point (except maybe as a relay, which is a bad solution).
We're making good progress on hole-punching, but it isn't available yet. Once complete, that should take some pressure/cost off the transit relay machine.
Note that the transit relay only sees ciphertext (for bulk data transfers). Even the mailbox server only sees ciphertext or SPAKE key-exchange messages. No server sees plaintext ever.
Re: Magic Wormhole: Get things from one computer to another, safely
#87This project made me learn about and attempt to implement the SPAKE2 protocol and HKDF as an exercise. It's quite fascinating. It lets you upgrade a short password to a long key, but requires trusting a server to rate limit attempts on brute-forcing that short password. It seems difficult to find a practical use case for it tho. Because it's only relevant when it is impractical to send a long key. But if you think fo…
That's all nice and dandy, but what about sending data the other way, from a phone to a desktop? Meticulously typing in long strings of text with no mistakes is not really a practical solution for the vast majority of users.
Localsend, if you're on the same wifi network. Works decently for sending files between Android/iOS/Desktop (sometimes on iOS the app must be closed and reopened a couple of times before non iOS devices can detect it, for some reason).
I use magic wormhole everywhere else, servers, vms, etc.
Re: Magic Wormhole: Get things from one computer to another, safely
#88I use magic wormhole when I first install a computer to send an SSH key. At that point, I have ssh. Also if you use a mesh VPN, your devices are already connected and there are several ways to transfer files. I like to use it more. What is your use case for this? BTW, I haven’t found a good iOS app.
FYI, there's a subcommand just for this use case: `wormhole ssh invite` / `accept`, which will read the SSH pubkey on one end and append it to authorized_keys on the other.
Re: Magic Wormhole: Get things from one computer to another, safely
#89Earlier quoted context omitted.
coc is also available on android which maked it really useful. Although kde connect works very well at least for smallish files, it requires pairing devices you might not want to pair permanently.
Isn't there an Android app supporting magic wormhole?
Yes, there are several alternative clients including several for Android: https://magic-wormhole.readthedocs.io/en/latest/ecosystem.ht...
Re: Magic Wormhole: Get things from one computer to another, safely
#90I prefer https://localsend.org/ nowadays. Nice cross-platform GUI, "just works". Requires being on the same lan, but discovery of other devices is automatic and there are no alphanumeric codes that have to be shared. It's a good QoL improvement to have "airdrop" between Android and Linux
The main reason one would use Magic Wormhole is that the devices do not need to be on the same LAN...
If two Magic Wormhole clients _are_ on the same LAN they should communicate directly that way (i.e. no relay required).