Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Darkwire.io – instant encrypted web chat (Socket.io and Web Crypto API)

darkwire.io

Post reply on HN
Print view View original

1–10 of 48 posts

Re: Show HN: Darkwire.io – instant encrypted web chat (Socket.io and Web Crypto API)

#2

Post by Ros2 »

Neat app, but curious why you aren't using WebRTC p2p?

I've always thought something like this using WebRTC + a (simple) way to independently check that no data is being sent elsewhere would be really cool.

Btw you could declare a content security policy for just your site since you don't load anything off domain https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP Good luck!

Re: Show HN: Darkwire.io – instant encrypted web chat (Socket.io and Web Crypto API)

#3

Post by tptacek »

This doesn't look especially safe. In addition to the fact that the crypto is delivered by the server, and so every browser/server transaction is an opportunity for the server to surreptitiously backdoor the crypto operations, the underlying crypto here appears to be CBC+HMAC where the payloads are decrypted before the HMAC is checked.

Re: Show HN: Darkwire.io – instant encrypted web chat (Socket.io and Web Crypto API)

#5

Post by Veratyr »

free2rhyme214 wrote: post #4

I understand the benefits from instant web chat, but I think it's not too difficult to access the signal protocol through Whatsapp or Signal's desktop app.

Those implementations both require phone numbers and registration through a mobile app (hence lack anonymity) and are useless for many use cases.

I think Matrix (Riot) would be a better choice. It's e2e encrypted like Signal but doesn't have any nonsense reliance on phones or phone numbers. It also has extra features like true multiple device support, a federated protocol and an open server implementation.

Re: Show HN: Darkwire.io – instant encrypted web chat (Socket.io and Web Crypto API)

#6

Post by marknadal »

Quick response to some of the comments here:

- WebRTC is great in theory, terrible in practice (doesn't work very well), and still needs a bootstrapping server. So it is better to have a reliable websocket based server as the default/fallback, and WebRTC progressively enhanced.

- Signal and Whatsapp, as others have pointed out, are far from being comfortable as being private (they already know too much, phone number, etc.), and don't have the convenience of a browser based app.

- Yes, this app should be using the Web Crypto API (it is what we switched over to, for our P2P cryptographic user accounts: https://github.com/amark/gun/wiki/auth ) to reduce dependency on the server. You can use the `integrity` attribute to help out with this, but ultimately unless somebody installs it as an Electron app or something, browser based crypto has its limitations.

Re: Show HN: Darkwire.io – instant encrypted web chat (Socket.io and Web Crypto API)

#8

Post by rymate1234 »

marknadal wrote: post #6

Quick response to some of the comments here: - WebRTC is great in theory, terrible in practice (doesn't work very well), and still needs a bootstrapping server. So it is better to have a reliable websocket based server as the default/fallback, and WebRTC progressively enhanced. - Signal and Whatsapp, as others have pointed out, are far from being comfortable as being private (they already know too much, phone number,…

Isn't the web crypto API chrome only at the moment?

Re: Show HN: Darkwire.io – instant encrypted web chat (Socket.io and Web Crypto API)

#9

Post by kuceram »

Veratyr wrote: post #5
free2rhyme214 wrote: post #4

I understand the benefits from instant web chat, but I think it's not too difficult to access the signal protocol through Whatsapp or Signal's desktop app.

Those implementations both require phone numbers and registration through a mobile app (hence lack anonymity) and are useless for many use cases. I think Matrix (Riot) would be a better choice. It's e2e encrypted like Signal but doesn't have any nonsense reliance on phones or phone numbers. It also has extra features like true multiple device support, a federated protocol and an open server implementation.

And what is the use-case for this? I probably somehow miss it.
Post reply on HN