8 ms·

Show HN: Darkwire.io – instant encrypted web chat (Socket.io and Web Crypto API)

118 points by alanfriedman 9y ago

Ros2 9y ago
Neat app, but curious why you aren't using WebRTC p2p? I've always thought something like this using WebRTC + a (simple) way to independently check that no data is being sent elsewhere would be really cool. Btw you could declare a content security policy for just your site since you don't load anything off domain https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP Good luck!
- alanfriedman 9y ago
  Thanks! We actually need the server intermediary to handle storing and locking rooms, and adding and removing members. Also IIRC WebRTC data channel doesn't have great cross browser support.
tptacek 9y ago
This doesn't look especially safe. In addition to the fact that the crypto is delivered by the server, and so every browser/server transaction is an opportunity for the server to surreptitiously backdoor the crypto operations, the underlying crypto here appears to be CBC+HMAC where the payloads are decrypted before the HMAC is checked.
- rqs 9y ago
  I agreed with most of part, but > the payloads are decrypted before the HMAC is checked I mean, on ClientA, I can calculate the HMACA of the plain-text, then encrypt the plain-text using KeyA to get MessageA Then, on ClientB, I decrypt the MessageA using KeyB to get plain-text, and calculate HMACB from the plain-text. After all that, I can still compare HMACA against HMACB to check if the message is authentic. So what seems to be the problem here?
  - zaarn 9y ago
    What you describe is MtE (Mac Then Encrypt), which is generally not recommended because you have to decrypt ciphertext before you can check the MAC. This can lead to various timing or padding oracle vulnerabilities. The recommended, more safer and sturdier method is EtM (Encrypt then MAC), in which you encrypt the plaintext then MAC the ciphertext. This way you can verify the cipher before you operate on it. EtM is [according to wikipedia] "[...] the only method which can reach the highest definition of security in AE [...]". Being able to supply arbitrary data into your system and have said system blindly apply a secret key to it is IMO not the safe mode. The safe mode is verifying that the data is from a source we can at least moderately trust to now spew out garbage and has the secret key anyway.
    - rqs 9y ago
      I implemented a protocol that uses MtE on a CFB mode cipher. And that's why I asked that question. Now, it seems like I may did it horribly wrong, I'm going to fix it right now. Thank you! EDIT: After I read an answer[0] on StackExchange, I realized I maybe did it right (Because of the CFB mode is different than CBC). Looks like I need to learn a whole lot more before start that fixing. Next time I'll just use GCM and save all these troubles. [0] https://crypto.stackexchange.com/questions/42369/is-this-symmetric-key-mac-then-encrypt-auth-token-methodology-secure https://crypto.stackexchange.com/questions/42369/is-this-sym...
      - zaarn 9y ago
        MtE isn't the worst choice, I've seen way worse. The best I can recommend is to take NaCl and then just using secret box. That picks the good defaults for you. Anything after that needs some research as even seemingly harmless naive implementations can ruin the entire cryptography of a program.
        tptacek 9y ago
        I don't know what "not the worst choice" means in this context. MtE compositions are generally vulnerable. Are there more flagrant ways to be vulnerable? Sure, I guess?
- alanfriedman 9y ago
  Firstly, thanks for inspecting the source and offering a suggestion for improvement. The latter point should be a relatively easy fix. As for your first point, there’s little we can do to prevent TLS or AWS tampering. But we can make it easier to choose e2e encryption in the first place. So we focused on reducing barriers to entry (no signup required, simple URL-based rooms) as well as providing these benefits over alternatives: - Open source code - Ephermeral message history (not persisted in a DB) - Opt-out anonymity We think these features make Darkwire a good solution for many users seeking secure, private online communication. Having said that, no solution is perfect and we hope to see contributions from the open source community to make it even better.
  - tptacek 9y ago
    Just to be clear: I didn't look carefully; I looked for about 2 minutes, found the first indication of unsound crypto I could, and then stopped.
  - rndgermandude 9y ago
    Given that the server distributes the keys, and there is no way for the user to compare/verify known-good keys of other users, it's possible for the server to MITM everything, actively, meaning modification instead of just eavesdropping. >- Open source code Open source doesn't save you either, because a user cannot inspect what is actually running on the server. And even the client side, while the code is technically there (downloaded to the browser in minified form), it's not feasible for a user no matter what level of skills to verify the distributed code is actually what's open sourced in your github repository and that the code stays like that whenever you refresh or reopen the site. So basically, you need to trust the server (operator) and your webcrypto scheme does not provide any additional security whatsoever given that the server (operator) can MITM it trivially. The only thing preventing third parties other than the server (operator) in a MITM position to do harm is the TLS, but not your webcrypto scheme. >- Ephermeral message history (not persisted in a DB) Even with best intensions, what happens when you receive some National Security Letter, court order or similar, which forces you into silently MITM the key exchanges, thereby enabling you to MITM the messages and then log every message and pass that to some state actor? To say something positive, I like the minimal UI and the way you handle file uploads. Even tho your service cannot fulfill the strong user-to-user security it somewhat claims, it's still a nice chat tool. However, since your service is easy to use (copy-paste just one URL and type away), I'd guess soon enough you'll run into the same troubles as similar services where some bad users (e.g. from the chans) will use your service to e.g. distribute child pornography, revenge porn and other very illegal content.
- pretty_dumn_guy 9y ago
  Hello tptacek, I am really interested in knowing how you reached your conclusions based on seeing the js file. I am quite new to analysing the source files of a given website using the firefox web console. I tried copying it to a text editor but, man, it was a mess to read. Any pointers as to how I might proceed ?
  - alanfriedman 9y ago
    You'd have better luck analyzing the source rather than the minified output. Relevant code is here: https://github.com/seripap/darkwire-client/blob/master/src/utils/message.js#L49 https://github.com/seripap/darkwire-client/blob/master/src/u...
    - pretty_dumn_guy 9y ago
      Dear Alanfriedman, Thank you. I will look into this. However, in this case, I can analyze the source now because it is available to me. What should I do when the source isn't available ? How do I proceed when all I have is the 'minified output'?
      - alanfriedman 9y ago
        You can try to prettify/beautify (something like http://jsbeautifier.org/ http://jsbeautifier.org/), but the output can still be hard to read. If you're looking to learn how to build a particular feature that's closed-source, I'd recommend trying to build something similar yourself using tutorials or an open-source analog.
free2rhyme214 9y ago
I understand the benefits from instant web chat, but I think it's not too difficult to access the signal protocol through Whatsapp or Signal's desktop app.
- Veratyr 9y ago
  Those implementations both require phone numbers and registration through a mobile app (hence lack anonymity) and are useless for many use cases. I think Matrix (Riot) would be a better choice. It's e2e encrypted like Signal but doesn't have any nonsense reliance on phones or phone numbers. It also has extra features like true multiple device support, a federated protocol and an open server implementation.
  - kuceram 9y ago
    And what is the use-case for this? I probably somehow miss it.
    - kirillseva 9y ago
      same reason you would host a gitlab or github enterprise instance instead of using github.com, only this time applied to encrypted messaging
- dominotw 9y ago
  https://signal.org/blog/whatsapp-complete/ https://signal.org/blog/whatsapp-complete/
marknadal 9y ago
Quick response to some of the comments here: - WebRTC is great in theory, terrible in practice (doesn't work very well), and still needs a bootstrapping server. So it is better to have a reliable websocket based server as the default/fallback, and WebRTC progressively enhanced. - Signal and Whatsapp, as others have pointed out, are far from being comfortable as being private (they already know too much, phone number, etc.), and don't have the convenience of a browser based app. - Yes, this app should be using the Web Crypto API (it is what we switched over to, for our P2P cryptographic user accounts: https://github.com/amark/gun/wiki/auth https://github.com/amark/gun/wiki/auth ) to reduce dependency on the server. You can use the `integrity` attribute to help out with this, but ultimately unless somebody installs it as an Electron app or something, browser based crypto has its limitations.
- rymate1234 9y ago
  Isn't the web crypto API chrome only at the moment?
  - edoceo 9y ago
    No https://caniuse.com/#search=Crypto https://caniuse.com/#search=Crypto
- gurgus 9y ago
  > - Signal and Whatsapp, as others have pointed out, are far from being comfortable as being private (they already know too much, phone number, etc.), and don't have the convenience of a browser based app. Whatsapp does have a browser based app. web.whatsapp.com
  - marknadal 9y ago
    I get a "download the app to scan QR code and login" wall / lock-out. This wouldn't count as being browser-based!
    - lawl 9y ago
Aeolun 9y ago
For those who do not want to talk to themselves: https://darkwire.io/Bkhi21HMz https://darkwire.io/Bkhi21HMz
ishansgupta 9y ago
Feature request: Some kind of 2 factor authentication. Such that messages are encrypted are on the view as long as we enter a valid key.
guy98238710 9y ago
How does it differ from wire.com in terms of privacy? Besides, wouldn't you have to transfer the chatroom name over another chat service since it changes all the time and users have no identity of their own?
- alanfriedman 9y ago
  Darkwire is more for ephemeral chat rooms, where the name doesn't change as long as the room is occupied. We also don't require sign up, so you can use it instantly and anonymously.
DyslexicAtheist 9y ago
Without looking deeper into the app ... The WebCrypto standard makes a lot of assumptions in terms of underlying security and is dangerous (if not negligent) without proper security headers (XSS, CSRF, CSP), in place[0]. Since this site positions itself as a security relevant app, mistakes like these are incredibly worrying. https://securityheaders.io/?q=https%3A%2F%2Fdarkwire.io%2FSkhYJzHGf&followRedirects=on https://securityheaders.io/?q=https%3A%2F%2Fdarkwire.io%2FSk...
- alanfriedman 9y ago
  Thanks for pointing this out. We'll work on getting fixes in ASAP.
sleavey 9y ago
The name makes it sound dodgy: "dark" reminds me of "dark web" and all the negative connotations. Not great for trustworthiness which is especially important for crypto.
- 0xJRS 9y ago
  I'm assuming their target market is people who have the opposite feeling when reminded of "dark web"
pjmlp 9y ago
> Slash commands (/nick, /me, /clear) So sad that young generations don't know what an IRC stands for.
mxuribe 9y ago
Kudos for working in this space...but why not just contribute to something like matrix? See: https://matrix.org/docs/guides/faq.html#what-is-matrix https://matrix.org/docs/guides/faq.html#what-is-matrix
- snvzz 9y ago
  Not the same thing by far. Matrix is a complex sindicalised protocol, this is a simple centralised chat with encryption.
nkkollaw 9y ago
Very cool! I wonder if the word "dark" makes the name have a negative connotation?
taosx 9y ago
You could give the option to the owner of the room to set a password for anyone wanting to join. And maybe you could use the password to encrypt further communication.
TehJIDF 9y ago
Volafile seems like a better alternative to this.

118 points by alanfriedman 9y ago

Ros2 9y ago

Neat app, but curious why you aren't using WebRTC p2p? I've always thought something like this using WebRTC + a (simple) way to independently check that no data is being sent elsewhere would be really cool. Btw you could declare a content security policy for just your site since you don't load anything off domain https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP Good luck!

alanfriedman 9y ago
Thanks! We actually need the server intermediary to handle storing and locking rooms, and adding and removing members. Also IIRC WebRTC data channel doesn't have great cross browser support.

tptacek 9y ago

This doesn't look especially safe. In addition to the fact that the crypto is delivered by the server, and so every browser/server transaction is an opportunity for the server to surreptitiously backdoor the crypto operations, the underlying crypto here appears to be CBC+HMAC where the payloads are decrypted before the HMAC is checked.

rqs 9y ago
I agreed with most of part, but > the payloads are decrypted before the HMAC is checked I mean, on ClientA, I can calculate the HMACA of the plain-text, then encrypt the plain-text using KeyA to get MessageA Then, on ClientB, I decrypt the MessageA using KeyB to get plain-text, and calculate HMACB from the plain-text. After all that, I can still compare HMACA against HMACB to check if the message is authentic. So what seems to be the problem here?
- zaarn 9y ago
  What you describe is MtE (Mac Then Encrypt), which is generally not recommended because you have to decrypt ciphertext before you can check the MAC. This can lead to various timing or padding oracle vulnerabilities. The recommended, more safer and sturdier method is EtM (Encrypt then MAC), in which you encrypt the plaintext then MAC the ciphertext. This way you can verify the cipher before you operate on it. EtM is [according to wikipedia] "[...] the only method which can reach the highest definition of security in AE [...]". Being able to supply arbitrary data into your system and have said system blindly apply a secret key to it is IMO not the safe mode. The safe mode is verifying that the data is from a source we can at least moderately trust to now spew out garbage and has the secret key anyway.
  - rqs 9y ago
    I implemented a protocol that uses MtE on a CFB mode cipher. And that's why I asked that question. Now, it seems like I may did it horribly wrong, I'm going to fix it right now. Thank you! EDIT: After I read an answer[0] on StackExchange, I realized I maybe did it right (Because of the CFB mode is different than CBC). Looks like I need to learn a whole lot more before start that fixing. Next time I'll just use GCM and save all these troubles. [0] https://crypto.stackexchange.com/questions/42369/is-this-symmetric-key-mac-then-encrypt-auth-token-methodology-secure https://crypto.stackexchange.com/questions/42369/is-this-sym...
    - zaarn 9y ago
      MtE isn't the worst choice, I've seen way worse. The best I can recommend is to take NaCl and then just using secret box. That picks the good defaults for you. Anything after that needs some research as even seemingly harmless naive implementations can ruin the entire cryptography of a program.
      - tptacek 9y ago
        I don't know what "not the worst choice" means in this context. MtE compositions are generally vulnerable. Are there more flagrant ways to be vulnerable? Sure, I guess?
alanfriedman 9y ago
Firstly, thanks for inspecting the source and offering a suggestion for improvement. The latter point should be a relatively easy fix. As for your first point, there’s little we can do to prevent TLS or AWS tampering. But we can make it easier to choose e2e encryption in the first place. So we focused on reducing barriers to entry (no signup required, simple URL-based rooms) as well as providing these benefits over alternatives: - Open source code - Ephermeral message history (not persisted in a DB) - Opt-out anonymity We think these features make Darkwire a good solution for many users seeking secure, private online communication. Having said that, no solution is perfect and we hope to see contributions from the open source community to make it even better.
- tptacek 9y ago
  Just to be clear: I didn't look carefully; I looked for about 2 minutes, found the first indication of unsound crypto I could, and then stopped.
- rndgermandude 9y ago
  Given that the server distributes the keys, and there is no way for the user to compare/verify known-good keys of other users, it's possible for the server to MITM everything, actively, meaning modification instead of just eavesdropping. >- Open source code Open source doesn't save you either, because a user cannot inspect what is actually running on the server. And even the client side, while the code is technically there (downloaded to the browser in minified form), it's not feasible for a user no matter what level of skills to verify the distributed code is actually what's open sourced in your github repository and that the code stays like that whenever you refresh or reopen the site. So basically, you need to trust the server (operator) and your webcrypto scheme does not provide any additional security whatsoever given that the server (operator) can MITM it trivially. The only thing preventing third parties other than the server (operator) in a MITM position to do harm is the TLS, but not your webcrypto scheme. >- Ephermeral message history (not persisted in a DB) Even with best intensions, what happens when you receive some National Security Letter, court order or similar, which forces you into silently MITM the key exchanges, thereby enabling you to MITM the messages and then log every message and pass that to some state actor? To say something positive, I like the minimal UI and the way you handle file uploads. Even tho your service cannot fulfill the strong user-to-user security it somewhat claims, it's still a nice chat tool. However, since your service is easy to use (copy-paste just one URL and type away), I'd guess soon enough you'll run into the same troubles as similar services where some bad users (e.g. from the chans) will use your service to e.g. distribute child pornography, revenge porn and other very illegal content.
pretty_dumn_guy 9y ago
Hello tptacek, I am really interested in knowing how you reached your conclusions based on seeing the js file. I am quite new to analysing the source files of a given website using the firefox web console. I tried copying it to a text editor but, man, it was a mess to read. Any pointers as to how I might proceed ?
- alanfriedman 9y ago
  You'd have better luck analyzing the source rather than the minified output. Relevant code is here: https://github.com/seripap/darkwire-client/blob/master/src/utils/message.js#L49 https://github.com/seripap/darkwire-client/blob/master/src/u...
  - pretty_dumn_guy 9y ago
    Dear Alanfriedman, Thank you. I will look into this. However, in this case, I can analyze the source now because it is available to me. What should I do when the source isn't available ? How do I proceed when all I have is the 'minified output'?
    - alanfriedman 9y ago
      You can try to prettify/beautify (something like http://jsbeautifier.org/ http://jsbeautifier.org/), but the output can still be hard to read. If you're looking to learn how to build a particular feature that's closed-source, I'd recommend trying to build something similar yourself using tutorials or an open-source analog.

free2rhyme214 9y ago

I understand the benefits from instant web chat, but I think it's not too difficult to access the signal protocol through Whatsapp or Signal's desktop app.

Veratyr 9y ago
Those implementations both require phone numbers and registration through a mobile app (hence lack anonymity) and are useless for many use cases. I think Matrix (Riot) would be a better choice. It's e2e encrypted like Signal but doesn't have any nonsense reliance on phones or phone numbers. It also has extra features like true multiple device support, a federated protocol and an open server implementation.
- kuceram 9y ago
  And what is the use-case for this? I probably somehow miss it.
  - kirillseva 9y ago
    same reason you would host a gitlab or github enterprise instance instead of using github.com, only this time applied to encrypted messaging
dominotw 9y ago
https://signal.org/blog/whatsapp-complete/ https://signal.org/blog/whatsapp-complete/

marknadal 9y ago

Quick response to some of the comments here: - WebRTC is great in theory, terrible in practice (doesn't work very well), and still needs a bootstrapping server. So it is better to have a reliable websocket based server as the default/fallback, and WebRTC progressively enhanced. - Signal and Whatsapp, as others have pointed out, are far from being comfortable as being private (they already know too much, phone number, etc.), and don't have the convenience of a browser based app. - Yes, this app should be using the Web Crypto API (it is what we switched over to, for our P2P cryptographic user accounts: https://github.com/amark/gun/wiki/auth https://github.com/amark/gun/wiki/auth ) to reduce dependency on the server. You can use the `integrity` attribute to help out with this, but ultimately unless somebody installs it as an Electron app or something, browser based crypto has its limitations.

rymate1234 9y ago
Isn't the web crypto API chrome only at the moment?
- edoceo 9y ago
  No https://caniuse.com/#search=Crypto https://caniuse.com/#search=Crypto
gurgus 9y ago
> - Signal and Whatsapp, as others have pointed out, are far from being comfortable as being private (they already know too much, phone number, etc.), and don't have the convenience of a browser based app. Whatsapp does have a browser based app. web.whatsapp.com
- marknadal 9y ago
  I get a "download the app to scan QR code and login" wall / lock-out. This wouldn't count as being browser-based!
  - lawl 9y ago

Aeolun 9y ago

For those who do not want to talk to themselves: https://darkwire.io/Bkhi21HMz https://darkwire.io/Bkhi21HMz

ishansgupta 9y ago

Feature request: Some kind of 2 factor authentication. Such that messages are encrypted are on the view as long as we enter a valid key.

guy98238710 9y ago

How does it differ from wire.com in terms of privacy? Besides, wouldn't you have to transfer the chatroom name over another chat service since it changes all the time and users have no identity of their own?

alanfriedman 9y ago
Darkwire is more for ephemeral chat rooms, where the name doesn't change as long as the room is occupied. We also don't require sign up, so you can use it instantly and anonymously.

DyslexicAtheist 9y ago

Without looking deeper into the app ... The WebCrypto standard makes a lot of assumptions in terms of underlying security and is dangerous (if not negligent) without proper security headers (XSS, CSRF, CSP), in place[0]. Since this site positions itself as a security relevant app, mistakes like these are incredibly worrying. https://securityheaders.io/?q=https%3A%2F%2Fdarkwire.io%2FSkhYJzHGf&followRedirects=on https://securityheaders.io/?q=https%3A%2F%2Fdarkwire.io%2FSk...

alanfriedman 9y ago
Thanks for pointing this out. We'll work on getting fixes in ASAP.

sleavey 9y ago

The name makes it sound dodgy: "dark" reminds me of "dark web" and all the negative connotations. Not great for trustworthiness which is especially important for crypto.

0xJRS 9y ago
I'm assuming their target market is people who have the opposite feeling when reminded of "dark web"

pjmlp 9y ago

> Slash commands (/nick, /me, /clear) So sad that young generations don't know what an IRC stands for.

mxuribe 9y ago

Kudos for working in this space...but why not just contribute to something like matrix? See: https://matrix.org/docs/guides/faq.html#what-is-matrix https://matrix.org/docs/guides/faq.html#what-is-matrix

snvzz 9y ago
Not the same thing by far. Matrix is a complex sindicalised protocol, this is a simple centralised chat with encryption.

nkkollaw 9y ago

Very cool! I wonder if the word "dark" makes the name have a negative connotation?

taosx 9y ago

You could give the option to the owner of the room to set a password for anyone wanting to join. And maybe you could use the password to encrypt further communication.

TehJIDF 9y ago

Volafile seems like a better alternative to this.