3 ms·
Quick response to some of the comments here: - WebRTC is great in theory, terrible in practice (doesn't work very well), and still needs a bootstrapping server
by marknadal 9y ago
Quick response to some of the comments here:
- WebRTC is great in theory, terrible in practice (doesn't work very well), and still needs a bootstrapping server. So it is better to have a reliable websocket based server as the default/fallback, and WebRTC progressively enhanced.
- Signal and Whatsapp, as others have pointed out, are far from being comfortable as being private (they already know too much, phone number, etc.), and don't have the convenience of a browser based app.
- Yes, this app should be using the Web Crypto API (it is what we switched over to, for our P2P cryptographic user accounts: https://github.com/amark/gun/wiki/auth https://github.com/amark/gun/wiki/auth ) to reduce dependency on the server. You can use the `integrity` attribute to help out with this, but ultimately unless somebody installs it as an Electron app or something, browser based crypto has its limitations.
- rymate1234 9y agoIsn't the web crypto API chrome only at the moment?
- edoceo 9y agoNo https://caniuse.com/#search=Crypto https://caniuse.com/#search=Crypto
- gurgus 9y ago> - Signal and Whatsapp, as others have pointed out, are far from being comfortable as being private (they already know too much, phone number, etc.), and don't have the convenience of a browser based app. Whatsapp does have a browser based app. web.whatsapp.com
- marknadal 9y agoI get a "download the app to scan QR code and login" wall / lock-out. This wouldn't count as being browser-based!
- lawl 9y agoThis is because the private key to en/decrypt messages never leaves your phone. So the 'browser based' version still routes messages to your phone first (to presumably re-encrypt them with a different key that you got from scanning that QR code). You can argue semantics if that counts as browser based or not, but I think that's actually a pretty sane way to to things, security wise.
- gurgus 9y agoIt's in a browser. It's browser based.