2 ms·

Isn't there only 65K passwords/magic keywords in wormhole ? What if someone constantly bruteforce all of these combinations, wouldn't he get access to the files

• pvg 8y ago
  This is covered in their docs, along with mitigation. https://magic-wormhole.readthedocs.io/en/latest/attacks.html https://magic-wormhole.readthedocs.io/en/latest/attacks.html
• lotharrr 8y ago
  The short answer is that PAKE is single-use, so the attacker only gets one guess (and their attempt prevents the legitimate peer from trying either). Each time they consume someone else's transfer attempt, they get a 1-in-65k chance of succeeding, and a 65535-in-65536 chance of alerting the peer that they failed. For the attacker to have a 50/50 chance of successfully stealing your file transfer, you'd have to (on average) re-run the `wormhole send` program over 30000 times. I don't know about you, but I'm not that patient, and I'd give up long before they had a significant chance of success :).