3 ms·

Really thank you for this. I'd forgotten the thrill of conversing with a complete stranger, from anywhere in the world, sight unseen. I hope it catches on. A

Really thank you for this. I'd forgotten the thrill of conversing with a complete stranger, from anywhere in the world, sight unseen. I hope it catches on. A serious question though, do the actual conversations cross the server or are they direct p2p?

bemmu 7y ago
They cross the server, but I use encryption to send the keystrokes. Public/private key pair is generated by collecting some randomness from the client, and used to transmit characters. It's the last function in https://sysop.chat/net.js https://sysop.chat/net.js
- h0l0cube 7y ago
  My knowledge of crypto might be completely backwards, but I think it's normal to use the asymmetric pair to then communicate a symmetric key between both parties. Also, I'm not sure what cryptico is doing under the hood, but if it's not communicating a new IV/offset for each key stroke message, I imagine you could compare two messages with the same keystroke and it would encrypt to exactly the same cypher. I really hope this project grows, and that I can visit it again... or even chat to people I know in this format. I really enjoyed /random, it was fun making friends with complete strangers. The last time I had that feeling was in the golden age of ICQ, and when I used to visit actual BBSes in the 90s.
  - bemmu 7y ago
    I was also concerned that the messages would be the same for the same keystrokes, but looking into it it seems it also contains a timestamp, so each message is different. I'm sure it's not bulletproof, but I think a huge improvement over plain text. Also I don't store any logs of sent keystroke messages.
    - mikeash 7y ago
      You could brute force that fairly easily if you know approximately when the message was sent. Still a lot better than being able to see it right in your packet sniffer, of course.

3 ms·

Really thank you for this. I'd forgotten the thrill of conversing with a complete stranger, from anywhere in the world, sight unseen. I hope it catches on. A

by h0l0cube 7y ago

bemmu 7y ago
They cross the server, but I use encryption to send the keystrokes. Public/private key pair is generated by collecting some randomness from the client, and used to transmit characters. It's the last function in https://sysop.chat/net.js https://sysop.chat/net.js
- h0l0cube 7y ago
  My knowledge of crypto might be completely backwards, but I think it's normal to use the asymmetric pair to then communicate a symmetric key between both parties. Also, I'm not sure what cryptico is doing under the hood, but if it's not communicating a new IV/offset for each key stroke message, I imagine you could compare two messages with the same keystroke and it would encrypt to exactly the same cypher. I really hope this project grows, and that I can visit it again... or even chat to people I know in this format. I really enjoyed /random, it was fun making friends with complete strangers. The last time I had that feeling was in the golden age of ICQ, and when I used to visit actual BBSes in the 90s.
  - bemmu 7y ago
    I was also concerned that the messages would be the same for the same keystrokes, but looking into it it seems it also contains a timestamp, so each message is different. I'm sure it's not bulletproof, but I think a huge improvement over plain text. Also I don't store any logs of sent keystroke messages.
    - mikeash 7y ago
      You could brute force that fairly easily if you know approximately when the message was sent. Still a lot better than being able to see it right in your packet sniffer, of course.