3 ms·
They cross the server, but I use encryption to send the keystrokes. Public/private key pair is generated by collecting some randomness from the client, and used
by bemmu 7y ago
They cross the server, but I use encryption to send the keystrokes. Public/private key pair is generated by collecting some randomness from the client, and used to transmit characters. It's the last function in https://sysop.chat/net.js https://sysop.chat/net.js
- h0l0cube 7y agoMy knowledge of crypto might be completely backwards, but I think it's normal to use the asymmetric pair to then communicate a symmetric key between both parties. Also, I'm not sure what cryptico is doing under the hood, but if it's not communicating a new IV/offset for each key stroke message, I imagine you could compare two messages with the same keystroke and it would encrypt to exactly the same cypher. I really hope this project grows, and that I can visit it again... or even chat to people I know in this format. I really enjoyed /random, it was fun making friends with complete strangers. The last time I had that feeling was in the golden age of ICQ, and when I used to visit actual BBSes in the 90s.
- bemmu 7y agoI was also concerned that the messages would be the same for the same keystrokes, but looking into it it seems it also contains a timestamp, so each message is different. I'm sure it's not bulletproof, but I think a huge improvement over plain text. Also I don't store any logs of sent keystroke messages.
- mikeash 7y agoYou could brute force that fairly easily if you know approximately when the message was sent. Still a lot better than being able to see it right in your packet sniffer, of course.