9 ms·
Serverless, peer-to-peer, local file sharing through sound
- paxys 6y agoNeat idea. IIRC Zoom does something similar to negotiate video sharing in conference room setups.
- dfischer 6y agoWow - didn’t realize the implications of this and needing a firewall: https://github.com/fhstp/SoniControl https://github.com/fhstp/SoniControl
- lioeters 6y agoMy goodness - I'd heard about trasmitting data using sound, but I also didn't realize its serious security implications. From the repo description: > SoniControl is a novel technology for the recognition and masking of acoustic tracking information. The technology helps end-users to protect their privacy. > Technologies like Google Nearby and Silverpush build upon ultrasonic sounds to exchange information. More and more of our devices communicate via this inaudible communication channel. Every device with a microphone and a speaker is able to send and receive ultrasonic information. The user is usually not aware of this inaudible and hidden data transfer. > To overcome this gap SoniControl detects ultrasonic activity, notifies the user and blocks the information on demand. Thereby, we want to raise the awareness for this novel technology.
- fao_ 6y agoYeah, also consider there have been no studies to ensure that we aren't destroying our pet's hearing by using these sorts of frequencies. It depends on the dB, but dogs for example have a much longer hearing range and distance than humans.
- dfischer 6y agoYeah this is news to me and I have pets that I’m concerned of and also want to utilize a firewall. I’ll need to research frequency ranges and safety.
- hoseja 6y agoWell, on the upside maybe we'll get better ultrasonic hardware. Easy listening to bats!
- whoisjuan 6y agoReminds a little bit of SlickLogin which provided user authentication via sound. Google bought, killed it and the concept completely disappeared. I’m wondering if it was unreliable from a security perspective, but it was a super cool concept. https://techcrunch.com/2014/02/16/google-acquires-slicklogin-the-sound-based-password-alternative/ https://techcrunch.com/2014/02/16/google-acquires-slicklogin...
- dfischer 6y agoGoogle Nearby seems to use it
- vel0city 6y agoAt first I thought the file sharing itself was over sound, but the sound is just to negotiate details of the WebRTC session which is then actually used to transmit the data. Neat and handy. I was thinking they had made something similar to the Fldigi suite, software kind of common in the ham radio universe. You can use it to encode arbitrary binary data into a lot of different modulations which exist in the audible range. Send files between computers without any IP networking at all. https://en.wikipedia.org/wiki/Fldigi#The_Fldigi_Suite https://en.wikipedia.org/wiki/Fldigi#The_Fldigi_Suite
- dfischer 6y agoThere does seem to be a few projects related to this on GitHub if you browse the tag. Enough so there’s firewall apps to counter non typical network telemetry. Allegedly, google, amazon, etc are using this. Interesting one way or another. See here: https://github.com/fhstp/SoniControl https://github.com/fhstp/SoniControl Seems massively not talked about given the vector.
- FridgeSeal 6y agoI wonder if it’s related to ad-tech that was embedding “sonic markers” in tv/YouTube ads that were to be picked up by ad-tech SDK’s embedded in apps. If someone had granted microphone access, the SDK could wait until it hears a signal embedded in an ad, and then pass back whatever data it had accumulated.
- kangaroozach 6y agoShazamified cookies?
- sebmellen 6y agoWatch out, every time someone speaks a startup idea, one pops into being. In a few years, we'll all be hearing about hot new "Shazam for Adtech" startups.
- Thorentis 6y agoWe've gone full circle. This is basically dial-up, but using mic/speakers instead of a phone.
- 0df8dkdf 6y agoYeah same with LISP and revival of functional and meta programming. History may not repeat but it sure rhyme.
- em3rgent0rdr 6y agoI get so nostalgic hearing the dial-up-modem-like sounds from their video.
- cblconfederate 6y agodon't be https://www.youtube.com/watch?v=r6UR_3ZieE4 https://www.youtube.com/watch?v=r6UR_3ZieE4
- bildung 6y agoIn former GDR (Eastern Germany) there was a computer show on the radio where programs were broadcasted this way. Listeners could record the programs with tapes an then run them on their computers.
- Shaddox 6y agoAh yes, we had something similar in Romania too, only that it was on national television. I got so many games and programs from it. Since they had reception everywhere in the country I was able to record them from the country side or a monastery too.
- krzyk 6y agoSame in Poland, good memories (not such good government though)
- urtie 6y agoSounds very much like BASICODE[1] which was used to broadcast e.g. tax return software on national public radio in the Netherlands back in the 1980's [1] https://en.wikipedia.org/wiki/BASICODE https://en.wikipedia.org/wiki/BASICODE
- f1refly 6y agoI remember there being a working implementation from chirp.io, with mobile apps and everything. They eventually axed it some years ago and tried selling some sdk to... people? Before getting bought by Sonos. I always missed their service because I used to use it to transfer stuff between my phone and my work computer. I'd be really cool if this could replace chirp for that cause.
- dfischer 6y agoSeems like they sold to Sonos. It redirects there.
- gfodor 6y agoSDP over sound seems pretty brilliant since it removes the weakest link of p2p connecting on a LAN. I'm excited to play with this - I think it could be a good solution for a VR use case I am going to be working on where you want to stream a computer screen to a VR headset with minimal friction.
- Sean-Der 6y agoDo you mind expanding on the `weakest link of P2P connection` on a LAN? I am really interested. I was able to get stuff connecting without signaling via mDNS, and I am working on a RFC now to grow on that idea! * https://github.com/pion/offline-browser-communication https://github.com/pion/offline-browser-communication * https://sean-der.github.io/webrtc-uri/draft-seaduboi-webrtc-uri.html https://sean-der.github.io/webrtc-uri/draft-seaduboi-webrtc-...
- gfodor 6y agoI was referring from a usability standpoint - “go to this URL and hold your headset near your speakers” is kind of the best case scenario.
- dfischer 6y agoProbably don’t have to be too close considering range. Sadly and also cool.
- dfischer 6y agoI’m investigating similar things. Might just rely on a DHT and routing algorithm - I like Yggdrasil’s algo. https://yggdrasil-network.github.io/ https://yggdrasil-network.github.io/
- boomlinde 6y agoWithin a local network segment I there are less involved solutions to the discovery problem, such as link-local multicast.
- brian-armstrong 6y agoThe idea of using this for WebRTC signaling is cool :) Shameless plug: If you like this you might also like https://quiet.github.io/quiet-js/ https://quiet.github.io/quiet-js/
- social_quotient 6y agoThanks for making this lib. We tested it a while back on a project that needed air-gapped data transfer. We ended up doing an animated QR flow but we spent some time with this.
- deleted 6y ago[deleted]
- ignoramous 6y ago> On mobile, using Firefox, the page can remain running in the background even after closing the tab Yikes! Sounds like a privacy nightmare if website can still be running regardless of whether the tab is dismissed or not.
- ggerganov 6y agoThis one happened to me just once, so I decided to put it in the README just in case. After that I have never been able to reproduce it, so it might be just a false positive
- Sean-Der 6y agoIn the README it mentions that mDNS candidates break things[0]. This should still work if you are in the same LAN though, the mDNS name just needs to be encoded properly? Maybe the author was trying to connect across networks that don't support Multicast? However mDNS candidates made this even easier! I stumbled upon this pattern and been trying to convince people that real use cases will be unlocked. * https://github.com/pion/offline-browser-communication https://github.com/pion/offline-browser-communication * https://sean-der.github.io/webrtc-uri/draft-seaduboi-webrtc-uri.html https://sean-der.github.io/webrtc-uri/draft-seaduboi-webrtc-... [0] https://tools.ietf.org/html/draft-mdns-ice-candidates-00 https://tools.ietf.org/html/draft-mdns-ice-candidates-00
- ggerganov 6y agoJust to clarify - the original intent was to use this only between devices in the same LAN, because this way you don't need a server. Having a server, there are much better ways to transfer files.
- Sean-Der 6y agoReally great work on this! I am a big fan of WebRTC. Even if I had a server I would try to use SCTP over DTLS. I have gotten better transfer rates. Not having to worry about HOL blocking and the overhead of TCP.
- em3rgent0rdr 6y agoThe idea of computers transferring information through sounds reminds me of badBIOS malware that sends network packets over ultra-high frequency sound waves to bypass airgaps. [1,2] [1] https://arstechnica.com/information-technology/2013/10/meet-badbios-the-mysterious-mac-and-pc-malware-that-jumps-airgaps/ https://arstechnica.com/information-technology/2013/10/meet-... [2] https://en.wikipedia.org/wiki/BadBIOS https://en.wikipedia.org/wiki/BadBIOS
- primitivesuave 6y agoThis would be a great way to set up an IoT device. It is usually quite time consuming to initialize a new device - negotiating bluetooth, downloading the corresponding app, setting up Alexa integrations, etc. If I could just hold my phone playing a sound that tells the device my WiFi password, I could be up and running in a minute or less.
- slimsag 6y agoMany Chinese WiFi security cameras sold on Amazon do this today. Namely Yi Home security cameras. Others use QR bar-codes, which I think is better for security cameras - but nonetheless the Yi Home ones do it through sound exactly as you described.
- primitivesuave 6y agoThank you for the perspective! I remember back in the day I would rig a photo resistor to an Arduino so I could flash instructions to it with an LED without needing to reprogram.
- cblconfederate 6y agoBut does it work in the cloud? https://asa.scitation.org/doi/10.1121/1.3619789 https://asa.scitation.org/doi/10.1121/1.3619789
- fputz 6y agoAcoustic communication is quite nice for this kind of ad-hoc provisioning, because it doesn't require any special hardware or prior pairing. One security issue is that if you do this in public, an attacker could initiate malicious connections and remove your own transmission via signal cancellation. It's hard to notice that when using an inaudible frequency band. To defend against this, our research team has described a method to protect the integrity of acoustic communication on the physical layer, without requiring any prior key exchange: https://dl.acm.org/doi/10.1145/3395351.3399420 https://dl.acm.org/doi/10.1145/3395351.3399420 PDF: https://arxiv.org/pdf/2005.08572 https://arxiv.org/pdf/2005.08572
- koolba 6y agoWasn’t vanilla Diffie-Hellman designed for this exact yelling-in-a-crowded-room use case?
- fputz 6y agoA regular Diffie-Hellman key exchange is not authenticated, meaning that you don't know who you establish a key with. To authenticate this key exchange, you would need some prior security context (e.g., some shared secret or TLS certificates). In pairing scenarios, you often do not have a prior security context, since the goal is to establish one in the first place. Our approach works without a prior security context by using the physical signal propagation properties of the acoustic signals.
- mongol 6y agoA technology like this could be very useful for password management. You store the passwords in your phone, and transmit them to the computer you are at through sound. No passwords to sync, no need to have an encrypted cloud location. If using a 3.5 mm male-to-male audio cable rather than speakers, no one in the vicinity can overhear either.
- minxomat 6y agoAnd have it be picked up by the nearest GoogleAlexaPod?
- mongol 6y agoTrue, if something like that is in the vicinity, not good. But with a cable like suggested, you you make it harder. I am thinking in the workplace. Edit: Also, communication could be encrypted. The receiver could show a QR code with a one time key, which your phone recognizes and encrypts with.
- admax88q 6y agoIf you're going to use a cable, might as well just use usb so you have a real data connection.
- mongol 6y agoYes but it is not always ok (policywise) to attach USB devices to corporate equipment.
- m4rtink 6y agoNot to mention simple analog channels vs complex modern protocol. Eq. it's unlikely the computer will try to take over your mobile device over an analogue audio channel while there could be viable attacks over an USB connection.
- kaoD 6y ago
- Uptrenda 6y agoMaybe interesting for making apps in the lan more resilient: * No need for port forwarding between network segments * Bypasses annoying local firewalls and security approval * On limited hardware you might literally have no Ethernet, wifi, or blue tooth -- could use this instead * Connectionless -- no zombie sockets tying up the same 'port' when testing client protocols * Can prevent packet sniffing + having to expose services to every node on the LAN directly. Neat one-time, local aspect to it. Have to be in range of devices Probably other benefits. Disadvantage is it would be slow and you would have to add support for it.
- pantulis 6y agoThere are companies already trying to apply this technology, even for payments. Although I don't really see this latest use case, there are other creative applications. https://lisnr.com https://lisnr.com
- pantulis 6y agoI've seen some demos and it kind of impress watching two mobile devices communicating while being in airplane mode :P
- kebman 6y agoFeels like the 1980's all over again. :)
- yuchi 6y agoThis thing is giving me huge cyber punk vibes! Nicely executed (the sound itself is pleasant to hear) and fine balance (the sound is used only to avoid a STUN server, the transmission is happening through a standard WebRTC data channel).
- EGreg 6y agoWhat about the QR codes approach https://aweirdimagination.net/2020/06/14/serverless-webrtc/ https://aweirdimagination.net/2020/06/14/serverless-webrtc/
- sokoloff 6y agoThe old TRS-80 used audio tape to save/load programs. As a 6th grader, I was amused that there was a "TRS-80 network" setup whereby you could cable a classroom of computers together, set all but one of them to "load from tape", then set the teacher's computer to "save to tape" and it all worked. I thought that was a clever bit of engineering/hackery, actually using sound for file-sharing. http://www.trs-80.org/network-1-controller/ http://www.trs-80.org/network-1-controller/
- athenot 6y agoThis is similar to how Webex room systems communicate using Proximity: ultrasounds emitted by a room device are picked up by the laptops / mobile devices of participants and exchange info on how to join. So as you walk into a room, the Telepresence unit recognizes you and allows you a set of actions, but someone in the room next door won't be able to access. This project is cool in that it's exchanging an actual SDP, which could be used for any media negotiation.
- warkdarrior 6y agoCouldn't this be done over BLE?
- barakados 6y agoThis is super cool and I can see tons of practical applications. I wonder if you could utilize this technology with SOFAR Channels in the ocean to create long range passive data transfers.