3 ms·

I've been playing around with this, and it's pretty cool. Say I want to share a single file with a developer - maybe it's a config file, or a simple script, or

by fwip 6y ago

I've been playing around with this, and it's pretty cool. Say I want to share a single file with a developer - maybe it's a config file, or a simple script, or a secret token. I would run: hyperbeam hey-jane-here-you-go < mygoodfile.txt And Jane would run, on her end: hyperbeam hey-jane-here-you-go > fwips-good-file.txt Note that the existence of npx makes this even simpler! You can tell your friend over discord "Hey, type in: 'npx hyperbeam hey-jane-here-you-go' and you'll get what I'm sending you. :)" Note that "hey-jane-here-you-go" is effectively a one-time passphrase that I'm using, and will only be sent to computers listening for that exact passphrase at the time you send it. If you're sending military secrets, you might need to use very long and complicated passphrases. But if you're sending a cat picture, you could probably use "for-jane" without risk of collision.

walrus01 6y ago
From the documentation for hyperswarm, it appears the 'topic' (the shared secret) is limited to 32 bytes, so I don't see how that can be used for a very long crypto key.
- anchpop 6y ago
  Is 256 bits not enough? I'm curious what the standard is
nullc 6y ago
> you could probably use "for-jane" without risk of collision Sounds like it's begging for some troublemaker to build up a dictionary by cracking past exchanges and stock wordlists then intercepting other people's sessions as they show up. (I know there is a timestamp based salt, but the attacker can even precompute the values for their dictionary far into the future) This feels like the tor HS enumeration attack but a lot worse, since once you find one you can intercept its traffic. It would be nice if there were a separate "name" and password, and the password used a zero knowledge secret comparison. Troublemakers could still block your sessions but they wouldn't have much luck trying to guess even fairly weak passwords.

by fwip 6y ago

walrus01 6y ago

From the documentation for hyperswarm, it appears the 'topic' (the shared secret) is limited to 32 bytes, so I don't see how that can be used for a very long crypto key.

anchpop 6y ago
Is 256 bits not enough? I'm curious what the standard is

nullc 6y ago

> you could probably use "for-jane" without risk of collision Sounds like it's begging for some troublemaker to build up a dictionary by cracking past exchanges and stock wordlists then intercepting other people's sessions as they show up. (I know there is a timestamp based salt, but the attacker can even precompute the values for their dictionary far into the future) This feels like the tor HS enumeration attack but a lot worse, since once you find one you can intercept its traffic. It would be nice if there were a separate "name" and password, and the password used a zero knowledge secret comparison. Troublemakers could still block your sessions but they wouldn't have much luck trying to guess even fairly weak passwords.