7 ms·

Wormhole-crypto: Streaming encryption based on Encrypted Content-Encoding

61 points by feross 6y ago

tptacek 6y ago
There's already a very good, popular encrypted file sharing system called Magic Wormhole, with implementations in multiple languages. https://github.com/magic-wormhole/magic-wormhole https://github.com/magic-wormhole/magic-wormhole
- remram 6y ago
  Damn, someone made wormhole.app and it does the same thing but is unrelated to magic-wormhole? That's seriously uncool.
  - iaml 6y ago
    What is uncool is that it's using AES-GCM in all of its 128 bit glory, which is subpar compared to just using libsodium like magic-wormhole does.
    - feross 6y ago
      Please don't spread FUD. AES-GCM 128 is perfectly fine and it's standard for a reason.
      - tptacek 6y ago
        AES-GCM is imperfectly fine and its standard has nothing to do with any of it. It's inferior in more than one way to the Chapoly-style ciphers in Sodium. Case in point: it looks like if callers to your ECE library pass in a repeated salt through Keychain for any reason, you'll generate a duplicate nonce, which blows up GCM. There are authenticated ciphers that mitigate this problem (most commonly: by having a nonce wide enough that you can simply always generate it randomly without requiring callers to manage it); GCM, on the other hand, is the poster child for that flaw. Since this is browser crypto, and not native execution like Magic Wormhole, all of this is irrelevant; the important distinction between the two projects isn't that one uses a lesser cryptosystem, but rather that the other uses real end-to-end cryptography and the other uses client-server cryptography pretending to be end-to-end.
        feross 6y ago
        > the other uses client-server cryptography pretending to be end-to-end This is misleading and false. Wormhole.app uses end-to-end encryption. To address the larger point – auditing a web app is indeed challenging with current web technologies. In the past, I experimented with a technique using App Cache to permanently cache a web app on first use [1]. Later, that technique was expanded into hyperboot [2] to give users the benefits of explicit, immutable versioning with control over upgrades using the html-version-spec while preserving the simplicity of passing around a URL. With the impending removal of AppCache from most browsers, the web is currently missing a way to "pin" a site to a specific version and only update it with user consent. Service Workers come close but they mandate a 24 hour maximum cache time before refetching from the server. We'd love to offer the usability benefits of web apps – you can give someone a URL and they can immediately load the app – with the security of installed apps – doesn't change without warning – once web standards catch up. This is something that I care deeply about. In the meantime, use magic-wormhole if you prefer a locally-installed command line tool and you're sending files to someone who understands the command line. Use Wormhole.app if you want usable end-to-end encryption, similar to what Firefox Send used to provide. [1]: https://github.com/feross/infinite-app-cache https://github.com/feross/infinite-app-cache [2]: https://github.com/substack/hyperboot https://github.com/substack/hyperboot
        tptacek 6y ago
        I stand by my analysis.
        psanford 6y ago
        > if you prefer a locally-installed command line tool and you're sending files to someone who understands the command line There's at least one good desktop GUI for Magic Wormhole[0]. I've also recently released an Magic Wormhole Android app[1][2]. [0]: https://github.com/Jacalz/wormhole-gui https://github.com/Jacalz/wormhole-gui [1]: https://github.com/psanford/wormhole-william-mobile https://github.com/psanford/wormhole-william-mobile [2]: https://play.google.com/store/apps/details?id=io.sanford.wormhole_william https://play.google.com/store/apps/details?id=io.sanford.wor...
        6y ago
  - minitech 6y ago
    I know, right? It’d be like making a linter configuration for your personal JavaScript style and naming it “JavaScript Standard Style”.
    - feross 6y ago
      More like making a linter configuration for your personal JavaScript style and then seeing the creator of JavaScript repeatedly endorse it [1][2][3][4][5][6][7]. Not to mention, the creator of the Web too [8]. EDIT: You might not like StandardJS – that's fine, feel free to use something else – but it's helped a lot of teams avoid pointless style debates and it's downloaded 1M+ times per month. [1]: https://twitter.com/BrendanEich/status/1149082576847400960 https://twitter.com/BrendanEich/status/1149082576847400960 [2]: https://twitter.com/BrendanEich/status/951558694570901504 https://twitter.com/BrendanEich/status/951558694570901504 [3]: https://twitter.com/BrendanEich/status/1157658128004997121 https://twitter.com/BrendanEich/status/1157658128004997121 [4]: https://twitter.com/BrendanEich/status/1126229937197707265 https://twitter.com/BrendanEich/status/1126229937197707265 [5]: https://twitter.com/BrendanEich/status/1014671417084792832 https://twitter.com/BrendanEich/status/1014671417084792832 [6]: https://twitter.com/BrendanEich/status/1378443247576440835 https://twitter.com/BrendanEich/status/1378443247576440835 [7]: https://twitter.com/BrendanEich/status/1170710893832753166 https://twitter.com/BrendanEich/status/1170710893832753166 [8]: https://twitter.com/feross/status/740592720230518784 https://twitter.com/feross/status/740592720230518784
- xd1936 6y ago
  My comment on this on ProductHunt, and the developer's response: https://www.producthunt.com/posts/wormhole-2#comment-1312733 https://www.producthunt.com/posts/wormhole-2#comment-1312733
- feross 6y ago
  Wormhole.app and magic-wormhole have different goals. Wormhole.app works in the browser, which means that it provides usable security to normal people. No `pip install` or command line needed. Wormhole.app stores end-to-end encrypted files for 24 hours so the share link continues to work even after the sender closes the tab or powers off their device.
  - psanford 6y ago
    Indeed it is different enough to justify using a different name.
  - phildenhoff 6y ago
    I was very excited to check this out, as I imagined `Wormhole.app` was a MacOS package for `magic-wormhole`, but, alas, it's just a web app with a very similar name.
    - feross 6y ago
      Then you'll also be disappointed if you run: $ brew info wormhole wormhole: 1.5.4 https://er.run/ Not installed From: https://github.com/Homebrew/homebrew-cask/blob/HEAD/Casks/wormhole.rb ==> Name Wormhole ==> Description Browse & Control phone on PC, Screen Fusion for iOS & Android ==> Artifacts Wormhole.app (App)
      - tptacek 6y ago
        I'm sure you can see the distinction between two unrelated projects being called "wormhole" and two almost identical projects sharing the same name.
      - neolog 6y ago
        Trademark law uses the "likelihood of confusion" concept.
  - BiteCode_dev 6y ago
    It creates confusion since both share the word wormhole and the goal the share files. If you still can, changing the name of your product would help a lot, and also show respect to the older FOSS project.
- Klonoar 6y ago
  This was also previously called out on HN. https://news.ycombinator.com/item?id=26666142 https://news.ycombinator.com/item?id=26666142
- sweis 6y ago
  There's also a web-based relay for magic-wormhole: https://webwormhole.io/ https://webwormhole.io/ https://github.com/saljam/webwormhole https://github.com/saljam/webwormhole
feross 6y ago
I'm one of the creators of Wormhole.app. Just want to highlight our $1000+ bug bounty program for responsible disclosure of security issues. Both the cryptography code and the website itself are in scope. More details here: https://wormhole.app/security/disclosure https://wormhole.app/security/disclosure
phildenhoff 6y ago
Another note to the developers of this site: I'm not sure if you've tested with Safari, but if you attempt to upload a file over 1 GB you'll get a number of prompts asking if you'd like to allow the website to use an amount of disk space, which showed up in increments of 200-400 MB for me. "Do you want to allow this site to use 1GB of space on your Mac?" "Do you want to allow this site to use 1.2GB of space on your Mac?" "Do you want to allow this site to use 1.4GB of space on your Mac?" etc. It's rather an annoying bug.
- feross 6y ago
  This is an unfortunate Safari limitation that Apple has intentionally put in place. We'd like to be able to use temporary storage space on the user's device (which can be automatically cleared as soon as the user or another app needs it). But Safari gives web apps a 1GB limit after which the app must prompt the user for an additional allocation of 200MB. So if the app needs e.g. 5GB of space the user will need to click "okay" on twenty prompts for 200MB more space to make the app work. Needless to say, this is totally ridiculous and definitely not an API that Apple would ever find acceptable to ship for native iOS apps. It's hard to see Apple's decisions here as anything but outright hostile to the web and designed to push developers into making native apps. It's especially ironic given that Apple recently suggested [1] to Australian authorities that they can't possibly have a monopoly on app distribution since they have no restrictions against developers distributing PWAs which "have the look, feel and functionality of a native app". But what they fail to mention is that they control exactly what functionality is actually available to web apps. And right now it's A LOT less than what is available to web apps. Furthermore, most users are not aware that other iOS browsers like Chrome, Brave, and Firefox are actually just "light UI skins" on top of the Safari browser engine, Webkit, because Apple refuses to allow third party browser engines on iOS. So this means that it's not possible for users to just switch to another browser in order to use more powerful web apps. They're literally prevented from doing so by Apple's policy to ban browser competition on iOS. [1]: https://www.accc.gov.au/system/files/Apple%20Pty%20Limited%20%2810%20February%202021%29.pdf https://www.accc.gov.au/system/files/Apple%20Pty%20Limited%2...
deleted 6y ago
[deleted]
deleted 6y ago
[deleted]
klabb3 6y ago
Wormhole.app mentions that the transfer is p2p AND that the encrypted files are stored on the server for 24 hours. Does the client send two streams (1 to server - 1 p2p)? What happens e.g. if the receiver client comes online during an ongoing upload to the server?
- feross 6y ago
  In that case we send two streams - one for the upload, and one for the receiver. We should probably optimize this further. I think pausing the server upload until the P2P transfer finishes would increase overall transfer speed.
  - codezero 6y ago
    Or have both clients upload different parts to the server over the course of the transfer, and optimize for the client with the highest upload speed to do most of the heavy lifting (this assumes you want the server to definitely have a full copy first). Sounds like I'm saying make the server another peer as you may get even more transfer speed sending half the file to the server, then the other half from the server and sender to the receiver - depending on which you want to have the complete file first/faster/at all (more general).
qbasic_forever 6y ago
I love the serendipity of thinking about a problem earlier this week and wishing I had a trusted, encrypted, identity-aware pipe I could throw on top of a websocket or similar connection... and a few days later here it is on HN. Looks like a nifty project!

61 points by feross 6y ago

There's already a very good, popular encrypted file sharing system called Magic Wormhole, with implementations in multiple languages. https://github.com/magic-wormhole/magic-wormhole https://github.com/magic-wormhole/magic-wormhole

remram 6y ago
Damn, someone made wormhole.app and it does the same thing but is unrelated to magic-wormhole? That's seriously uncool.
- iaml 6y ago
  What is uncool is that it's using AES-GCM in all of its 128 bit glory, which is subpar compared to just using libsodium like magic-wormhole does.
  - feross 6y ago
    Please don't spread FUD. AES-GCM 128 is perfectly fine and it's standard for a reason.
    - tptacek 6y ago
      AES-GCM is imperfectly fine and its standard has nothing to do with any of it. It's inferior in more than one way to the Chapoly-style ciphers in Sodium. Case in point: it looks like if callers to your ECE library pass in a repeated salt through Keychain for any reason, you'll generate a duplicate nonce, which blows up GCM. There are authenticated ciphers that mitigate this problem (most commonly: by having a nonce wide enough that you can simply always generate it randomly without requiring callers to manage it); GCM, on the other hand, is the poster child for that flaw. Since this is browser crypto, and not native execution like Magic Wormhole, all of this is irrelevant; the important distinction between the two projects isn't that one uses a lesser cryptosystem, but rather that the other uses real end-to-end cryptography and the other uses client-server cryptography pretending to be end-to-end.
      - feross 6y ago
        > the other uses client-server cryptography pretending to be end-to-end This is misleading and false. Wormhole.app uses end-to-end encryption. To address the larger point – auditing a web app is indeed challenging with current web technologies. In the past, I experimented with a technique using App Cache to permanently cache a web app on first use [1]. Later, that technique was expanded into hyperboot [2] to give users the benefits of explicit, immutable versioning with control over upgrades using the html-version-spec while preserving the simplicity of passing around a URL. With the impending removal of AppCache from most browsers, the web is currently missing a way to "pin" a site to a specific version and only update it with user consent. Service Workers come close but they mandate a 24 hour maximum cache time before refetching from the server. We'd love to offer the usability benefits of web apps – you can give someone a URL and they can immediately load the app – with the security of installed apps – doesn't change without warning – once web standards catch up. This is something that I care deeply about. In the meantime, use magic-wormhole if you prefer a locally-installed command line tool and you're sending files to someone who understands the command line. Use Wormhole.app if you want usable end-to-end encryption, similar to what Firefox Send used to provide. [1]: https://github.com/feross/infinite-app-cache https://github.com/feross/infinite-app-cache [2]: https://github.com/substack/hyperboot https://github.com/substack/hyperboot
        tptacek 6y ago
        I stand by my analysis.
        psanford 6y ago
        > if you prefer a locally-installed command line tool and you're sending files to someone who understands the command line There's at least one good desktop GUI for Magic Wormhole[0]. I've also recently released an Magic Wormhole Android app[1][2]. [0]: https://github.com/Jacalz/wormhole-gui https://github.com/Jacalz/wormhole-gui [1]: https://github.com/psanford/wormhole-william-mobile https://github.com/psanford/wormhole-william-mobile [2]: https://play.google.com/store/apps/details?id=io.sanford.wormhole_william https://play.google.com/store/apps/details?id=io.sanford.wor...
      - 6y ago
- minitech 6y ago
  I know, right? It’d be like making a linter configuration for your personal JavaScript style and naming it “JavaScript Standard Style”.
  - feross 6y ago
    More like making a linter configuration for your personal JavaScript style and then seeing the creator of JavaScript repeatedly endorse it [1][2][3][4][5][6][7]. Not to mention, the creator of the Web too [8]. EDIT: You might not like StandardJS – that's fine, feel free to use something else – but it's helped a lot of teams avoid pointless style debates and it's downloaded 1M+ times per month. [1]: https://twitter.com/BrendanEich/status/1149082576847400960 https://twitter.com/BrendanEich/status/1149082576847400960 [2]: https://twitter.com/BrendanEich/status/951558694570901504 https://twitter.com/BrendanEich/status/951558694570901504 [3]: https://twitter.com/BrendanEich/status/1157658128004997121 https://twitter.com/BrendanEich/status/1157658128004997121 [4]: https://twitter.com/BrendanEich/status/1126229937197707265 https://twitter.com/BrendanEich/status/1126229937197707265 [5]: https://twitter.com/BrendanEich/status/1014671417084792832 https://twitter.com/BrendanEich/status/1014671417084792832 [6]: https://twitter.com/BrendanEich/status/1378443247576440835 https://twitter.com/BrendanEich/status/1378443247576440835 [7]: https://twitter.com/BrendanEich/status/1170710893832753166 https://twitter.com/BrendanEich/status/1170710893832753166 [8]: https://twitter.com/feross/status/740592720230518784 https://twitter.com/feross/status/740592720230518784
xd1936 6y ago
My comment on this on ProductHunt, and the developer's response: https://www.producthunt.com/posts/wormhole-2#comment-1312733 https://www.producthunt.com/posts/wormhole-2#comment-1312733
feross 6y ago
Wormhole.app and magic-wormhole have different goals. Wormhole.app works in the browser, which means that it provides usable security to normal people. No `pip install` or command line needed. Wormhole.app stores end-to-end encrypted files for 24 hours so the share link continues to work even after the sender closes the tab or powers off their device.
- psanford 6y ago
  Indeed it is different enough to justify using a different name.
- phildenhoff 6y ago
  I was very excited to check this out, as I imagined `Wormhole.app` was a MacOS package for `magic-wormhole`, but, alas, it's just a web app with a very similar name.
  - feross 6y ago
    Then you'll also be disappointed if you run: $ brew info wormhole wormhole: 1.5.4 https://er.run/ Not installed From: https://github.com/Homebrew/homebrew-cask/blob/HEAD/Casks/wormhole.rb ==> Name Wormhole ==> Description Browse & Control phone on PC, Screen Fusion for iOS & Android ==> Artifacts Wormhole.app (App)
    - tptacek 6y ago
      I'm sure you can see the distinction between two unrelated projects being called "wormhole" and two almost identical projects sharing the same name.
    - neolog 6y ago
      Trademark law uses the "likelihood of confusion" concept.
- BiteCode_dev 6y ago
  It creates confusion since both share the word wormhole and the goal the share files. If you still can, changing the name of your product would help a lot, and also show respect to the older FOSS project.
Klonoar 6y ago
This was also previously called out on HN. https://news.ycombinator.com/item?id=26666142 https://news.ycombinator.com/item?id=26666142
sweis 6y ago
There's also a web-based relay for magic-wormhole: https://webwormhole.io/ https://webwormhole.io/ https://github.com/saljam/webwormhole https://github.com/saljam/webwormhole

feross 6y ago

I'm one of the creators of Wormhole.app. Just want to highlight our $1000+ bug bounty program for responsible disclosure of security issues. Both the cryptography code and the website itself are in scope. More details here: https://wormhole.app/security/disclosure https://wormhole.app/security/disclosure

phildenhoff 6y ago

Another note to the developers of this site: I'm not sure if you've tested with Safari, but if you attempt to upload a file over 1 GB you'll get a number of prompts asking if you'd like to allow the website to use an amount of disk space, which showed up in increments of 200-400 MB for me. "Do you want to allow this site to use 1GB of space on your Mac?" "Do you want to allow this site to use 1.2GB of space on your Mac?" "Do you want to allow this site to use 1.4GB of space on your Mac?" etc. It's rather an annoying bug.

feross 6y ago
This is an unfortunate Safari limitation that Apple has intentionally put in place. We'd like to be able to use temporary storage space on the user's device (which can be automatically cleared as soon as the user or another app needs it). But Safari gives web apps a 1GB limit after which the app must prompt the user for an additional allocation of 200MB. So if the app needs e.g. 5GB of space the user will need to click "okay" on twenty prompts for 200MB more space to make the app work. Needless to say, this is totally ridiculous and definitely not an API that Apple would ever find acceptable to ship for native iOS apps. It's hard to see Apple's decisions here as anything but outright hostile to the web and designed to push developers into making native apps. It's especially ironic given that Apple recently suggested [1] to Australian authorities that they can't possibly have a monopoly on app distribution since they have no restrictions against developers distributing PWAs which "have the look, feel and functionality of a native app". But what they fail to mention is that they control exactly what functionality is actually available to web apps. And right now it's A LOT less than what is available to web apps. Furthermore, most users are not aware that other iOS browsers like Chrome, Brave, and Firefox are actually just "light UI skins" on top of the Safari browser engine, Webkit, because Apple refuses to allow third party browser engines on iOS. So this means that it's not possible for users to just switch to another browser in order to use more powerful web apps. They're literally prevented from doing so by Apple's policy to ban browser competition on iOS. [1]: https://www.accc.gov.au/system/files/Apple%20Pty%20Limited%20%2810%20February%202021%29.pdf https://www.accc.gov.au/system/files/Apple%20Pty%20Limited%2...

deleted 6y ago

[deleted]

deleted 6y ago

[deleted]

klabb3 6y ago

Wormhole.app mentions that the transfer is p2p AND that the encrypted files are stored on the server for 24 hours. Does the client send two streams (1 to server - 1 p2p)? What happens e.g. if the receiver client comes online during an ongoing upload to the server?

feross 6y ago
In that case we send two streams - one for the upload, and one for the receiver. We should probably optimize this further. I think pausing the server upload until the P2P transfer finishes would increase overall transfer speed.
- codezero 6y ago
  Or have both clients upload different parts to the server over the course of the transfer, and optimize for the client with the highest upload speed to do most of the heavy lifting (this assumes you want the server to definitely have a full copy first). Sounds like I'm saying make the server another peer as you may get even more transfer speed sending half the file to the server, then the other half from the server and sender to the receiver - depending on which you want to have the complete file first/faster/at all (more general).

qbasic_forever 6y ago

I love the serendipity of thinking about a problem earlier this week and wishing I had a trusted, encrypted, identity-aware pipe I could throw on top of a websocket or similar connection... and a few days later here it is on HN. Looks like a nifty project!