4 ms·

Magic Wormhole is one of my absolute favourite tools. see also https://wormhole.app/ https://wormhole.app/

gidam 5y ago
to avoid confusion Ferros should have chosen a different and better name, considering that magic-warmhole is an older project doing more or less the same thing (with different and better technology and it's real free software)
atonse 5y ago
Is this open source? How do we know it's doing as advertised?
- deleted 5y ago
  [deleted]
- lotharrr 5y ago
  For (my) magic-wormhole, yep, entirely, source is on the github link above. It uses a pair of helper servers (that I run), for which the source is also on github. But the protocol (implemented in the client, not the server) is carefully designed to be resistant against server misbehavior. So you can either study the client and convince yourself the protocol is indeed secure, or rely upon my claims that my code is working as advertised. But you don't need to rely upon my claims that my servers are not snooping or interfering: that's protected by the protocol.
  - noahmasur 5y ago
    They're actually different projects. This is what I could find for wormhole.app source: https://github.com/SocketDev/wormhole-crypto https://github.com/SocketDev/wormhole-crypto
lotharrr 5y ago
(author of magic-wormhole here) aww, thanks :) BTW for anyone reading, https://wormhole.app/ https://wormhole.app/ is awesome and serves a very similar purpose, but uses entirely different technology (no PAKE) and has a different security model. In my (https://magic-wormhole.io https://magic-wormhole.io) world, we've kicked around ways to make a good browser-based client (and I've tried to prepare the protocols to work well there), but I haven't had time to pursue any of them. The tasks include 1: port everything to JS (or take the core of the Rust port and compile it to WASM, then write an IO layer in JS), 2: glue it to the browser's file/blob upload/download APIs, 3: settle on a trusted-application security model. To make it work in a vanilla browser with no setup phase, you're pretty much limited to relying upon the webserver from which you get the page, which is the model wormhole.app provides. Other options include using an addon (which shifts the reliance set slightly), or running some sort of Electron thing (making it not really a browser app) that you get from some distribution channel (debian, homebrew, etc) which shifts the reliance set in a better direction.. at least you're probably getting the same application as everybody else using that distribution, vs a webserver that could conceivably serve up a different version each time.
- ccmcarey 5y ago
  FYI looks like magic-wormhole.io doesn't listen on 443, only on port 80 (which redicts to github).
- tptacek 5y ago
  For what it's worth, and I know you're not looking for this fight, but I think it's important: There is a world of difference between what Magic Wormhole can promise and what Wormhole.app can promise. Magic Wormhole relies entirely on clientside cryptography; once you have it installed, you can trust that it's doing what it says on the tin. Which means you can reasonably use it operationally. "Wormhole.app" --- which has a frustrating name, given the distinction --- demands that you trust the server, since the server can on every transaction defeat the cryptography you're using. If someone owns up a Magic Wormhole relay server, there's not much they can plausibly do to intercept the files you send. But if someone owns up Wormhole.app, they can, I believe, quietly pick up and store people's files. Incidentally, apropos none of this: I've been using the Golang https://github.com/psanford/wormhole-william https://github.com/psanford/wormhole-william port on some of my machines for a year now, interoperating with the standard Python Magic Wormhole, and it works great. Magic Wormhole is an achievement. I wrote a blog post about modern cryptographic tools, and what I have to say about Magic Wormhole is that everyone I've introduced to it immediately starts wormholing all sorts of stuff; it's kind of addictive. Thanks for designing it!
CobrastanJorji 5y ago
That seems like a wonderful service, but if it allows up to 100 downloads over 24 hours, I kind of worry that it's gonna get massively abused for nefarious purposes. It's not quite "publicly writable S3 bucket" abusable, but it's close.

to avoid confusion Ferros should have chosen a different and better name, considering that magic-warmhole is an older project doing more or less the same thing (with different and better technology and it's real free software)

atonse 5y ago

Is this open source? How do we know it's doing as advertised?

deleted 5y ago
[deleted]
lotharrr 5y ago
For (my) magic-wormhole, yep, entirely, source is on the github link above. It uses a pair of helper servers (that I run), for which the source is also on github. But the protocol (implemented in the client, not the server) is carefully designed to be resistant against server misbehavior. So you can either study the client and convince yourself the protocol is indeed secure, or rely upon my claims that my code is working as advertised. But you don't need to rely upon my claims that my servers are not snooping or interfering: that's protected by the protocol.
- noahmasur 5y ago
  They're actually different projects. This is what I could find for wormhole.app source: https://github.com/SocketDev/wormhole-crypto https://github.com/SocketDev/wormhole-crypto

lotharrr 5y ago

(author of magic-wormhole here) aww, thanks :) BTW for anyone reading, https://wormhole.app/ https://wormhole.app/ is awesome and serves a very similar purpose, but uses entirely different technology (no PAKE) and has a different security model. In my (https://magic-wormhole.io https://magic-wormhole.io) world, we've kicked around ways to make a good browser-based client (and I've tried to prepare the protocols to work well there), but I haven't had time to pursue any of them. The tasks include 1: port everything to JS (or take the core of the Rust port and compile it to WASM, then write an IO layer in JS), 2: glue it to the browser's file/blob upload/download APIs, 3: settle on a trusted-application security model. To make it work in a vanilla browser with no setup phase, you're pretty much limited to relying upon the webserver from which you get the page, which is the model wormhole.app provides. Other options include using an addon (which shifts the reliance set slightly), or running some sort of Electron thing (making it not really a browser app) that you get from some distribution channel (debian, homebrew, etc) which shifts the reliance set in a better direction.. at least you're probably getting the same application as everybody else using that distribution, vs a webserver that could conceivably serve up a different version each time.

ccmcarey 5y ago
FYI looks like magic-wormhole.io doesn't listen on 443, only on port 80 (which redicts to github).
tptacek 5y ago
For what it's worth, and I know you're not looking for this fight, but I think it's important: There is a world of difference between what Magic Wormhole can promise and what Wormhole.app can promise. Magic Wormhole relies entirely on clientside cryptography; once you have it installed, you can trust that it's doing what it says on the tin. Which means you can reasonably use it operationally. "Wormhole.app" --- which has a frustrating name, given the distinction --- demands that you trust the server, since the server can on every transaction defeat the cryptography you're using. If someone owns up a Magic Wormhole relay server, there's not much they can plausibly do to intercept the files you send. But if someone owns up Wormhole.app, they can, I believe, quietly pick up and store people's files. Incidentally, apropos none of this: I've been using the Golang https://github.com/psanford/wormhole-william https://github.com/psanford/wormhole-william port on some of my machines for a year now, interoperating with the standard Python Magic Wormhole, and it works great. Magic Wormhole is an achievement. I wrote a blog post about modern cryptographic tools, and what I have to say about Magic Wormhole is that everyone I've introduced to it immediately starts wormholing all sorts of stuff; it's kind of addictive. Thanks for designing it!

CobrastanJorji 5y ago

That seems like a wonderful service, but if it allows up to 100 downloads over 24 hours, I kind of worry that it's gonna get massively abused for nefarious purposes. It's not quite "publicly writable S3 bucket" abusable, but it's close.