5 ms·
Show HN: Throwaway – single-use, 1-1, e2e encrypted messaging (in-browser)
Hi HN!
Keen to get your thoughts on an encrypted messaging app I've made:
throwaway is an in-browser messaging app. It's specifically for single-use, one-to-one, e2e encrypted messaging. This means your messages are encrypted in your browser, and they are only decrypted when they reach your recipients browser. The messages disappear permanently once both browser windows have closed. You can never recover a throwaway chat; once the window is closed, it's gone forever.
throwaway uses the SubtleCrypto Web API to create a public/private key pair every time it is opened/refreshed (ECDH P-521). You can invite a recipient to start a chat using the invite link; automatically generated when you land on the page. Once a recipient has clicked on the invite link, throwaway generates them a key pair too. The public keys are shared so each user can derive symmetric keys (AES-GCM 256, forward secrecy) to encrypt messages that can only be decrypted by their recipients symmetric key. The private keys and derived symmetric keys never leave the browser window they were created in.
All ideas/thoughts/critiques welcome, thanks!
- cryptoken 5y agoThis is legitimately cool. Nice work!
- bleakbin 5y agoI've been lurking on HN for years but this is the first time I've been inclined to make an account and actually comment on something. The concept behind this is quite simple but I have never seen it presented so well. Just looking at the world we live in today, I can already imagine plenty of use cases for throwaway, e2e encrypted chats! Is there a roadmap for throwaway / what are your plans for features going forward?
- macondorivers 5y agoThe next big feature would be group chats, still the same single-use concept but the ability to get multiple users in a single chat. I'm up for being convinced otherwise but that feels like the logical next step.
- derekzhouzhen 5y agoSimilar programs I have seen hides the secret in the URL fragment, so it was never sent over the wire. However, you have a server side redirect from the invite link; what guaranty that the secret is not leaked? Also, can you implement open graph based link preview? I guess it is hard to do that in the context of E2E.
- macondorivers 5y agoOnly the public keys are transferred over the wire - nothing secret. The private keys and derived symmetric keys remain private in the original browser they were created in. Do you mean open graph based link previews for invite links? What information would you want the previews to contain outside the current metadata? Thanks for your questions!
- derekzhouzhen 5y agoNo, I mean open graph based link preview for whatever people would send in the chat. It is very common for people to send links in chat.
- macondorivers 5y agoAh understood. It’s not on the immediate roadmap but if enough users requested it we’d look into it. So far our users have been most interested in things like forward secrecy, so that was the latest release.