3 ms·

Yea you're right, we just didn't get around to it yet. Thanks for the issue.

StavrosK 13y ago
You are quite welcome, hopefully you'll find some time soon, it would make Sharefest the file transfer mode of choice for paranoid people like me :)
- arethuza 13y ago
  Out of interest, if the decryption is being done in a client by JavaScript, what's stopping a MITM attacker replacing the JavaScript crypto library with something that captures the source URL and key?
  - skymt 13y ago
    That's a well-known problem with JavaScript crypto: http://www.matasano.com/articles/javascript-cryptography/ http://www.matasano.com/articles/javascript-cryptography/ The short answer is that so long as the page is loaded entirely over TLS, and the TLS isn't stripped or subverted in any way, it's safe from MITM. Sharefest doesn't currently support TLS, so they would need to set that up prior to enabling end-to-end encryption.
    - shacharz 13y ago
      The P2P crypto is done by the browser. But not doubt that we need to load the entire page and scripts securely securely...
  - StavrosK 13y ago
    Nothing (assuming the MITM is someone who can break HTTPS or Peer5 themselves), which is why I proposed this: https://github.com/Peer5/ShareFest/issues/30#issuecomment-20554455 https://github.com/Peer5/ShareFest/issues/30#issuecomment-20... You can download ShareFest, audit it and store it locally so you can run your known-good version. It's just an HTML page and a few JS files (or at least it was, last time I looked). I was going to create a version of this that was a single webpage and had as little code as possible (for auditability and ease of saving/deployment), but other projects got in the way (plus it's easier to improve ShareFest than write it from scratch).
- 1O0101ll100O 13y ago
  It's clearly not baseless paranoia anymore.
  - StavrosK 13y ago
    That's true, I guess. The funny thing is that the most I ever transfer is family photos and code, but I don't see why anyone should be able to look at even my family photos.

You are quite welcome, hopefully you'll find some time soon, it would make Sharefest the file transfer mode of choice for paranoid people like me :)

arethuza 13y ago
Out of interest, if the decryption is being done in a client by JavaScript, what's stopping a MITM attacker replacing the JavaScript crypto library with something that captures the source URL and key?
- skymt 13y ago
  That's a well-known problem with JavaScript crypto: http://www.matasano.com/articles/javascript-cryptography/ http://www.matasano.com/articles/javascript-cryptography/ The short answer is that so long as the page is loaded entirely over TLS, and the TLS isn't stripped or subverted in any way, it's safe from MITM. Sharefest doesn't currently support TLS, so they would need to set that up prior to enabling end-to-end encryption.
  - shacharz 13y ago
    The P2P crypto is done by the browser. But not doubt that we need to load the entire page and scripts securely securely...
- StavrosK 13y ago
  Nothing (assuming the MITM is someone who can break HTTPS or Peer5 themselves), which is why I proposed this: https://github.com/Peer5/ShareFest/issues/30#issuecomment-20554455 https://github.com/Peer5/ShareFest/issues/30#issuecomment-20... You can download ShareFest, audit it and store it locally so you can run your known-good version. It's just an HTML page and a few JS files (or at least it was, last time I looked). I was going to create a version of this that was a single webpage and had as little code as possible (for auditability and ease of saving/deployment), but other projects got in the way (plus it's easier to improve ShareFest than write it from scratch).
1O0101ll100O 13y ago
It's clearly not baseless paranoia anymore.
- StavrosK 13y ago
  That's true, I guess. The funny thing is that the most I ever transfer is family photos and code, but I don't see why anyone should be able to look at even my family photos.