5 ms·

Onionshare – Securely share a file of any size using Tor

114 points by sinak 12y ago

civilian 12y ago
Not super relevant, but I love Flask. It's so nice to quick simple webapp for small applications like this. I love Django too, but https://github.com/micahflee/onionshare/blob/master/onionshare.py https://github.com/micahflee/onionshare/blob/master/onionsha... would be at least be half a dozen files in Django.
- deleted 12y ago
  [deleted]
- StavrosK 12y ago
  You can have single-file Django projects, Flask style. They even work!
  - civilian 12y ago
    "They even work!" Hah, that's reassuring? Here's what I found when I googled for it: https://github.com/readevalprint/mini-django https://github.com/readevalprint/mini-django
    - StavrosK 12y ago
      That looks about right. There's no reason for it not to work, really, Django doesn't have much magic.
- eric_bullington 12y ago
  I'm kind of getting back in to Flask after a flirtation with Go. I think I'll continue to use Go for APIs but for quick web apps there's nothing like Flask, and it's getting pretty decent performance now with PyPy (and PyPy with Gevent now!). I've actually been working today polishing up a skeleton app I use for my Flask apps for other devs to use -- still rewriting but I'll throw this out there since it's already pretty usable for small-to-midsized projects (MIT license): https://github.com/esbullington/flask-bootstrap https://github.com/esbullington/flask-bootstrap
  - odonnellryan 12y ago
    Just curious, why do you do your URL routing that way? https://github.com/esbullington/flask-bootstrap/blob/master/app/__init__.py#L47 https://github.com/esbullington/flask-bootstrap/blob/master/...
    - eric_bullington 12y ago
      Well, I think that as your app grows, it's not a bad idea to keep routing separate from the controllers. I may even put them into their own file as I extend this project to support blueprints.
zaroth 12y ago
Really....? I guess an NSA honeypot would be more subtle, but seriously I don't know whether to be sad or angry; def check_auth(username, password): global auth_username, auth_password return username == auth_username and password == auth_password
- codys 12y ago
  What is being complained about here? The obvious thing that stands out to me is potential timing attacks: 'and' doing short circuit eval, and '==' exiting early when the first byte is non-equal (or the lengths are non-equal).
  - zaroth 12y ago
    You nailed it. In other words, literally everything is wrong with that function.
    - michaelmior 12y ago
      I would agree with the other comment that I suspect it would be impossible to get accurate data for a timing attack over Tor. Not only is the connection slow, but my experience has been that bandwidth and latency can be highly variable.
      - handsomeransoms 12y ago
        With enough sampling, it should be possible. Additionally, the values you are trying to infer are pretty small (8 bytes each) so that makes it easier.
        michaelmior 12y ago
        Fair point. I'll admit I'm biased because I've messed around with trying time attacks on my vulnerable code in arguably ideal scenarios and haven't had much luck. So the feasibility of this is questionable to me, but I'm willing to accept that it's an issue. In any case, the above block of code should be easily fixable.
liotier 12y ago
If you are going to run a hidden service, be aware that running a Tor router and a hidden service on the same host - doing so may expose the location of the hidden service: http://cybermashup.com/2013/09/04/dont-run-a-tor-router-and-a-hidden-service-from-the-same-connection/ http://cybermashup.com/2013/09/04/dont-run-a-tor-router-and-...
akerl_ 12y ago
Previous thread on the article published for this project: https://news.ycombinator.com/item?id=7780488 https://news.ycombinator.com/item?id=7780488

114 points by sinak 12y ago

Not super relevant, but I love Flask. It's so nice to quick simple webapp for small applications like this. I love Django too, but https://github.com/micahflee/onionshare/blob/master/onionshare.py https://github.com/micahflee/onionshare/blob/master/onionsha... would be at least be half a dozen files in Django.

deleted 12y ago
[deleted]
StavrosK 12y ago
You can have single-file Django projects, Flask style. They even work!
- civilian 12y ago
  "They even work!" Hah, that's reassuring? Here's what I found when I googled for it: https://github.com/readevalprint/mini-django https://github.com/readevalprint/mini-django
  - StavrosK 12y ago
    That looks about right. There's no reason for it not to work, really, Django doesn't have much magic.
eric_bullington 12y ago
I'm kind of getting back in to Flask after a flirtation with Go. I think I'll continue to use Go for APIs but for quick web apps there's nothing like Flask, and it's getting pretty decent performance now with PyPy (and PyPy with Gevent now!). I've actually been working today polishing up a skeleton app I use for my Flask apps for other devs to use -- still rewriting but I'll throw this out there since it's already pretty usable for small-to-midsized projects (MIT license): https://github.com/esbullington/flask-bootstrap https://github.com/esbullington/flask-bootstrap
- odonnellryan 12y ago
  Just curious, why do you do your URL routing that way? https://github.com/esbullington/flask-bootstrap/blob/master/app/__init__.py#L47 https://github.com/esbullington/flask-bootstrap/blob/master/...
  - eric_bullington 12y ago
    Well, I think that as your app grows, it's not a bad idea to keep routing separate from the controllers. I may even put them into their own file as I extend this project to support blueprints.

zaroth 12y ago

Really....? I guess an NSA honeypot would be more subtle, but seriously I don't know whether to be sad or angry; def check_auth(username, password): global auth_username, auth_password return username == auth_username and password == auth_password

codys 12y ago
What is being complained about here? The obvious thing that stands out to me is potential timing attacks: 'and' doing short circuit eval, and '==' exiting early when the first byte is non-equal (or the lengths are non-equal).
- zaroth 12y ago
  You nailed it. In other words, literally everything is wrong with that function.
  - michaelmior 12y ago
    I would agree with the other comment that I suspect it would be impossible to get accurate data for a timing attack over Tor. Not only is the connection slow, but my experience has been that bandwidth and latency can be highly variable.
    - handsomeransoms 12y ago
      With enough sampling, it should be possible. Additionally, the values you are trying to infer are pretty small (8 bytes each) so that makes it easier.
      - michaelmior 12y ago
        Fair point. I'll admit I'm biased because I've messed around with trying time attacks on my vulnerable code in arguably ideal scenarios and haven't had much luck. So the feasibility of this is questionable to me, but I'm willing to accept that it's an issue. In any case, the above block of code should be easily fixable.

liotier 12y ago

If you are going to run a hidden service, be aware that running a Tor router and a hidden service on the same host - doing so may expose the location of the hidden service: http://cybermashup.com/2013/09/04/dont-run-a-tor-router-and-a-hidden-service-from-the-same-connection/ http://cybermashup.com/2013/09/04/dont-run-a-tor-router-and-...

akerl_ 12y ago

Previous thread on the article published for this project: https://news.ycombinator.com/item?id=7780488 https://news.ycombinator.com/item?id=7780488