5 ms·

Show HN: EphChat – Ephemeral, Anonymous, Encrypted Realtime Chat

17 points by bmmayer1 12y ago

aaronbasssett 12y ago
Really? I wouldn't trust this with any form of secure communication. https://ephchat.com/?room=%3C/title%3E%3Cimg%20src=%22http://i.imgur.com/FdxVfli.png%22%20/%3E%3C/head%3E https://ephchat.com/?room=%3C/title%3E%3Cimg%20src=%22http:/...
- corobo 12y ago
  works in chat message too, just got redirected to example.com and someone's embedding an audio file using their username so I'm guessing there's just no sanitization anywhere
nullc 12y ago
uhh. trivial HTML injection, "trust us" security model. lame.
sarciszewski 12y ago
Where is the server source code? I'm not seeing where messages are stored/transmitted to clients? Also https://github.com/bmmayer/ephchat/issues/2 https://github.com/bmmayer/ephchat/issues/2
- joeyspn 12y ago
  It is a simple websockets chat using Firebase... https://github.com/firebase/firechat https://github.com/firebase/firechat
- system_32 12y ago
  You criticized about the random code generation function. Could you explain why it is bad? Though I code, I am no expert and would really like to know.
  - sarciszewski 12y ago
    This is the offending code: https://github.com/bmmayer/ephchat/blob/ec375c7974ea825f887ff4ca1cca2349018a187e/php/functions.php#L4-L20 https://github.com/bmmayer/ephchat/blob/ec375c7974ea825f887f... This is the proper way to do it (h/t @tptacek): http://sockpuppet.org/blog/2014/02/25/safely-generate-random-numbers/ http://sockpuppet.org/blog/2014/02/25/safely-generate-random... mt_srand() + rand() is just hilarious. The md5(uniquid()) thing is a common randomness anti-pattern in PHP projects that needs to die in a fire. In PHP, a very brief example of the code to achieve the proper way of generating randomness looks like the snippet I posted in the issue.
joeyspn 12y ago
This is not secure at all. I expected some kind of XMPP-OTR stuff...
alvyHere 12y ago
The text I type to the room is cached locally.
mpgarate 12y ago
Reminds me of a little encrypted chat app I made with a friend a few weeks ago. Ours is intended for two-way communication: http://cifrachat.herokuapp.com/ http://cifrachat.herokuapp.com/
asdad 12y ago
Is firebase even open source? How is this anonymous? Does anyone know what data firebase collects from its users?
qeorge 12y ago
This is misleading - it uses Firebase for the server! How can the OP claim that the server is not storing messages if the OP doesn't control the server? I have no reason to trust that Firebase isn't storing the messages. Why should I?
pjc50 12y ago
Judging by the other comments, this is a good example of all the ways not to build such a system.
seagrass 12y ago
1. Open ephchat. 2. Click change name. 3. Paste the following contents and hit enter. <img src="#" onerror="javascript:void(function(setVal,sendClick,text){setVal.value=text;sendClick.click();}(document.querySelector('#chatText'),document.querySelector('#chatButton'),'hello'))"/>hi
- lytedev 12y ago
  And this is why you absolutely never trust user input.
- bmmayer1 12y ago
  This has been fixed. Thanks!
  - seagrass 12y ago
    Nice!
arcameron 12y ago
For something a bit better, check out https://chat.echoplex.us https://chat.echoplex.us Or description at https://echoplex.us https://echoplex.us

17 points by bmmayer1 12y ago

Really? I wouldn't trust this with any form of secure communication. https://ephchat.com/?room=%3C/title%3E%3Cimg%20src=%22http://i.imgur.com/FdxVfli.png%22%20/%3E%3C/head%3E https://ephchat.com/?room=%3C/title%3E%3Cimg%20src=%22http:/...

corobo 12y ago
works in chat message too, just got redirected to example.com and someone's embedding an audio file using their username so I'm guessing there's just no sanitization anywhere

nullc 12y ago

uhh. trivial HTML injection, "trust us" security model. lame.

sarciszewski 12y ago

Where is the server source code? I'm not seeing where messages are stored/transmitted to clients? Also https://github.com/bmmayer/ephchat/issues/2 https://github.com/bmmayer/ephchat/issues/2

joeyspn 12y ago
It is a simple websockets chat using Firebase... https://github.com/firebase/firechat https://github.com/firebase/firechat
system_32 12y ago
You criticized about the random code generation function. Could you explain why it is bad? Though I code, I am no expert and would really like to know.
- sarciszewski 12y ago
  This is the offending code: https://github.com/bmmayer/ephchat/blob/ec375c7974ea825f887ff4ca1cca2349018a187e/php/functions.php#L4-L20 https://github.com/bmmayer/ephchat/blob/ec375c7974ea825f887f... This is the proper way to do it (h/t @tptacek): http://sockpuppet.org/blog/2014/02/25/safely-generate-random-numbers/ http://sockpuppet.org/blog/2014/02/25/safely-generate-random... mt_srand() + rand() is just hilarious. The md5(uniquid()) thing is a common randomness anti-pattern in PHP projects that needs to die in a fire. In PHP, a very brief example of the code to achieve the proper way of generating randomness looks like the snippet I posted in the issue.

joeyspn 12y ago

This is not secure at all. I expected some kind of XMPP-OTR stuff...

alvyHere 12y ago

The text I type to the room is cached locally.

mpgarate 12y ago

Reminds me of a little encrypted chat app I made with a friend a few weeks ago. Ours is intended for two-way communication: http://cifrachat.herokuapp.com/ http://cifrachat.herokuapp.com/

asdad 12y ago

Is firebase even open source? How is this anonymous? Does anyone know what data firebase collects from its users?

qeorge 12y ago

This is misleading - it uses Firebase for the server! How can the OP claim that the server is not storing messages if the OP doesn't control the server? I have no reason to trust that Firebase isn't storing the messages. Why should I?

pjc50 12y ago

Judging by the other comments, this is a good example of all the ways not to build such a system.

seagrass 12y ago

1. Open ephchat. 2. Click change name. 3. Paste the following contents and hit enter. <img src="#" onerror="javascript:void(function(setVal,sendClick,text){setVal.value=text;sendClick.click();}(document.querySelector('#chatText'),document.querySelector('#chatButton'),'hello'))"/>hi

lytedev 12y ago
And this is why you absolutely never trust user input.
bmmayer1 12y ago
This has been fixed. Thanks!
- seagrass 12y ago
  Nice!

arcameron 12y ago

For something a bit better, check out https://chat.echoplex.us https://chat.echoplex.us Or description at https://echoplex.us https://echoplex.us