News for hackers. Stuff that matters.
Re:Croc: Easily and securely send things from one computer t... by bscphil on Friday September 18, 2020 @08:36AM (#24515883)
That's right. But you'd have to attack an extraordinary number of transfers to have even a small chance of managing to get one by luck, and an attack of that scale would very quickly become obvious since everyone would have their transfers interrupted. I agree with you in principle though, I'd like to see just a bit more entropy.
Re:Croc: Easily and securely send things from one computer t... by lioeters on Friday September 18, 2020 @10:40AM (#24517347)
> a bit more entropy

The appropriate use of "bit" here made me smile.

Re:Croc: Easily and securely send things from one computer t... by Dangeranger on Friday September 18, 2020 @12:14PM (#24518618)
Increasing the passphrase to four words would bring the odds up to 1 / 6,990,080,303,376. In magic-tunnel I believe there is a flag to change the number of words used by default. It appears that schollz/croc allows you to use your own passphrase, but not increase the default word size, that would be a good feature request.
Re:Croc: Easily and securely send things from one computer t... by bscphil on Friday September 18, 2020 @06:56PM (#24522656)
You're quite right, of course, but keep in mind that magic-wormhole is using a much smaller wordlist, and in fact only has 1 / 65536 odds by default. The people writing software in this space don't seem to believe this is a credible threat.
Re:Croc: Easily and securely send things from one computer t... by psanford on Saturday September 19, 2020 @06:13PM (#24530655)
You can use whatever string you want as the passphrase for Magic Wormhole, the receiver just won't get tab completion.
Re:Croc: Easily and securely send things from one computer t... by Dangeranger on Sunday September 27, 2020 @04:37PM (#24609961)
How would tab completion work in a situation like this? Are the clients exchanging information about the passphrase over the same communication channel?