An easy way to share files P2P, and how it works

Re:An easy way to share files P2P, and how it works by arethuza on Saturday July 06, 2013 @10:08AM (#5998905)

Out of interest, if the decryption is being done in a client by JavaScript, what's stopping a MITM attacker replacing the JavaScript crypto library with something that captures the source URL and key?

[ Parent | on HN ]

Re:An easy way to share files P2P, and how it works by skymt on Saturday July 06, 2013 @10:27AM (#5998947)

That's a well-known problem with JavaScript crypto: http://www.matasano.com/articles/javascript-cryptography/

The short answer is that so long as the page is loaded entirely over TLS, and the TLS isn't stripped or subverted in any way, it's safe from MITM. Sharefest doesn't currently support TLS, so they would need to set that up prior to enabling end-to-end encryption.

[ Parent | on HN ]

Re:An easy way to share files P2P, and how it works by shacharz on Saturday July 06, 2013 @10:37AM (#5998967)

The P2P crypto is done by the browser. But not doubt that we need to load the entire page and scripts securely securely...

[ Parent | on HN ]

Re:An easy way to share files P2P, and how it works by StavrosK on Saturday July 06, 2013 @10:27AM (#5998950)

Nothing (assuming the MITM is someone who can break HTTPS or Peer5 themselves), which is why I proposed this:

https://github.com/Peer5/ShareFest/issues/30#issuecomment-20...

You can download ShareFest, audit it and store it locally so you can run your known-good version. It's just an HTML page and a few JS files (or at least it was, last time I looked).

I was going to create a version of this that was a single webpage and had as little code as possible (for auditability and ease of saving/deployment), but other projects got in the way (plus it's easier to improve ShareFest than write it from scratch).

[ Parent | on HN ]