News for hackers. Stuff that matters.

A comment on An easy way to share files P2P, and how it works. Parent comment

Re:An easy way to share files P2P, and how it works by kimlelly on Saturday July 06, 2013 @11:00AM (#5999026)
The other thing is, as with almost all web-based solutions, you're being tracked by various scripts in the background (Google API/JS, etc.). So, if you're paranoid, you're better off with a client solution.
[ Parent | on HN ]
Re:An easy way to share files P2P, and how it works by StavrosK on Saturday July 06, 2013 @12:02PM (#5999167)
Sure, but a client solution doesn't have the ease-of-use of this for the other party. I use Ghostery, incidentally, but your general point is that security on a live webpage is impossible, which I agree with. That's why I proposed that the app be made into a downloadable package as well.
[ Parent | on HN ]
Re:An easy way to share files P2P, and how it works by whadar on Saturday July 06, 2013 @03:48PM (#5999827)
Why downloadable package is necessarily more secure than a live webpage over TLS (HTTPS)? Given that you can verify that Sharefest is Sharefest (using the certificate in the future), I don't see the big difference. I do think that a live webpage can be updated with security fixes more easily.

Being a live webpage also give us, as the developers, much less headaches in terms of protocol compatibility -- We maintain just one "version" of Sharefest client at the same time.

[ Parent | on HN ]
Re:An easy way to share files P2P, and how it works by StavrosK on Saturday July 06, 2013 @03:56PM (#5999857)
Because a downloadable package can't be replaced by something else the next time you use it, while Sharefest can, and nation-states can easily serve you whatever they want, even over SSL.
[ Parent | on HN ]
Re:An easy way to share files P2P, and how it works by whadar on Saturday July 06, 2013 @04:05PM (#5999894)
But nation-states can do that for downloadable packages as well, perhaps even the verifiers for those packages...
[ Parent | on HN ]
Re:An easy way to share files P2P, and how it works by whadar on Saturday July 06, 2013 @04:49PM (#6000029)
They can spoof the package and its key. If the root of trust (CA) is tempered as you suggest and the chain of trust is broken, I don't see how you can really secure it.
[ Parent | on HN ]
Re:An easy way to share files P2P, and how it works by StavrosK on Saturday July 06, 2013 @04:41PM (#6000009)
How?
[ Parent | on HN ]
Re:An easy way to share files P2P, and how it works by shacharz on Saturday July 06, 2013 @12:05PM (#5999176)
It would be interesting to create a self sustained WebRTC client that can communicate with the web version.
[ Parent | on HN ]
Re:An easy way to share files P2P, and how it works by StavrosK on Saturday July 06, 2013 @12:25PM (#5999221)
It already can, the web version is just an HTML file with some JS too.
[ Parent | on HN ]
Re:An easy way to share files P2P, and how it works by kimlelly on Saturday July 06, 2013 @12:23PM (#5999214)
Personally, I don't see a better platform than RetroShare. That is why I believe, we're better off if we all get behind RetroShare:

Developers can extend this platform with as many plugins as they wish - as an open-source solution, it's totally open. (I believe fragmentation, more specifically increasing the number of less advanced solutions doesn't help...)

[ Parent | on HN ]
Re:An easy way to share files P2P, and how it works by spyder on Saturday July 06, 2013 @11:24AM (#5999082)
Client side solutions can do even more tracking because there is no browser sandbox. And for example the µTorrent client has ads in it which are probably tracked.
[ Parent | on HN ]
Re:An easy way to share files P2P, and how it works by kimlelly on Saturday July 06, 2013 @12:04PM (#5999174)
Yes, I suggest using open-source clients that don't include ads (such as RetroShare). µTorrent is not open-source, btw.
[ Parent | on HN ]
Re:An easy way to share files P2P, and how it works by imissmyjuno on Saturday July 06, 2013 @12:24PM (#5999217)
So if the issue is tracking regardless, why not use a non-tracking web app?
[ Parent | on HN ]