cryptoalex
P.S. In fact, I was going to send that book to my friend's son who is about same age, and who got some sudden interest in cryptography recently. So it is safe to say that I am now aware of at least two 10 year olds who have interest in Cryptography. I feel a bit surprised, but in a good way :)
1) "... if someone can dump the indexdb data stored in your browser they can access your AES Key and impersonate the device ..." - I was surprised to read that index DB stores the AES key. Is that a "Shared Secret Session Key" negotiated via ECDH? If so, it should not be stored. Only the Public Key of the ToothPaste device (obtained during the "Pairing" process) should be stored in the browser's indexdb, preferably HMAC'ed or otherwise authenticated (via password-derived local client-only symmetric key which you already seem to be using)
2) "... ToothPaste allows encrypting this local data, along with saved Macros and Duckyscript scripts, using a Password + Argon2 derived encryption key ..." - make sure you are using random salt here, and deriving from (password+salt), not just (password). The salt should be stored in the plain text in the indexdb. Also, since this derivation runs in the browser (not in the MCU), try using Argon2id flavor of Argon to also make it memory-hard, not just compute-hard
3) from the animated gif demo, it looks like the BLE packets are being sent on every key stroke as you type. At the very least, you may leak your BitLocker password length. I would rather send the whole thing once user finished typing and pressed enter, or took more steps to obfuscate by padding with random dummy data and sending every 0.3 seconds
4) you never mention what MODE of AES are you using. I think you should be fine with GCM mode with random nonce, using "Message Number" as Associated Data (see next point)
5) you probably need a protection from "Replay" attack, i.e. encrypted BLE packet "replayed" by attacker. Could be done by ever increasing Message Number on a sender side, and receiver keeping track of the "last Message Number" and only accepting messages with higher number than "last Message Number" - for both directions you need 2 independent numbers. Also, Message Number is a good thing to put into Associated Data if you use AES GCM mode
6) every session should start from ECDH negotiating a brand new AES key - this way you dont have to deal with a long-living AES key, do not need to store it anywhere, and do not have a risk of using the same AES GCM key for too many messages or too much data
Otherwise, for purely "fun" option, I would get smth like Google Pixel 3a (about $150) and install Ubuntu Touch on it https://devices.ubuntu-touch.io/device/sargo/ .
The most practical option is probably to get Google Pixel 9/9A and use it as is with the latest Android, Google AI, etc. Also having an option to flash something else (like Graphene OS) if needed
- What programming languages and frameworks are popular for desktop apps? - for me - Blazor Hybrid / MAUI / Avalonia UI / WinForms
- Are there any go-to IDEs, build tools, or libraries that make development easier? - I use MSVS 2022, VSCode for .NET, IntelliJ for $$$ at work. There are of course UI control libraries, I am using MudBlazor for Blazor WASM / Hybrid, other than that I use built-in controls that come with each framework. I try to use as little as possible of 3rd party libraries b/c my apps are security-sensitive.
- Do the above answers change if you care about code performance or efficiency (whatever that means to you)? - in my case no, I am able to find what I need in .NET ecosystem. Modern .NET supports ahead-of-time compilation compiling to native code, and that helps to reduce start-up time which is important for Desktop / CLI. Ironically, for a long running processes, like a web service, the just-in-time compilation sometimes produces code running faster than ahead-of-time compilation, b/c it learns most common execution paths at runtime, and is able to recompile on the fly, optimizing for most frequent execution paths, giving a non-trivial performance boost in some cases
- Is native desktop app development still viable as a career, or are most greenfield projects shifting to web-based alternatives - depends on the app/use case. For my project, desktop is the first class citizen, but I am building E2EE apps, i.e. end-to-end-encryption apps, aka client-side encryption, and native / Desktop / CLI is a better fit for E2EE in most of the cases compared to web apps. For those Web apps that I have it is still E2EE but in the browser (still client side encryption)
UI for both apps is reasonably complex and could be seen here - https://youtu.be/PZVwYSCO1p4?t=78.
To be honest, Blazor UI controls / object model / lifecycle takes some time to get used to. However, MudBlazor library does help here, as well as finding your own patterns and just building on top of your own base classes.
With the same stack i.e. Blazor Hybrid / Blazor WASM / MudBlazor, I've also build Secure Mail Client, Notes, File Encryption application, and also a number of CLI utilities related to encryption via QR codes.
Overall, I do recommend Blazor Hybrid for a cross platform desktop application with simple to medium UI complexity.
I've spot-checked few logos that I need at the moment, and most of them are already there. However, I've noticed that there is no IndieHackers logo in the database.
I wonder if it is possible to come up with the tool where you would enter the Home Page Url and the tool would then output an SVG file of round or square shape that could be used as an SVG icon to represent links to that site (from my site).
The tool could try to detect the logo image on the home page of the target site, vectorize and normalize it into square or circle. Or it could try to locate a Favicon in SVG format, if present. Or, if nothing else works, it could fall into some default case when the SVG icon would be created from the most dominant color (of the target site) and 1 or 2 letters of the site name.
Do you guys know of any such tool? Thanks!