2·
2 days agoRight?! This is why I love the Fediverse and FOSS.
Have a good night/day
Hope you find new fun ideas as well!
- 0 Posts
- 14 Comments
Joined 3 days ago
Cake day: March 19th, 2025
You are not logged in. If you use a Fediverse account that is able to follow users, you can follow this user.
I think that’s by design and the nature of the setup. Anyone with the URL can communicate.
If your other comms method is compromised this doesn’t have much use. Which is a different problem all together. I think this would work great as something like a deadrop so two completely faceless people can communicate. I like it a lot.
I don’t know yet. It’s more a thought experiment than anything else.
https://github.com/muke1908/chat-e2ee
Looks like the URL is part of the seed and salt which is cool.
Proving who you are is done in another stream. Like MFA.
You do a one time pad, generate the URL with that. Communicate what’s needed, then the URL dies.
I’m still noodling with it.
I still don’t see how
swap to a modified JS that exfiltrates the e2ee key
or
add additional keys
Wouldn’t significantly change the recieved hash and break the stream thus ending comms. Also unless you’re hosting and building it yourself you have to trust the recipient and the cloud host.
I agree if an attacker owns the server comms can be compromised. I thought that was the benefit of the ephemeral nature. It’s for quick relay of information. Best practices would probably include another cypher within the messages themselves like a one time pad or some such.
https://www.itstactical.com/intellicom/tradecraft/uncrackable-diy-pencil-and-paper-encryption/
It has. Strangely enough they posted a code of conduct after that feedback and started weilding the ban hammer. However I cannot speak to outside forums like XDA or Reddit or even comms here. I tend to stick to their forums or github
Fragility is by design as it’s ephemeral comms. Swapping the js decryption doesn’t make sense as wouldn’t the client just fail or refuse the message stream as the decrypt/encrypt changed? It’s an interesting problem. Thanks for giving me something to noodle on.
Can you expand more on the key management? I thought https://chat-e2ee-2.azurewebsites.net/ passes a PSK Through the header and sets that as a cookie in the browser to sign further comms. I could be mistaken of course.
10·2 days agoFedora based actually
1·2 days agoGlad to hear it. Hopefully you have a long tenure there and the company grows at a sustainable rate. You’re in like 1% of the market.
You deserve to be there or they wouldn’t have hired you. You work with smart people who know their shit. They wouldn’t have you there if you didn’t contribute.
However remember that as soon as it starts to get bad jump ship or form a union. You only matter until that tiny company gets bought up by another larger company…like Amazon.
https://en.m.wikipedia.org/wiki/List_of_mergers_and_acquisitions_by_Amazon
With the impending financial crisis expect there to be a lot of “consolidation” in the market.
1·2 days agoFedora desktop with KDE. Or you could do grape Arch
Or Blueberry Fedora
Great way to get rid of rotting inventory and recoup costs through insurance.
11·3 days agoLikely as not Chinese companies will profit through shell corporations and NGOs rebuilding Russia and Ukraine. The US could’ve but they dismantled USAID and are actively courting Russian interests in the region.
I’m lucky to have only had one system nuked by a faulty power supply that shut down during a kernel update.
I usually just reinstalled back then. But I didn’t get into it till the late nineties. Back when Ian was still on the list serves.
Unless you mean nuking the OS or borking the bootloader. Then yeah, countless.