this post was submitted on 13 Jun 2024
48 points (94.4% liked)

Open Source

31111 readers
310 users here now

All about open source! Feel free to ask questions, and share news, and interesting stuff!

Useful Links

Rules

Related Communities

Community icon from opensource.org, but we are not affiliated with them.

founded 5 years ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
48
Decentralized Encrypted P2P Chat (chat.positive-intentions.com)
submitted 4 months ago* (last edited 4 months ago) by [email protected] to c/[email protected]
24 comments fedilink hide all child comments
 

chat.positive-intentions.com

https://github.com/positive-intentions/chat

I'm excited to share with you an instant messaging application I've been working on that might interest you. This is a chat app designed to work within your browser, with a focus on browser-based security and decentralization.

What makes this app unique is that it doesn't rely on messaging servers to function. Instead, it works based on your browser's javascript capabilities, so even low-end devices should work.

Here are some features of the app:

  • Encrypted messaging: Your messages are encrypted, making them more secure.
  • File sharing: Easily share files using WebRTC technology and QR codes.
  • Voice and video calls: Connect with others through voice and video calls.
  • Shared virtual space: Explore a shared mixed-reality space.
  • Image board: Browse and share images in a scrollable format.

Your security is a top priority. Here's how the app keeps you safe:

  • Decentralized authentication: No central server is required for login, making it harder for anyone to gain unauthorized access.
  • Unique IDs: Your ID is cryptographically random, adding an extra layer of security.
  • End-to-end encryption: Your messages are encrypted from your device to the recipient's device, ensuring only you and the recipient can read them.
  • Local data storage: Your data is stored only on your device, not on any external servers.
  • Self-hostable: You have the option to host the app on your own server if you prefer.

The app is still in the early stages and I'm exploring what's possible with this technology. I'd love to hear your feedback on the idea and the current state of the app. If you have any feature requests or ideas, I'm all ears in the comments below!

Looking forward to hearing your thoughts!

The live app

About the app

Docs

top 24 comments
sorted by: hot top controversial new old
[–] [email protected] 11 points 4 months ago* (last edited 4 months ago) (1 children)

Where is the crypto documented? I'm immediately dubious of messengers that do not provide LENGTHY documentation about the crypto. Did you roll your own? Are you using libraries? Which ones? Etc... It's not s good start to see that you have the self signed certs hard-coded in the repo...

[–] [email protected] 3 points 4 months ago (1 children)

An understandable view. Not sure what you mean by lengthy, but I can confirm my app is not well documented. If the MDN docs count, its a fairly thin wrapper around the functionality provided by the browser of your choice.

https://github.com/positive-intentions/cryptography/blob/staging/src/stories/components/Cryptography.tsx

I'm using webpack 5 module federation to import that file at runtime. Perhaps over-engineered, but it's so I can keep the crypto functionality maintained separately. That repo is in need of more attention for things like unit tests, but the crypto implementation there is pretty basic.

[–] [email protected] 5 points 4 months ago (1 children)

This doesn't really explain how the whole protocol works. Are the keys exchanged for example? Are they rotated? If so when and how? From a quick glance at this bit of code this is just RSA? So no forward secrecy?

[–] [email protected] 3 points 4 months ago (1 children)

The app is a active work in progress. I try to make this clear in my post. Any "protocol" being used, is subject to change as I make improvements.

You raise some good points about rotating keys and forward secrecy. These are things I will be including, but the app is far from finished.

Maybe this helps a bit (I know it's not what you want, but it's the best I got at the moment without diving into the code): https://positive-intentions.com/docs/research/authentication/

[–] [email protected] 1 points 4 months ago (1 children)

You'll probably want to layer in a quantum resistant crypto too. E.g. encrypt the plaintext with old school encryption like you are, then encrypt the cyphertext with quantum resistant encryption. This is essentially one part of what signal does

[–] [email protected] 0 points 4 months ago* (last edited 4 months ago)

https://www.reddit.com/r/cryptography/comments/1bs7slv/help_me_understand_postquantum_cryptography/

Sorry to redirect to Reddit. I'm new to Lemmy.

Tldr; there are several approaches to this issue. In the case of webapps, relying on the offering from the browser should be enough.

I'm also investigating if wasm could also be a way to introduce real-world-entropy to key generation (because I noticed it isn't possible to seed the browser key generation)

[–] [email protected] 7 points 4 months ago (1 children)

But we already have decentralized encypted chat, it's XMPP.

Is yours truly P2P? What about clients behind NAT? Does it use STUN/TURN servers?

[–] [email protected] 2 points 4 months ago (2 children)

I'm using peerjs-server. I'm also investigating other ways to achieve peer discovery which itself could be quite a discussion.

[–] [email protected] 1 points 4 months ago (1 children)

Maybe look at how syncthing works

[–] [email protected] 1 points 4 months ago

Thanks. I want to also investigate if YJS could also fit into the app.

[–] [email protected] 1 points 4 months ago (1 children)

Can users self host that and set up clients to use their own servers?

[–] [email protected] 1 points 4 months ago

Users can selfhost the frontend and backend independently. When creating a profile, you can set it to use your own peerjs-server (set preferences)

The frontend is only run as client-side JavaScript. There isn't a step to "set up clients".

[–] [email protected] 1 points 4 months ago (1 children)

Nothing against this, but isn't this basically Matrix?

[–] [email protected] 5 points 4 months ago

It's similar to matrix in many ways. The key difference is with mine it's is purely browser based. Unlike traditional solutions like matrix where you have a (self)hosted server, mine does not require things like registration or installation.

[–] [email protected] 1 points 4 months ago (1 children)

It's an interesting idea. If it can make it easier to share files with friends then I'd be in. Voice and video have always been challenging as I understand it, so I'm expecting that to come later. Very ambitious, but cool if you can pull it off!

[–] [email protected] 2 points 4 months ago (1 children)

There is a lot to be fixed throughout but file transfer and video calls should be working if you try out the live app.

[–] [email protected] 1 points 4 months ago (1 children)

All right I tried out the live app, to connect my phone to my desktop. Couldn't get it to work. Tried the link method both ways, once normal and once animals. Tried the QR code too. All it does is bring me to a "contacts" page, which is essentially the same screen, or to a "new peer" one. Tried looking at the docs but didn't see what I might be doing wrong there. Do certain plug ins mess it up like ublock origin? Anything else?

[–] [email protected] 1 points 4 months ago* (last edited 4 months ago)

Sorry. It's quite buggy.

  • Its best to start off by clearing all site data from the browser settings.
  • Do not have multiple tabs of the app on the same device.
  • It doesnt hurt to refresh to page.

What you're describing might be related to there being 2 tabs of the app running. This results in both reacting to the new-connection-event, but ultimately resulting in a data conflict.

Plugins shouldn't be an issue. For stronger security, i have CSP headers to try to prevent browser plugins reading data.

If nothing works then the egg is squarely on my face and my buggy app is too buggy.

[–] [email protected] 1 points 4 months ago (1 children)

Interesting project, cool to see that you are passionate about this. Nostr does much of this and can do it entirely in-browser without having to trust any particular relay like AP/Lemmy/Mastodon does. It has encrypted DMs. Might want to check out the protocol.

[–] [email protected] 2 points 4 months ago

Thanks. It's been mentioned before and I'd like to take a look at it when I can make the time.

[–] [email protected] 1 points 4 months ago (1 children)

What encryption protocol u using? I wpuld strongly recommend using signal protocol but i dont exactly know how the implementation of that in js would work

[–] [email protected] 2 points 4 months ago

The project it's in its early stages. There isn't anything as formal as a protocol yet. That is also why there isn't good documentation about it... The best I have for your question is:

https://positive-intentions.com/docs/research/authentication

[–] [email protected] 0 points 4 months ago (1 children)

Sounds to me that it would have been easier to create a web-based client for an existing messaging system with such features (like Briar).

[–] [email protected] 1 points 4 months ago

perhaps.

it started of very vanillajs, but i found that users didnt like the appearance. so i added a faily basic implementation of material ui.

existing frameworks were not compatible with the look, feel and funtionality i was after. i still havent achieved it, but im happy with the progress.