Comment on Encrypted P2P Chat
totally_notAcat@lemmy.blahaj.zone 4 days ago
Hi I tried your app recently, the main issue that I had was that it had a tendency to drop messages, also the uploading a profile doesn’t currently seem to work (on mobile Firefox at least).
But anyways I love the application concept and it seems like you have made some pretty good progress.
P.s. what is the crypto signature box that you can just draw in?
(Also I think you could probably fit the offline connection into one QR code if you really wanted to (117x117 but still))
xoron@lemmy.world 4 days ago
thanks for the feedback!
the app is a work in progress and full of bugs and issues. as a side project i can only set aside so much time to do things. the app as you see it is something im approaching with a “release often” approach. this will highlight thing like you are doing for me to prioritize. the profile loading from file is something i havent taken a look at in a while so thanks for that! i will take a look when i can make time for it :)
the cryptography in the app can be a whole separate discussion. but to be brief, the crypto signature input is something the app uses to generate a cryptographically random value… basically whatever you draw (e.g. “a smiley face”) gets converted to a base64 string… then this is passed through a sha-256 hashing function. the idea is that even if you try, you could never draw the “exact” same smiley that would be pixel perfect and result in the same hash. the app also appends this to the cryptographically random value generated from the browsers built-in functions. so that crypto-signature is actually entirely redundent but could address concerns about the device/browser cryptography functions being compromized.
for the QR, i tried to make it a resolution that would be reasonable to view from another phone… to see the data that is being squashed into the QR codes for offline, you can take a look at the details around here. github.com/positive-intentions/chat/issues/6 … there is an offline demo described there where instead of QR code it shows the data as plain text (this will include things like IP so you should be pasting this publicly anywhere… these details generated only exist on your device in memory)