“private and secure chat app”

I don’t think it’s a solved problem. There are countless nuances to it. So it’s good to have various approaches.

https://positive-intentions.com/blog/docker-ios-android-desktop

this a yet another approach to a “private and secure chat app” because its a unique approach to the same problem which id like to investigate.

its a work in progress and hope to get to a point its comparable to Signal and OnionShare.

for now, the purpose is to present open-source code to demonstrate a concept. like mentioned in the post it isnt ready to replace any existing tools.

sorry for the delay in responding. personal matters required more focus and to reply to you i wanted to set aside some time to write well for clarity.

… Might as well get real-life practice at writing.

im not entirely bad at writing (technical or otherwise) to get to where i am now in the project, i usually write with my own words like now. the blog articles you see on the website are from old reddit posts. questions like your are understandably frequent and so it made sense to create the website and blog to address FAQ’s. i think its important to note how im using AI here. while i can say to AI “here are some bullet points, now turn it into an article…”, i have written the content and details myself and then have AI reword it for clarity. i think the resulting content is better for clarity.

What is the lifetime of each user’s public/private keypair? What is the lifetime of the symmetric key shared between two communicating users?

the implementation sits ontop of a webrtc connections which mandates its own encryption keys. my app adds an additional set of public/private keypair and symmetric keys. these are persisted to browser storage (indexedDB). the keys are cleared if the user performs a logout (its all client-side, so there is no actual “logout”, it clears the local data).

key rotation is a work-in-progress and not testable in the app. while i can have a button that says “rotate keys”, im planning to frame it as something like “block contact”. this is because it makese to keep user ID’s static, so that in future sessions, the app can automatically connect to “known peers”. in the case you want to block someone, it makes sense to abandon that ID so they cannot ping you with it. when you connect to a “know peer” that doesnt know your new ID, it can use the previsously establish keys to verify each other and update the contact details accordingly.

its also possible to export the data to a file to then load from that profile. its currently static and unencrypted. there will be an option to have it all password encrypted. https://www.reddit.com/r/cryptography/comments/1lhjpxk/veracryptlike_functionality_from_a_browser/

I take substantial notice whenever a promise of “true privacy” is made

completely understandable. as mentioned in the post cybersecurity is full of caveats. here is a previsous attempt to outline some details: https://www.reddit.com/r/cryptography/comments/1evdby4/is_this_a_secure_messaging_app/

im also investigate various approaches to exchanging data offline with QR codes.

(written by me): https://www.reddit.com/r/positive_intentions/comments/1b5j424/file_sharing_by_qr_code/ (written by having AI transcribe my wording): https://positive-intentions.com/blog/qr-codes-as-a data-channel

id also like to investigate other things a browsers can do like exchange encryption data over NFC.

it isnt use-friendly yet, but i also have some basic functionality around p2p broker connections to avoid needing the peerjs-server (which acts as the broker.). some unclear details which could do with AI clarification can be seen here: https://github.com/positive-intentions/chat/issues/6

If a secure medium existed, then secure key exchange would already be solved

the existing key exchange should be already secure enough… but users would understandably want to be sure my code doesnt have a critical-bug and validating hashes provides that bit extra.

many others have also tried their hand at secure messaging, with more fails than successes.

i have seem some other myself, and i still believe my approach is unique. there are of course limitations in the webapp form-factor, but it also provides a lot of flexibility in just being able to run on a browser. while many try/succeed/fail, this is my attemp. i have been refining my approach with feedback and there is still much to do. at this point i dont consider it insecure, but the UI is pretty ugly and combined with various UI bugs, is deterring users. with the code being course source, i often try to present some concepts in a more digestable way with code examples as seen:

• https://cryptography.positive-intentions.com/?path=%2Fstory%2Fcryptography-introduction--welcome
• https://github.com/positive-intentions/cryptography

there is a lot to learn but by breaking things into small parts, i can better learn how it can all fit together.

“cryptography engineer” and not a cryptographer

i like that term. its new to me. i normally just call myself a webdeveloper to clarify my expertise. its more so the case than a cryptography engineer. i open sourcemy work for transparency, but also great for my own learning.

thanks for the good wishes. hopefully i get to a stage where its better presented as a product and not just a proof-of-concept.

thanks for taking a look.

firstly i would like to apologise for throwing the following blocks of AI text at you. i often used AI to create documentation for the project. im not much of a writer, im sure its more clear from AI than if i did it myself.

• how the authentication works: https://positive-intentions.com/docs/research/authentication
• how security works: https://positive-intentions.com/blog/security-privacy-authentication

the ID’s are cryptographically random to make it reasonably certain that strangers cannot connect (because its an ungussable ephemental string). this is used with peerjs-server (open source and documented) to connect with a predictable ID. when this ID is shared “through some other trusted channel” (e.g. whatsapp, qrcode), the peers connect and establish encryptions keys (see links above). afer the first connection (expected to be secure!), the previously establish encryption keys can be used to authenticate the user (to prevent MITM).

Was that document crafted for this project specifically?

long story short… this is my sideproject and im trying to get it off the ground. as i post more about the project, i decieded to create a website to “document” the project. there are understandable questions like yours, so made sense to answer them in the website. this includes things like the threat-model… while one-shotting is a thing you can do with AI, the threat model took several days of learning, thinking and consideration. i also posted about it on reddit for feedback and updated it accordingly.

Was it prepared by a cryptographer?

am i a cryptographer yet? having worked on this project i must have picked some stuff up. i still find that i need to learn much more.

And was it generated using an AI/LLM?

i hope admitting i used AI doesnt undermine the effort i put in. i try to communicate details in places like lemmy and the code is open source. AI enables me to demonstrate granular functionality that is easier for me to test as well present to professionals; in contrast to presenting overwhelmingly complicated code on github. for example for my cryptography functionality i created a separate repo to try things out for my learning: https://cryptography.positive-intentions.com/?path=%2Fstory%2Fcryptography-introduction--welcome

there are good and bad ways to using AI and i believe im doing it responsibly. i have been a coder for 15+ years. i can do it myself, i simply cant type as fast as AI making it indespensible when working on a project of this scale. i completely understand your concerns and im all ears for advice on a reddit post i asked: https://www.reddit.com/r/CyberSecurityAdvice/comments/1lekrsx/what_advicebestpractices_are_there_for_creating/

(its why like in all my app, website and posts (like this), i try to strike caution.)

thanks. thats what id like to aim for and i dont think its far off. the build script there is mainly for the storybook statics (as seen in the link provided for “website”).

couple things i hope to do soon, remove lit as a dependency - i use this right now because its useful for template rendering and lifecycle methods. webcomponents have a an ugly approach to this which Lit makes easier, and so i pushed it back, but its still on the todo.

after that i should be able to have a more vanilla web dx.

By feature, do you mean “foss”? (Wondering if you’re replying to the correct thread)

If so, then it’s unfortunate I’m investigating this direction, it seems nessesary.

Otherwise feel free to let me know of a critical feature missing (if “foss” is not the feature you meant.)

No. When I type with “correct capitals”, it’s because I’m doing it from my phone. I otherwise generally might sound like chatgpt.

thanks!

im a developer im not much of an expert on licences of any kind. i created code and decided to open source it here: https://github.com/positive-intentions/chat . when i say the close source app is “based on” the open source code, i hope it doesnt undermine that it itself is a fully functional p2p messaging system (im of the opinion that all projects will always need refinement). anyone with issues about close-source code should take a look at the open-srouce version. its basically more functional but it seems too complex to maintain as open source andd thus this new project.

id like to offer the statics as a zipped folder. this is in the roadmap, but the code will be minified and obfuscated. about as opaque as possible for “source available”. i dont know much on the matter, but id like to learn more about if this can be made into libre software. its hardly modifyable or studyable.

while i dont want you to “trust me bro”, i am actively developing it and improving the functionality. so that static bundle will have to be build by the CI/CD and it will update along with the app. it goes without saying, the project is not mature enough to have things like security audits.

thanks! for your feedback there! ahh the connection bugs. unfortunately this is is one of the trickier bugs. im working towards fixing that asap. i have an idea of a fix, but im trying to avoid rewriting a core piece. have you tried closing the app on both devices and trying again (sorry, i know its a bit cliche).

if its not a secret, can you maybe tell me more about your LAN setup for me to set something up and try? i certainly aim for it to “just work”.

I’m no expert on the matter of licences either. I made the open source code some bsd licence because some of the dependencies called for it.

I created some code and made some open source. I don’t have to apply that to all my projects.

I mean to draw attention to the open source code in such a case.

If interested in how it works and to see code examples, this project is based on my beefier open-source code seen here: https://github.com/positive-intentions/chat

Thanks. I hope to get to a point where I can make the experience as seamless as workhole.

To compare solutions, a key details around providing my app as a webapp, is to avoid the requirement of a client. this opens up the set of compatible platforms.

(Note: it’s a common request for me, so by popular demand, i will aim to provide binaries for the major platforms.)

For me, it’s an achievement for it to be comparable to those tools. I aim to get to a similar feature set and make the user experience intuitive.

I tried foss. I couldn’t get it to work so i’m trying something different.

Just to be clear, my own open source code. Yes.

Strong title needed for strong claims.

Its based on open source code. https://github.com/positive-intentions/chat . I’d be happy for feedback on that too.

Webrtc would be able to outperform all other methods for transfer speed (useful for when sending larger files)

I’m sure there is a market for eople who want to transfer files. With a zero-installation, zero-registration, it should make it easy for people to get started.

Thanks for the empassioned speech/statement!

Perhaps you’d be interested in one of my open source projects. It’s a beefier version of the app presented in the parent post.

https://github.com/positive-intentions/chat

On the point about open source, it isn’t easy to pull off. I can confirm it isn’t the case that open-source be flooded with some kind of collective community review/support. It’s been an option for the chat app for a while and I’ve tried actively promoting it, it’s clear that the project is simply too complicated.

I’m a bit disappointed in how hard I tried on the open source project for it to not get the traction I wanted. To create somthing close-source and competitive in the file-transfer space is only logical at this point.

I’m sure with an enthusiastic speech like that, you’re doing your part for supporting the open source community. Unfortunately I couldn’t figure out how to get it to filter down to me.

I’m in the process of rebranding and moving domains, so the documentation links are broken. You can try the search. it seems to work reasonably well. A good place to start could be from here:

https://positive-intentions.com/docs/research/authentication#authentication-sequence

Feel free to reach out for clarity on anything.

I haven’t heard of Dibbles. Can you point me to their site?