-
Mastodon: https://infosec.exchange/@xoron
How it works: https://positive-intentions.com/docs/projects/chat
TLDR: im working on a p2p messaging webapp. webapps are generally not considered secure because of the nature of serving satics over the internet. this is correct, but not a limitation of this project. (selfhosting options: https://positive-intentions.com/blog/docker-ios-android-desktop).
as a webapp, i can provide the app with zero-installation and no-registration. the storage is local-only from your browser/device. so “the cloud”, but the cloud storage capacity is made up of your devices. this allows for things like p2p authentication: https://positive-intentions.com/blog/security-privacy-authentication.
Future: im aiming to create the most secure messaging app out there... (more than signal, simplex, etc). i know i have a have a long way to go to get there. the UI is fairly ugly for the average user, but i think the mechanics are working as expected. i think javascript is underrated in what you can do with it. i actively investigting improving the encryption approach further to align to how the signal protocol works (currently using the classic diffie-helman key-exchange).
Support: i would like to keep this project open source, but open-source funding is not working for me. i dont want your donations because it isnt sustainable for a long-term project. i have so far only experienced grant-funding rejections. i have no idea what im doing in trying to get funding for this project, so any support/advice is appriciated. in recognition of the project in its current state not able to get funding... (sorry) i will have to go close-source (which id like to avoid because it undemines several cybersecurity claims id like to make.)
I was thinking about similar concept - E2E encrypted chat, but build on top of other existing services, through a Browser extension and PGP. The extension would just handle message encryption and decryption with PGP, and the rest can be sent through Messenger infrastructure, or anything like that.
The only issue is key exchange.
How do you handle secure key exchange in this case?
Im also working on something similar. I was thinking with a browser extension I could "scan" a page for some kind of blob that the extension would have produced. Something like a webcomponent tag (but not that because a good website would have sanitized for that) then inject a webcomponents from the extension to show it decrypted. The idea is pretty difficult to describe without a working example, but I think it would allow for reasonably secure messaging on public channels (because the payload would be encrypted).
As for exchanging keys securely, the app is using crypto-random ID's to connect peers. On the initial connection, it'll establish the nessesary keys.
https://positive-intentions.com/docs/research/authentication/
True, I forgot that in asymetric crypto, you can simply send a meta/service message "give public key or install extension", and that should work in most cases.
Although, the main threat profile is Chatcontrol, and that could be MITMd by the chat provider, if the extension would get popular enough.
I wonder if there is a way how to establish keys over public chat provider, if the provider has active interrest in breaking your encryption.
I don't think it's possible over a channel that has active interest in breaking your encryption. It's the recipe for a mitm attack.
It would be possible to use password encrypted keys on the public channel and rotate the keys immediately after establishing a connection.
I try to provide ways to transfer data offline. I don't have a working example, but it would be possible to exchange keys over a series of QR codes or NFC... But this would require peers to be at the same physical location.
I'm sure there are many approaches for exchanging keys here that balance between convenience and security.
Ultimately it's worth noting we are talking about encryption on a browser where the operating system could just as easily be taking screenshots.