lotharrr

5 ms·

1.
by lotharrr 1y ago
FYI, there's a subcommand just for this use case: `wormhole ssh invite` / `accept`, which will read the SSH pubkey on one end and append it to authorized_keys on the other.
2.
by lotharrr 1y ago
We're making good progress on hole-punching, but it isn't available yet. Once complete, that should take some pressure/cost off the transit relay machine. Note that the transit relay only sees ciphertext (for bulk data transf
3.
by lotharrr 1y ago
(author here) Both sides connect to the "mailbox relay server" to perform key exchange and setup. That's a host named "relay.magic-wormhole.io". If either side has a public IP address, the encrypted data is transfer
4.
by lotharrr 1y ago
(magic-wormhole author here) Debian was kind enough to configure their distribution's copy with a distinct hostname for the transit relay helper (the bit that forwards bulk encrypted traffic when both parties are behind NAT). "mag
5.
by lotharrr 1y ago
I've been pretty happy with Unifi's "In-Wall" AP (e.g. https://store.ui.com/us/en/category/wifi-wall/products/u6-iw ): PoE powered, has four downstream RJ45 ports (one with PoE it
6.
by lotharrr 2y ago
One tricky constraint is that a "simple URL" isn't big enough to hold a full-entropy encryption key. So your security must either come from PAKE (like magic-wormhole and friends), or from the good behavior of some intermediar
7.
by lotharrr 2y ago
WebRTC (and the various hole-punching techniques listed elsewhere here) have mechanisms to help with most cases of both participants living behind NAT boxes. The remaining cases require some sort of relay that is willing to proxy the connec
8.
by lotharrr 2y ago
Nope. It needs to contact the "mailbox server" to coordinate the rest of the protocol. Two machines with local connectivity (e.g. on the same LAN, but your WAN connection is broken) could still implement the second half of the pro
9.
by lotharrr 2y ago
Correct. The wormhole code is a channel number (called a "nameplate") and a short secret, which defaults to 16 bits of entropy. The secret is used as the input to a PAKE, which only gives the other party (hopefully your intended r
10.
by lotharrr 2y ago
The PAKE algorithm lets you spend an interactive roundtrip to buy a full-strength key out of a weak shared secret. An attacker can attempt to guess the passphrase, and their chances are non-zero (one out of 65536 with the default configurat
11.
by lotharrr 2y ago
I don't know of one yet, but I tried to choose protocols (websockets) that were friendly to being hosted in a browser, or a browser plugin. The exception is the bulk-transfer protocol, that's pure TCP, which can't be used by
12.
by lotharrr 2y ago
Magic-wormhole is really intended to help with the first-step "introduction" phase of a tool like that: start with two humans that can yell a codephase at each other, and finish with two computers that have a secure encrypted conn
13.
by lotharrr 2y ago
It can't hurt, but it shouldn't be necessary. The client-side software establishes an encrypted connection with its peer, using an encryption scheme that should be just as secure [but see below] as what GPG or SSH will give you. F
14.
by lotharrr 2y ago
Mostly no. ssh/rsync is compiled C code, so might be slightly faster than a Python-based `wormhole`, if you have a really fast connection to take advantage of. And rsync provides that lovely continue-from-interrupted-transfer feature t
15.
by lotharrr 2y ago
There's a `wormhole send --text BLOB`, which doesn't bother with a bulk-data "transit" connection, and just drops a chunk of text on the receiving side's stdout. You can also import the wormhole library directly and
16.
by lotharrr 2y ago
Not really.. the closest approximation would be if both sides set their `--transit-helper` to an unusable port like `tcp:localhost:9`. That would effectively remove the relay helpers from the negotiation list, leaving just the direct connec
17.
by lotharrr 2y ago
Alas no. It's a one-shot file-transfer tool, and we don't store a copy of the encrypted data or anything. So the sender must stay running until the receiver has finished downloading. If you're comfortable with relying on serv
18.
by lotharrr 2y ago
None that I know of. It just uses a TCP connection to the mailbox server (with keepalives), and then TCP connections for the bulk-transfer transit phase, so I can't think of anything special that iptables would need to handle it well.
19.
by lotharrr 2y ago
Yes, it relies on two servers, both of which I run. All connections use the "mailbox server", to exchange short messages, which are used to do the cryptographic negotiation, and then trade instructions like "I want to send yo
20.
by lotharrr 2y ago
Not yet. The "Dilation" protocol (which is about 80% implemented) is intended to support WebRTC as a transport layer. IIRC it requires a public server to tell you about your external IP address, but magic-wormhole already has a se
21.
by lotharrr 2y ago
scp/rsync are great tools, but they require pre-coordination of keys. One side is the client, the other is the server. The client needs an account on the server machine (so the human on the client machine must provide an ssh pubkey to
22.
by lotharrr 2y ago
There are two servers. The "mailbox server" helps with handshakes and metadata transfers, and is super-low bandwidth, a few hundred bytes per connection. The "transit relay helper" is the one that handles the bulk data t
23.
by lotharrr 2y ago
Yeah, syncthing is awesome for repeated interaction.. once you've configured the two sides to know about each other, it's really flexible for doing an initial transfer, pushing just the new changes, pushing to multiple destination
24.
by lotharrr 2y ago
author here.. happy to answer any questions!
25.
by lotharrr 2y ago
(author here) The protocol enumerates all the IPv4 addresses on each side, and attempts to connect to all of them, and the first successful handshake wins. So if your VPN arrangement enables a direct connection, `wormhole send` will use tha
26.
by lotharrr 2y ago
(magic-wormhole author here) Thanks for making a donation! I run the relay server, but the Debian maintainer agreed to bake an alternate hostname into the packaged versions (a CNAME for the same address that the upstream git code uses), so
27.
by lotharrr 5y ago
Maybe $20/mo. The bandwidth is growing but not too bad so far, every once in a while I see a really huge transfer that makes me wince (seriously, who sustains a gigabit/s for five hours?), but I've still got some margin befor
28.
by lotharrr 5y ago
As aborsy said, if you can encrypt ahead of time, that's great, you're only relying upon the server for availability, (just like magic-wormhole). You would not be vulnerable to the Dropbox server, or the folks who run them, or som
29.
by lotharrr 5y ago
Good question! The code is broken up into two parts: a number, and some words. The number is like a mailbox: you put messages into it, the person you're intending to talk to puts messages into it, (maybe an attacker puts messages into
30.
by lotharrr 5y ago
A few I've found: * You're sitting next to someone at a conference (remember those?) and want to hand them a file: fewer steps than email, the wormhole code is easier to transcribe than most email addresses, the file lands where y

More ›