Crumb
c/privacy · by nemesis3469@lemmy.world · 58d

An end-to-end encrypted anonymous webchat

Source code and details: https://git.anarchists.space/NanoChat/Server

Features

  • Small codebase
  • Messages expire after 30 days
  • Panic button to delete all messages in a room
  • WebSocket for communication
  • Docker support

Technical details

  • AES-256-GCM for client-side encryption
  • Key is not sent to server
38 points · 11 comments · view on lemmy.world

11 Comments

voxel@feddit.org · 8 pts · 58d (4 replies)

Cloudfare doesn't let me through. 🙄

nemesis3469@lemmy.world · 12 pts · 58d (3 replies)

We were under attack from a Singaporean botnet for two weeks, so I had to put our Forgejo instance behind Cloudflare because of that 🥲

nutbutter@discuss.tchncs.de · 3 pts · 58d (1 reply)

Do peojects like Anubis fail in such cases?

nemesis3469@lemmy.world · 9 pts · 58d

Anubis is for blocking AI crawlers, not DDoS attacks

airikr@lemmy.ml · 1 pts · 54d

I literally hate people who only wants to destroy or weaken good things 😒 But why don't you use Codeberg? Is it because of downs every now and then because of the same reason (DDoS attacks from idiots)?

solrize@lemmy.ml · 5 pts · 58d (1 reply)

How does the anonymity work?

nemesis3469@lemmy.world · 5 pts · 58d

There are no user identities (not even cryptographic ones), and room encryption key is stored in URL which is never sent to server. Anyone can choose any nickname and you can access official instance (https://nanochat.anarchists.space/) through Tor.

armrecords@lemmy.ca · 1 pts · 54d

A few ideas that could further strengthen the design:

  • Consider deriving separate keys from a master secret using HKDF (e.g. encryption key, authentication key, attachment key) instead of relying on a single key for everything.
  • Room IDs alone could leak metadata if discovered. An HMAC-based room authentication scheme could help without requiring the server to know any encryption keys.
  • Adding replay protection with counters/nonces and periodic key rotation would make the protocol more resilient.
  • For public deployments, some abuse protection (rate limiting, room creation limits, optional proof-of-work) would help prevent DoS attacks.
dreamy@lemmy.blahaj.zone · 1 pts · 57d (1 reply)

OnionShare already has a chat feature that works pretty well. What does this add?

nemesis3469@lemmy.world · 1 pts · 57d

Codebase is small and easy to audit. The panic button wipes all chat history in a room and blocks future messages. OnionShare fully depends on Tor’s built-in encryption for message security while NanoChat has its own encryption, which means you can host it on different anonymity networks.

thatsnomayo@lemmy.ml · 1 pts · 57d

Thanks for sharing I recommend Cheogram web which is in beta but will reach the full feature set of the app in due time