multihack / multihack-web

Realtime collaboration for programmers. (Web Version)
https://multihack.github.io/multihack-web/
MIT License
93 stars 18 forks source link

E2E encryption #30

Closed t-mullen closed 6 years ago

t-mullen commented 7 years ago

Everything is encrypted with WebRTC and WSS, but the server can see the key exchanges in the WebRTC case and the content in the WSS case.

Would be neat if you could specify a shared key along with your room and have everything encrypted.

Backlog because web crypto is useless without something like hyperboot (if even then), and that would need to be opt-in and so more complicated.

Basically, if you trust the server, you are fine and this isn't needed.

t-mullen commented 6 years ago

Impossible. Run your own server if you don't trust the public one.

https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/august/javascript-cryptography-considered-harmful//