search

vicr123 / QNearbyShare

Nearby Share implementation for Linux
MIT License
115 stars 6 forks source link

Security and Privacy #9

Open bkmgit opened 10 months ago

bkmgit commented 10 months ago

There are security and privacy concerns with the nearbyshare and related protocols:

Does this implementation do anything different? Should there be an advice to users?

vicr123 commented 10 months ago

Hi,

This implementation of Nearby Share does not support being run over Bluetooth, and the service is only running and exposed when the user has elected to receive a file. Having said that, it's important to check the PIN that is shown before a transfer is started matches on both devices to avoid a MITM attack.

If you do find a specific, reproducible security issue please open a ticket :)

bkmgit commented 10 months ago

Maybe it is worth standardizing the protocol? For example through an IETF RFC? There is an upcoming meeting relatively close to you https://www.ietf.org/how/meetings/119/

vicr123 commented 10 months ago

Hey, the goal of this project is compatibility with Google's protocol. It would be great if it was a standardised protocol but that's for Google to decide and act on, not me. If Google changes the protocol I'll endeavour to update the project to maintain compatibility.

Most of the reverse engineering work comes from https://github.com/grishka/NearDrop if you're interested in protocol documentation.

bkmgit commented 10 months ago

Ok commented on https://github.com/google/nearby/issues/2198