Come-from-Beyond
Legendary
Offline
Activity: 2142
Merit: 1010
Newbie
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
November 14, 2013, 09:28:29 PM |
|
have you worked much with WebRTC?
Not much, just played a little. This tech is still too raw.
|
|
|
|
bluemeanie1 (OP)
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
November 14, 2013, 09:31:06 PM |
|
have you worked much with WebRTC?
Not much, just played a little. This tech is still too raw. I was looking at this also: http://www.pjsip.org/pjnath/docs/html/it's a Java library that uses the same set of protocols for NAT traversal as WebRTC.
|
|
|
|
bluemeanie1 (OP)
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
November 14, 2013, 09:34:55 PM |
|
I would double check all your assumptions here. The problem of connecting two people behind NAT is non-trivial. I think what this article is talking about is a simple Browser API for connecting to other people who are connected to the server. You haven't taken the server out of the equation, although you might hide some of the complexities of this arrangement.
http://webrtchacks.com/an-intro-to-webrtcs-natfirewall-problem/I can only hope that at some point you will realize this has nothing to do with cryptography. ![](https://ip.bitcointalk.org/?u=http%3A%2F%2Fcdn.memegenerator.net%2Finstances%2F250x250%2F43000040.jpg&t=665&c=rhiVta4TJTqmKQ) Crypto is part of the problem, interacting with the p2p network is another. Seems that the javascript crypto space is inhabited by various individuals hacking out their own ideas and not much organization or collaboration, which is strange because browser-based crypto is very commonly requested by the development community.
|
|
|
|
moderate
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 98
Merit: 10
nearly dead
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
November 14, 2013, 09:40:17 PM |
|
I would double check all your assumptions here. The problem of connecting two people behind NAT is non-trivial. I think what this article is talking about is a simple Browser API for connecting to other people who are connected to the server. You haven't taken the server out of the equation, although you might hide some of the complexities of this arrangement.
http://webrtchacks.com/an-intro-to-webrtcs-natfirewall-problem/I can only hope that at some point you will realize this has nothing to do with cryptography. Seems that the javascript crypto space is inhabited by various individuals hacking out their own ideas and not much organization or collaboration, which is strange because browser-based crypto is very commonly requested by the development community. Start reading here http://www.matasano.com/articles/javascript-cryptography/
|
|
|
|
Come-from-Beyond
Legendary
Offline
Activity: 2142
Merit: 1010
Newbie
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
November 14, 2013, 09:50:18 PM |
|
I can only hope that at some point you will realize this has nothing to do with cryptography.
I didn't notice this. Yes, I do know that p2p has nothing to do with cryptography. But it's essential for decentralized cryptocurrency.
|
|
|
|
bluemeanie1 (OP)
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
November 14, 2013, 09:52:25 PM |
|
I can only hope that at some point you will realize this has nothing to do with cryptography.
I didn't notice this. Yes, I do know that p2p has nothing to do with cryptography. But it's essential for decentralized cryptocurrency. he's just got some bone to pick, I would ignore him.
|
|
|
|
moderate
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 98
Merit: 10
nearly dead
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
November 14, 2013, 09:56:52 PM |
|
I can only hope that at some point you will realize this has nothing to do with cryptography.
I didn't notice this. Yes, I do know that p2p has nothing to do with cryptography. But it's essential for decentralized cryptocurrency. he's just got some bone to pick, I would ignore him. You can ignore me as much as you please, just don't fuck the users with this broken tool you are planning. Hope you read the previous link.
|
|
|
|
bluemeanie1 (OP)
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
November 14, 2013, 10:10:25 PM |
|
I can only hope that at some point you will realize this has nothing to do with cryptography.
I didn't notice this. Yes, I do know that p2p has nothing to do with cryptography. But it's essential for decentralized cryptocurrency. he's just got some bone to pick, I would ignore him. You can ignore me as much as you please, just don't fuck the users with this broken tool you are planning. Hope you read the previous link. this project offers client side encryption for Gmail and it works completely in the web browser: https://chrome.google.com/webstore/detail/mymail-crypt-for-gmail/jcaobjhdnlpmopmjhijplpjhlplfkhbaa Browser based Cryptocurrency client would have similar security considerations. keep trolling...
|
|
|
|
moderate
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 98
Merit: 10
nearly dead
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
November 14, 2013, 10:12:35 PM |
|
I can only hope that at some point you will realize this has nothing to do with cryptography.
I didn't notice this. Yes, I do know that p2p has nothing to do with cryptography. But it's essential for decentralized cryptocurrency. he's just got some bone to pick, I would ignore him. You can ignore me as much as you please, just don't fuck the users with this broken tool you are planning. Hope you read the previous link. a Browser based Cryptocurrency client would have similar security considerations. Do you even understand why cryptocat moved to a plugin model ? Gosh, you are hopeless. I'm leaving you alone now.
|
|
|
|
bluemeanie1 (OP)
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
November 14, 2013, 10:16:59 PM |
|
I can only hope that at some point you will realize this has nothing to do with cryptography.
I didn't notice this. Yes, I do know that p2p has nothing to do with cryptography. But it's essential for decentralized cryptocurrency. he's just got some bone to pick, I would ignore him. You can ignore me as much as you please, just don't fuck the users with this broken tool you are planning. Hope you read the previous link. a Browser based Cryptocurrency client would have similar security considerations. Do you even understand why cryptocat moved to a plugin model ? Gosh, you are hopeless. I'm leaving you alone now. if you have such a rich background in javascript based crypto browser security, why don't you tell us who you are so we can review your past accomplishments?
|
|
|
|
eb3full
VIP
Full Member
Offline
Activity: 198
Merit: 101
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
November 14, 2013, 11:19:29 PM |
|
You could probably compile OpenSSL (or maybe entire portions of bitcoind) into javascript using emscripten. I still personally believe any browser-based wallets are flawed unless the signing is occurring on a physical device in control of the user. All of the technologies needed for a browser-based wallet (WebRTC etc.) are there though.
|
"With four parameters I can fit an elephant, and with five I can make him wiggle his trunk." John von Neumann buy me beer: 1HG9cBBYME4HUVhfAqQvW9Vqwh3PLioHcU
|
|
|
bluemeanie1 (OP)
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
November 14, 2013, 11:47:34 PM Last edit: November 15, 2013, 12:14:25 AM by bluemeanie1 |
|
You could probably compile OpenSSL (or maybe entire portions of bitcoind) into javascript using emscripten. that sounds pretty ambitious. the stanford library I posted appears to have all the basic Crypto functions you need to use Bitcoin.. http://www-cs-students.stanford.edu/~tjw/jsbn/I still personally believe any browser-based wallets are flawed unless the signing is occurring on a physical device in control of the user. All of the technologies needed for a browser-based wallet (WebRTC etc.) are there though.
just to be clear, I am suggesting that the signing and key management happen IN THE BROWSER. This is possible given the technologies I described in the OP. This is not a "web wallet", instead a "browser based wallet". There are a few extra security considerations, but you are in control of your keys and generally conforms to the same security model as the regular Bitcoin client.
|
|
|
|
eb3full
VIP
Full Member
Offline
Activity: 198
Merit: 101
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
November 15, 2013, 05:10:44 AM |
|
There are a few extra security considerations, but you are in control of your keys and generally conforms to the same security model as the regular Bitcoin client.
Other browser plugins or browser exploits would make it incredibly unsafe even if the client itself was secure. It's a step backward to hand the browser any control over authentication of transactions.
|
"With four parameters I can fit an elephant, and with five I can make him wiggle his trunk." John von Neumann buy me beer: 1HG9cBBYME4HUVhfAqQvW9Vqwh3PLioHcU
|
|
|
bluemeanie1 (OP)
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
November 15, 2013, 05:12:39 AM |
|
There are a few extra security considerations, but you are in control of your keys and generally conforms to the same security model as the regular Bitcoin client.
Other browser plugins or browser exploits would make it incredibly unsafe even if the client itself was secure. It's a step backward to hand the browser any control over authentication of transactions. But a step forward in deployment costs.
|
|
|
|
jago25_98
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
November 15, 2013, 01:00:54 PM |
|
Stating the obvious here, but Mandrik from the client side blockchain.info might have a comment or 2 regarding browser security. Might be worth a PM once you have some more concrete ideas
|
Bitcoiner since the early days. Crypto YouTube Channel: Trading Nomads | Analyst | News Reporter | Bitcoin Hodler | Support Freedom of Speech!
|
|
|
bluemeanie1 (OP)
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
November 15, 2013, 07:17:30 PM |
|
Stating the obvious here, but Mandrik from the client side blockchain.info might have a comment or 2 regarding browser security. Might be worth a PM once you have some more concrete ideas
thanks, but I think blockchain.info is a traditional web app? Haven't used it much really. He may have valuable advice, but the architecture I'm suggesting has few counterparts, here is one: https://chrome.google.com/webstore/detail/mymail-crypt-for-gmail/jcaobjhdnlpmopmjhijplpjhlplfkhbaIm somewhat versed in web app security. thanks, bm
|
|
|
|
bluemeanie1 (OP)
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
November 15, 2013, 07:28:28 PM |
|
here is a handy image I just made: ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fdocs.google.com%2Fdrawings%2Fd%2F1gObQaCkJgllgKwPRWrN5OAaDOusIGapqRqmdGeqKrtU%2Fpub%3Fw%3D960%26amp%3Bh%3D720&t=665&c=PHiQP4aeTi3TMA)
|
|
|
|
Come-from-Beyond
Legendary
Offline
Activity: 2142
Merit: 1010
Newbie
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
November 15, 2013, 07:36:43 PM |
|
Why do u need to store ECC keys? Use a secret phrase asked upon login to get a master key. Other keys can be derived from the master.
PS: What that server in the picture for?
|
|
|
|
bluemeanie1 (OP)
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
November 15, 2013, 07:39:50 PM |
|
Why do u need to store ECC keys? Use a secret phrase asked upon login to get a master key. Other keys can be derived from the master.
PS: What that server in the picture for?
that's 'brand X', the web wallet. Im proposing the scenario on the right.
|
|
|
|
Come-from-Beyond
Legendary
Offline
Activity: 2142
Merit: 1010
Newbie
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
November 15, 2013, 07:45:09 PM |
|
that's 'brand X', the web wallet. Im proposing the scenario on the right.
A secret phrase is enough to reconstruct thousands of ECC keys.
|
|
|
|
|