Show HN: EphChat – Ephemeral, Anonymous, Encrypted Realtime Chat

https://ephchat.com

by bmmayer1 • 12 years ago

17 18 12 years ago

ephchat.com

aaronbasssett• 12 years ago

Really? I wouldn't trust this with any form of secure communication.

https://ephchat.com/?room=%3C/title%3E%3Cimg%20src=%22http:/...

corobo• 12 years ago

works in chat message too, just got redirected to example.com and someone's embedding an audio file using their username so I'm guessing there's just no sanitization anywhere

nullc• 12 years ago

uhh. trivial HTML injection, "trust us" security model. lame.

sarciszewski2• 12 years ago

Where is the server source code? I'm not seeing where messages are stored/transmitted to clients?

Also https://github.com/bmmayer/ephchat/issues/2

joeyspn2• 12 years ago

It is a simple websockets chat using Firebase...

https://github.com/firebase/firechat

system_32• 12 years ago

You criticized about the random code generation function. Could you explain why it is bad? Though I code, I am no expert and would really like to know.

sarciszewski2• 12 years ago

This is the offending code: https://github.com/bmmayer/ephchat/blob/ec375c7974ea825f887f...

This is the proper way to do it (h/t @tptacek): http://sockpuppet.org/blog/2014/02/25/safely-generate-random...

mt_srand() + rand() is just hilarious. The md5(uniquid()) thing is a common randomness anti-pattern in PHP projects that needs to die in a fire.

In PHP, a very brief example of the code to achieve the proper way of generating randomness looks like the snippet I posted in the issue.

joeyspn2• 12 years ago

This is not secure at all. I expected some kind of XMPP-OTR stuff...

alvyHere• 12 years ago

The text I type to the room is cached locally.

mpgarate• 12 years ago

Reminds me of a little encrypted chat app I made with a friend a few weeks ago. Ours is intended for two-way communication: http://cifrachat.herokuapp.com/

asdad• 12 years ago

Is firebase even open source? How is this anonymous? Does anyone know what data firebase collects from its users?

qeorge• 12 years ago

This is misleading - it uses Firebase for the server! How can the OP claim that the server is not storing messages if the OP doesn't control the server?

I have no reason to trust that Firebase isn't storing the messages. Why should I?

pjc50• 12 years ago

Judging by the other comments, this is a good example of all the ways not to build such a system.

seagrass2• 12 years ago

1. Open ephchat.

2. Click change name.

3. Paste the following contents and hit enter.

  <img src="#" onerror="javascript:void(function(setVal,sendClick,text){setVal.value=text;sendClick.click();}(document.querySelector('#chatText'),document.querySelector('#chatButton'),'hello'))"/>hi

lytedev• 12 years ago

And this is why you absolutely never trust user input.

bmmayer1• 12 years ago

This has been fixed. Thanks!

seagrass2• 12 years ago

Nice!

arcameron• 12 years ago

For something a bit better, check out https://chat.echoplex.us Or description at https://echoplex.us

Show HN: EphChat – Ephemeral, Anonymous, Encrypted Realtime Chat

Related Stories