Privacy

49578 readers

1046 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
Don't promote proprietary software
Try to keep things on topic
If you have a question, please try searching for previous discussions, maybe it has already been answered
Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
Be nice :)

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 6 years ago

MODERATORS

An end-to-end encrypted anonymous webchat (lemmy.ml)

submitted 4 days ago by nemesis3469@lemmy.world to c/privacy@lemmy.ml

11 comments fedilink hide all child comments

Source code and details: https://git.anarchists.space/NanoChat/Server

Features

Small codebase
Messages expire after 30 days
Panic button to delete all messages in a room
WebSocket for communication
Docker support

Technical details

AES-256-GCM for client-side encryption
Key is not sent to server

you are viewing a single comment's thread
view the rest of the comments

[–] armrecords@lemmy.ca 1 points 21 hours ago

A few ideas that could further strengthen the design:

Consider deriving separate keys from a master secret using HKDF (e.g. encryption key, authentication key, attachment key) instead of relying on a single key for everything.
Room IDs alone could leak metadata if discovered. An HMAC-based room authentication scheme could help without requiring the server to know any encryption keys.
Adding replay protection with counters/nonces and periodic key rotation would make the protocol more resilient.
For public deployments, some abuse protection (rate limiting, room creation limits, optional proof-of-work) would help prevent DoS attacks.