Hacker News new | ask | show | jobs
by syx 377 days ago
This is very nice and simple. A few areas for improvement, in my opinion: the URL should be easy to copy, paste, or type into another device. I'd suggest designing the route like pindsend.app/pin/CODEHERE. Also, for some reason, copying and pasting the URL didn't seem to work in its current form. I would also consider implementing a QR code to allow quick scanning and redirection on another device, especially a phone, see Wormhole's implementation for reference [1]. Regarding security, the PIN looks quite short; I'd suggest increasing its complexity or length and automatically expiring sessions after a few minutes of inactivity. Additionally, definitely consider implementing end-to-end encryption if you haven’t already.

[1] https://wormhole.app
2 comments
avovsya 377 days ago
Thank you for the feedback and wormhole.app suggestion! As for QR code - it's already available after you've set up your session, but UI might not be as obvious so I'll work on it. For PIN code - you might be right, though brute forcing PIN codes with 6 alphanumeric characters and throttling on signaling server might not be as easy as it seems.

Communication inside a sharing session is end-to-end encrypted as it uses WebRTC, and session will "expire" as soon as all clients are disconnected, because no data is stored on a server - it's all between connected clients

link
syx 376 days ago
You indeed have already a QR code, my bad for not seeing it in the first place!
link
Imustaskforhelp 376 days ago
I am actually quite surprised and frankly concerned about the fact that wormhole.app constantly is considered as the wormhole protocol which, it frankly with its confusing name isn't.

It isn't the wormhole protocol. I am on mobile at the moment but someone can definitely link websites which are genuinely using the wormhole protocol as I was involved in the scene of learning about such protocols and the alikes of crocs and there was atleast one open source website based wormhole app.

Also,I may be wrong,I usually am but if you are suggesting the pin to be long and e2ee, then isn't that just pure wormhole, doesn't wormhole protocol also do the same?

Also, i may be wrong again but by p2p / webrtc. I was already imagining encryption. Isn't that the case with webrtc given I have considered it "secure"

There is chitchatter which can be self hosted with ease as a static app and I am pretty sure that one can reconfigure it to better suit the purpose of this app.

Cheers! Hope you can edit out the mistake. Appreciate it.

link