Skip to main content

lemmy - Link to source

An end-to-end encrypted anonymous webchat

Source code and details: git.anarchists.space/NanoChat/…

Features

  • Small codebase
  • Messages expire after 30 days
  • Panic button to delete all messages in a room
  • WebSocket for communication
  • Docker support

Technical details

  • AES-256-GCM for client-side encryption
  • Key is not sent to server
#privacy
in reply to nemesis3469

Voxel
lemmy - Link to source
Voxel
• •
Cloudfare doesn't let me through. 🙄
in reply to Voxel

nemesis3469
lemmy - Link to source
nemesis3469
• •
We were under attack from a Singaporean botnet for two weeks, so I had to put our Forgejo instance behind Cloudflare because of that 🥲
in reply to nemesis3469

airikr
lemmy - Link to source
airikr
• •
I literally hate people who only wants to destroy or weaken good things 😒 But why don't you use Codeberg? Is it because of downs every now and then because of the same reason (DDoS attacks from idiots)?
This entry was edited (3 weeks ago)
in reply to nemesis3469

solrize
lemmy - Link to source
solrize
• •
How does the anonymity work?
in reply to solrize

nemesis3469
lemmy - Link to source
nemesis3469
• •
There are no user identities (not even cryptographic ones), and room encryption key is stored in URL which is never sent to server. Anyone can choose any nickname and you can access official instance (nanochat.anarchists.space/) through Tor.

NanoChat

nanochat.anarchists.space
in reply to nemesis3469

dreamy (she/her)
lemmy - Link to source
dreamy (she/her)
• •
OnionShare already has a chat feature that works pretty well. What does this add?
in reply to dreamy (she/her)

nemesis3469
lemmy - Link to source
nemesis3469
• •
Codebase is small and easy to audit. The panic button wipes all chat history in a room and blocks future messages. OnionShare fully depends on Tor’s built-in encryption for message security while NanoChat has its own encryption, which means you can host it on different anonymity networks.
in reply to nemesis3469

thatsnomayo
lemmy - Link to source
thatsnomayo
• •
Thanks for sharing I recommend Cheogram web which is in beta but will reach the full feature set of the app in due time
in reply to nemesis3469

armrecords
lemmy - Link to source
armrecords
• •

A few ideas that could further strengthen the design:

  • Consider deriving separate keys from a master secret using HKDF (e.g. encryption key, authentication key, attachment key) instead of relying on a single key for everything.
  • Room IDs alone could leak metadata if discovered. An HMAC-based room authentication scheme could help without requiring the server to know any encryption keys.
  • Adding replay protection with counters/nonces and periodic key rotation would make the protocol more resilient.
  • For public deployments, some abuse protection (rate limiting, room creation limits, optional proof-of-work) would help prevent DoS attacks.
⇧