Comment by yoo1I | Hacker News Reader

Comment by yoo1I | Hacker News Reader

Summary:

http://www.seif.place

"HTML free based application delivery system based on [stripped down] node.js and QT"

He describes a "Helper Application" that he wants to convince browser vendors to install.

Features as I gleaned them from this talk.

- Replace DNS addressing with <publickey>@<ipaddress>/<referral> (since these are not human friendly: QRcodes and Petnames)

- Replace HTTP with a "Secure JSON over TCP"

- Content based addressing through file hashes

- communicate with QT through a messaging protocol

- For some reason reinvents an RNG(!) (what?) (EDIT: this originally said "running in Javascript(!)", based on the git repository that's probably not true)

- apparently no password will be needed ever again

All of it sounds a bit hyperbolic...

(OK I admit it, I stopped taking it seriously when he mentioned the awesome idea of adding microphone/camera input into the RNG for randomness, that just sounds like something which seems common sense on the surface, but is a totally incorrect thing to do in practice).

> is a totally incorrect thing to do in practice

Can you elaborate on this? I understand that there are many sources of entropy for random number generation, and it seems like this would be as good a way as any to store* a pool of some for future use.

(* Is it that the storage is the inherent problem?)

Hi, sorry for the late reply.

I meant it in the sense that it seems intuitively correct that you'd be able to get some random data out of a microphone somehow, but that intuition doesn't serve as a good adviser in cryptography.

I bet just looking at a recording from a computer microphone, it's possible to make deductions about it's structure. Let's say there are people in the room who talk with a certain pitch, the frequency of the AC current as it get's into the computer, things like that which all make the microphone output non-random.

So it might be that there is a way to generate true random numbers like that, but it's probably not as easy as just using the microphone as a source of entropy.

Based on the information that's in there, this makes mutual authentication based on TLS certifictes (or some other public-key-scheme) mandatory, and uses it for addressing. The only information that this talk contains about how to solve the introducton,authentication problem is this (paraphrasing):

"I don't trust Verisign to prove someone's identity, but I trust google's search results"

(As in "I googled for ACME Bank, and this is the address/public key that was returned, I am going to trust it")

The whole thing feels like something someone would come up in an afternoon with lot's of handwaving potential problems away.

Reply on news.ycombinator.com