[HN Gopher] Show HN: Encrypt and upload files to IPFS from browser
___________________________________________________________________
Show HN: Encrypt and upload files to IPFS from browser
Hi HN, I'm building ThirdCloud with the goal to replace Google
Drive for everyone: more private, cheaper & maybe better UI/UX. So
far, I've successfully implemented the main feature, which involves
uploading and downloading files. Files are encrypted before being
sent to IPFS network. Would like to hear your thoughts on this
proof of concept.
Author : tri2820
Score : 42 points
Date : 2023-10-27 14:11 UTC (8 hours ago)
(HTM) web link (www.thirdcloud.org)
(TXT) w3m dump (www.thirdcloud.org)
| jqpabc123 wrote:
| Allow the user to decide if encryption should be applied to files
| or not.
|
| I have files that are already encrypted.
| superdug wrote:
| I'm not arguing that you don't have a valid point nor that the
| feature request should be beneficial for the project to add to
| gain wider adoption. I know why this feature isn't there
| though, because doubly encrypting something doesn't do anything
| but add another layer of protection they guarantee by default,
| but that the computational cost of this possibly not needed
| protection is assumed by the provider and not the consumer. On
| top of which other features have obviously been added before
| it, with an announcement of the service with the features that
| differentiate it from already available and established
| competing services.
| jqpabc123 wrote:
| A simple checkbox is all that is needed.
| tri2820 wrote:
| Sure
| lagniappe wrote:
| I was under the impression IPFS was a content addressing system
| with a p2p layer. Does ThirdCloud upload it to a pinning server?
| tri2820 wrote:
| Yeah, I'm uploading it through NFTStorage gateway (your files
| then will be pinned by many nodes on IPFS network)
| brocklobsta wrote:
| Neato! My main concern is reliability of this type of service.
| Given the boom/bust cycle of crypto I have my hesitations.
|
| Anyway to download a file via curl? I wouldn't mind setting up a
| cronjob to periodically download a testfile to track the
| reliability over time.
| chrisco255 wrote:
| Booms and busts in crypto affect the market price, not
| reliability. Historically, blockchains with significant
| adoption and robust engineering like Bitcoin and Ethereum have
| had 100% uptime since near inception. Filecoin is newer (think
| the network went live in 2019), but since this relies on IPFS,
| you can also just back up your files in any other way (hard
| drive, cloud, etc) and the IPFS protocol will pull a file from
| any of several pinned data sources on the network.
| tri2820 wrote:
| I could link a helper script to download the file later
| katella wrote:
| I think curl added some support for ipfs recently. Saw a
| previous discussion here
| https://news.ycombinator.com/item?id=37628525
| ianburrell wrote:
| How is encrypted? Is it content-based encryption so files can be
| shared? How are the encryption keys stored?
|
| Who is pinning the files in IPFS?
|
| How are you planning on charging for storage? Are you going to
| use Filecoin?
| tri2820 wrote:
| It's encrypted directly on your browser, you can download the
| encryption key after file is uploaded. Not content-based
| (because the header is randomly generated & you keep the
| encryption key) but you can share to secret file to others and
| they will be able to download the file.
|
| Files are pinned mainly by NFTStorage.
|
| Currently it's free because NFTStorage is free. If things
| change I would allow buying storage using Filecoin
| (~$0.2/TB/month).
| zauguin wrote:
| According to NFTStorage's Terms and Conditions:
|
| > The Service is offered for the creation and storage of
| NFTs. Use of the Service to store other types of data is not
| permitted.
|
| Do you have a special agreement with NFTStorage which
| overrules the general Terms and Conditions?
| srustagi wrote:
| https://web3.storage/ most likely
| RobotToaster wrote:
| Isn't any file stored on IPFS by definition a NFT, since
| the address identifies a unique file?
| chrisco255 wrote:
| Technically no, you'd need to also deploy a NFT smart
| contract that creates a new token for each file. But
| theoretically any media type could be represented by an
| NFT so it's sort of an arbitrary restriction by
| NFT.storage. Probably not super enforceable on their
| part. I imagine the promo will end at some point though.
| Filecoin just happens to have an excess of available
| storage right now, which is why they can afford to offer
| it for free.
| r3trohack3r wrote:
| This is amazing, great work! I love that it does everything in-
| browser.
|
| A handful of questions:
|
| Your currently uploading to a gateway and are considering moving
| to your own gateway backed by filecoin. Have you considered
| ditching the gateway and using the libp2p WebRTC and/or WebSocket
| transports to upload directly to the network via the browser tab?
|
| Where are you hosting this and how are you protecting against
| "supply chain attacks" where your hosting provider (either
| maliciously or through their service being compromised) injects
| additional JS that exfiltrates secrets? Have you explored
| managed/trusted upgrades to the existing user's apps through
| browser storage and a service worker? I don't know of any
| surefire ways to protect against the first delivered page being
| compromised, or a compromised browser environment, but could you
| lock down the upgrade path for the app for returning users by
| moving it outside of the page load path? (Not just a question for
| OP, I've been wondering about this for a bit now, it's kinda
| critical path for delivering P2P experiences to a browser tab -
| you need a way to minimize trust of the server hosting the
| HTML/JS files otherwise it can trivially exfiltrate your secrets)
|
| What is the migration path off of this? If I have this metadata
| file, how do I use it locally to fetch my encrypted files
| directly from the IPFS pinning server without having to return to
| your site?
|
| How does multi-user access work?
|
| What do you think the path to beating Google Drive on UI/UX is
| with P2P software?
|
| ---
|
| We are working on a very similar problem to this right now, using
| the guts of IPFS and some stuff borrowed from Secure Scuttlebutt
| et. al. to manage encrypted files, identities, and capabilities.
| We also have a way to encrypt a file once and share individual
| per-user encryption keys on-demand bound to the user's private
| key. This lets the decryption keys be mirrored by nodes (i.e. put
| it on IPFS!), without the corresponding private key the
| decryption key is worthless. Next we are exploring UCAN for
| managing capabilities and granting access. And an overlay network
| to power it all. I'd love to compare notes with you.
|
| Do you want a job? There is an open spot on my team working on
| exactly this stuff. Our goal is to make an SDK for building these
| exact types of apps.
|
| Salary bands max out at $250k. Fully remote team, nomad friendly,
| 4 day work weeks. Time is spent roughly 50/50 implementing stuff
| and reading research papers (like Filecoin, IPFS, Scuttlebutt,
| etc.).
|
| We have an open interview challenge for the team that gives some
| good insight into what the role is and what a "day in the life"
| will be like: https://gitlab.com/webai-open/network/interview-
| challenge
| StableAlkyne wrote:
| It's always very cool to see ShowHN posts result in a job
| offer. Seems to happen often enough here, but I never really
| see it on any other forum
| INTPenis wrote:
| It's hardly unlimited though. I can't even upload a 1.82kB image
| file to test it. Probably because whatever service it uses to
| access IPFS is saturated. So that wouldn't be unlimited in my
| book.
|
| I love selfhosted stuff like IPFS, but keep expectations
| realistic or people will just leave with a bad impression of
| them.
| stavros wrote:
| What's the use case? If I have files, why should I store them on
| IPFS and pay someone to pin through all that complexity, rather
| than just use Google Drive or whatever?
| StableAlkyne wrote:
| Encryption gets broken eventually as we get more compute power,
| and the current algorithms could have problems we're not yet
| aware of. IPFS requires every node to agree to your delete
| request (if I'm understanding it correctly).
|
| What's stopping someone from just vacuuming all the data they can
| until codebreaking catches up with encryption?
|
| Is there a way to remove malicious content? For example, if
| someone uses this to store some malware's payload and you don't
| want your project being used for that, what happens?
|
| That said, IPFS is cool, and this project is a neat application
| of it
| ianopolous wrote:
| You can make blocks private in ipfs so only authorised people
| can download them. Here's how we do this in peergos
| https://peergos.org/posts/bats
| taway1237 wrote:
| >Is there a way to remove malicious content? For example, if
| someone uses this to store some malware's payload and you don't
| want your project being used for that, what happens?
|
| My job involves fighting malicious content on the internet. No,
| there's no way to remove malicious content from ipfs. It's
| especially annoying when the ipfs2http gateway takes path using
| a GET parameter (instead of it being a part of a domain name)
| because it makes it unblockable on the DNS level.
| tamimio wrote:
| Looks cool, though I don't trust the cloud when it comes to file
| storage.
| Welmoto wrote:
| Not a big fan of hosting / supporting ipfs with all this garbage.
|
| NFT and random encrypted backups
___________________________________________________________________
(page generated 2023-10-27 23:01 UTC)