MeroChat - Friendly Random Chat
mero.chat
Chat to new people who also just want to chat. MeroChat is a text based chat site for having actual conversations

Bored on holidays or miss Omegle? Come chat with us on MeroChat!

It’s a web based random chat where you’re presented with a flow of user profiles, whom you can choose to chat with. And of course someone else might find you the same way and send you a message out of the blue (provided your privacy settings allow it).

And here’s the code. (Written in PureScript!) A lot remains to be done but it’s a joyful thing already.

  • waffle
    5·
    8 hours ago

    Yeah, I’m not used to E2EE in the browser either and StackExchange seems to agree that there’s no nice solution :/

    The sanest option in terms of user practicality to me appears to be storing the private key on the server, maybe encrypted with the user’s password, and sending it to the user on successful login where it would be decrypted client side. It seems like it’s more or less what MEGA is doing since they have a similar issue

    If the server having temporary access to the user’s password is an issue maybe the password could be partially pre-hashed before being sent?

    It’s be interesting to talk about it with someone with more experience, especially since implementing all of that will be a pain so it can’t be redone every Thursday

    • Tiuku@sopuli.xyzOP
      2·
      13 hours ago

      The sanest option in terms of user practicality to me appears to be storing the private key on the server, maybe encrypted with the user’s password, and sending it to the user on successful login where it would be decrypted client side.

      That does seem reasonable, but it doesn’t solve the trust issue. The server might always send a modified script that just uploads the plaintext private key.

      That said it would still be useful in other ways. Like in a breach the data would be secure.

      • waffle
        2·
        7 hours ago

        The server might always send a modified script that just uploads the plaintext private key.

        Yeah, you’d need a way to validate the client code before it’s executed to solve that issue

        Section “2. Client application security” of MEGA’s Security Whitepaper discusses this exact problem. Their best solution to that issue is to just cram the whole frontend in a signed web extension and not serve any code to the user when the extension is active, which is not very user friendly but works for those who want an extra layer of protection

        I just can’t find a good user-friendly implementation, sorry for not being of more help. The web just isn’t E2EE-friendly ig :/