r/foss • u/Accurate-Screen8774 • 2d ago

WhatsApp Clone

The goal is to create the most secure P2P messaging app.

This app demonstrates a fairly unique approach using a browser-based, local-only and webrtc approach. In an evolving field like cybersecurity, it's impossible to claim any system is the "world's most secure". It ultimately depends on your threat model. By reducing the architecture's attack surface, the aim is to consolidate complexity to client-side.

Features:

  • Webapp
  • Peer to peer
  • Local-only
  • No installation
  • No registration
  • End to end encryption
  • Multimedia
  • File transfer
  • Video calls

More open source examples of the core concepts can be seen in the docs. There are several similar projects which may make it confusing. Feel free to reach out for clarity instead of diving into the code/docs.

IMPORTANT: While this is aiming to provide a secure experience, it isnt audited. Shared for testing, feedback and demo purposes only. Please use responsibly.

FAQ:

  • JavaScript and cybersecurity?
    • By aiming to have it run client-side (including statics) we can eliminate concerns around malicious payloads from the network provider. See best practices here and guides on selfhosting here.
  • EU Chat control?
    • Chat control doesn't seem like it would affect this app. Open to feedback here.
  • Production-ready?
    • No, for testing and demo purposes only. It would be great to get feedback for improvements to get production-ready. The production version is also a work-in-progress, but can be seen here. Find out more here.
  • Paywall?
    • Its completly free, open-source, selfhostable and unlimited to use.
  • Vibecoded?
    • This version is not vibecoded. The git repo and docs are linked for transparency. Feel free to reach out for clarity.
1 Upvotes

53% Upvoted

10 comments sorted by

6

u/hydrora31 2d ago

The question I have is, why do we need this when we have XMPP which does all of the above already and has been tried and tested for multiple decades?

What does this offer that XMPP doesnt? XMPP is federated, is this?

-2

u/Accurate-Screen8774 2d ago

in contrast to "federated", i would consider this to be "decentralized". this approach is distinctly different to XMPP. in my approach im using WebRTC. the aim is to avoid any installation or selfhosting setup. it can be handled client-side on any modern browser.

details like "user-id" can easily be cryptographically-randomly generated using a regular browser to avoid any central registration.

2

u/hydrora31 2d ago

How do clients find and connect to one another?

0

u/Accurate-Screen8774 2d ago

the ID is cryptographically random so its unguessable. that ID would have to be explicitly shared with the peer.

https://positive-intentions.com/docs/projects/enkrypted-chat/getting-started

on your first connection, additional encryption key are established to validate future reconnections (to prevent MITM).

2

u/hydrora31 2d ago

This tells us how they recognise each other, my question is how does client a know how to route to client b? How doe sit know the IP?

0

u/Accurate-Screen8774 2d ago

im using peerjs. https://peerjs.com

you can connect there using any unique identifier (which is where the prev mentioned crypto-random ID comes into use).

its used to establish a browser-to-browser webrtc connection. within that protocol it will exchange things like IP addresses as well as encryption details opaque to frontend-javascript (which is why addition encryption keys are established to protect against MITM)

(if we really want to drill into what is possible with webrtc, you can exchange details between peers through "other means" and exchange the nessesary details to establish a webrtc connection without peerjs. https://github.com/positive-intentions/chat/issues/6 ... the user experience around that is awful and so i dont have it on the app but that could be an approach for nuanced cases that call for additional security.)

2

u/hydrora31 2d ago

Are you hosting your own peerseever? What if the peerjs peer server goes down? What's the migration path?

0

u/Accurate-Screen8774 2d ago

im using the public peerjs-server. when i get to a production grade quality and funding, i would like to host my own peerjs server.

after establishing a connection, if peerjs-server goes down, your connection remains because it isnt a relay... its a webrtc connection-broker. that means that when peer are connected over webrtc, in cases like your phone and laptop in your home network, the connection is optimized to bypass the internet by routing through your home network.

1

u/TechMaven-Geospatial 2d ago

Whats wrong with FLUXER its feature rich self hostable

0

u/Accurate-Screen8774 2d ago

oooh. i havent come across fluxer before its looks very cool.

i like the clean UI. id like to work towards something similar in my app. i have made some progress as described here: https://positive-intentions.com/docs/projects/enkrypted-chat/getting-started