Direct file transfer between devices via WebRTC

[Man]

The new WebWormHole service works as a portal through which files are transferred from one computer to another. You click the New Wormhole button and get a code to enter. The person on the other side enters the same code or URL - and an ephemeral tunnel is established between you, through which files are transferred directly. Very simple and effective. Source code on Github.

You don't need to open a browser to install a portal between devices. The Go client runs from the command line and generates a one-time code in the console.

Installation:

$ go get -u webwormhole.io/cmd/ww

Transfer:

$ cat hello.txt
hello, world
$ ww send hello.txt
8-enlist-decadence

The recipient on the other side of the ephemeral tunnel enters a one-time code into the console and receives the file.

$ ww receive 8-enlist-decadence
$ cat hello.txt
hello, world

The author of the program, Salmān Aljammāz, warns that the client is in early development, uses experimental cryptographic libraries, so it may glitch and not work in all browsers. The program has also not passed a security audit, so it may work incorrectly and unsafely.

The author borrowed the idea and name from the Magic Wormhole program, which also establishes a peer-to-peer connection and transfers files between computers.

Magic Wormhole

The difference is that WebWormHole uses WebRTC, which allows you to break through firewalls and NAT, as well as start the transfer from the browser.

Each tunnel is protected by a one-time password and PAKE - this is a specific way of exchanging keys with password authentication to establish an encrypted connection. The password itself is not transmitted over the network in any form.

The verification is carried out in a manner similar to a zero-knowledge proof, in which the recipient can verify the veracity of a statement without having any other information from the sender.

SPAKE2

In WebWormHole, session descriptions with DTLS certificate fingerprints, which WebRTC uses to encrypt connections, are exchanged to generate a common encryption key.

Transferring files via a peer-to-peer tunnel is faster and safer than via email, FTP, or other methods. These methods are compared in terms of convenience and security in the table from the Magic Wormhole presentation:

	Input by sender	Recipient input	Physical intimacy	Wiretapping
E-mail	~30 simv.			providers, certification centers, internet
Upload to FTP/HTTP		~60 simv.		server, providers, certification centers, internet
Dropbox		~60 simv.		Dropbox, Certification Authorities
+link shortening service		~20 simv.		URL Shortening Service, Random Enumeration, Dropbox, Certificate Authorities
USB drive			X
SSH/scp		~740 chars public key		nobody
magic wormhole		~20 simv.		nobody

Note: Since this table was compiled back in 2016, convenient file transfer services such as Firefox Send (there is a console client) and File.pizza have been launched.

In addition to Python's Magic Wormhole, there are other clients for establishing direct connections via WebRTC between computers:

• pion WebRTC: Go's WebRTC API implementation
• aiortc: WebRTC library for Python's asyncio framework
• webrtcbin
• rawrtc
• node-webrtc

As a bonus:

• rtc-ssh: WebRTC wrapper for SSH-connected

The WebRTC channel can be used to establish video communication between devices, transmit voice, files, etc.

As for the PAKE key exchange mechanism, it is useful in various areas. For example, it allows you to implement authentication on a website without transmitting a password to the server.

Source