Hardlint网络安全团队发布了Hard-Chat，一款基于浏览器的开源P2P加密聊天应用1。该工具采用无服务器架构，用户无需创建账户，仅通过共享房间密钥即可建立端到端加密通讯1。
Hard-Chat采用AES-GCM 256位加密算法，并使用PBKDF2进行密钥派生，迭代次数达100,000次1。应用利用WebRTC技术实现用户之间的直接连接，消息不经由中央服务器中继1。为保证隐私性，系统不存储任何数据——不使用cookies、本地存储或数据库，所有通讯内容仅存于内存中1。房间密钥为100字符的随机生成字符串，需通过其他渠道手动传递给通讯方1。连接建立有时限要求，若在120秒内未成功连接，房间密钥将自动过期1。
该项目配置了18个STUN/TURN服务器作为备用方案，支持在受限网络环境下运行1。应用基于HTML5/CSS3开发，利用Web Crypto API进行加密操作，集成PeerJS v1.5.4库，并托管于GitHub Pages1。用户需使用支持WebRTC的现代浏览器在HTTPS环境下访问1。开发者在文档中明确说明了已知限制，包括不保证网络层匿名性、不提供会话间前向保密以及缺乏对端身份认证机制1。
Hardlint Cybersecurity Team has released Hard-Chat, a browser-based serverless P2P encrypted chat application that operates entirely in RAM with no data persistence.1 The tool employs AES-GCM 256-bit encryption combined with PBKDF2 key derivation using 100,000 iterations to secure communications, with users establishing end-to-end encrypted connections through shared room keys without requiring accounts.1 Connection is facilitated by direct WebRTC links rather than central server relays, and the application is configured with 18 STUN/TURN backup servers to handle restrictive network environments.1
The software operates without any persistent storage mechanisms—no cookies, localStorage, or databases are employed—and room keys are randomly generated 100-character strings shared through external channels by users.1 Room keys automatically expire if a connection fails to establish within 120 seconds.1 Hard-Chat is accessible through modern browsers that support WebRTC and operate in HTTPS Secure Context environments.1 As an open-source free project, it includes comprehensive technical documentation detailing its encryption mechanisms, operational architecture, and acknowledged limitations including the lack of network-layer anonymity guarantees, absence of forward secrecy across sessions, and no peer identity authentication.1
评论
还没有评论，欢迎留下第一条。