[https://github.com/positive-intentions/chat](https://github.com/positive-intentions/chat) probably not... Because I'm comparing it to everything... but id like to share some details about how my app works so you can tell me what im missing. id like to have wording in my app to say something like "most secure chat app in the world"... i probably cant do that because it doesnt qualify... but i want to understand why? im not a cyber security expert. im sure there are many gaps in my knowlege of this domain. using javascript, i created a chat app. it is using peerjs-server to create an encrypted webrtc connection. this is then used to exchange additional encryption keys from cryptography functions built into browsers to add a redundent layer of encryption. the key exchange is done like diffie-helman over webrtc (which can be considered secure when exchanged over public channels) - i sometimes recieve feedback like "javascript is inherently insecure". i disagree with this and have opened sourced my cryptography module. its basically a thin wrapper around vanilla crypto functions of a browser. [a prev post](https://www.reddit.com/r/cryptography/comments/1cint8h/what_are_your_thoughts_on_subtlecrypto_vs_wasm/) on the matter. - another concern for my kind of app (PWA) is that the developer may introduce malicious code. this is an important point for which i open sourced the project and give instructions for selfhosting. selhosting this app has some unique features. unlike many other selfhosted projects, this app can be hosted on github-pages for free and instructions are provided. im also working on introducing a way that users can selfhost federated modules. [a prev post](https://www.reddit.com/r/selfhosted/comments/1ecsst5/selfhosted_federated_modules/) on the matter. - to prevent things like browser extensions, the app uses strict CSP headers to prevent unauthorised code from running. selfhosting users should take note of this when setting up their own instance. - i often get touted things like the Signal/Simplex protocol is amazing and great, etc. id like to compare that opinion to the observation in how [my todo app ](https://github.com/positive-intentions/p2p/blob/staging/src/stories/TodoDemo.stories.js) demo works. (the work is all experimental work-in-progress and far from finished). the demo shows a simple functionality for a basic decentralized todo list. this should already be reasonably secure. i could add a few extra endpoints for exchanging keys diffie-helman style. which at this point is relatively trivial to implement. I think it's simplicity could be a security feature. i think if i stick to the principle of avoiding using any kind of "required" service provider (myself included) and allowing the frontend and the peerjs-server to be hosted independently, im on track for creating a chat system with the "fewest moving parts". im hope you will agree this is true p2p and i hope i can use this as a step towards true privacy and security. security [might be further improved](https://www.reddit.com/r/WebRTC/comments/1e7sq0b/webrtc_ip_leaking_advice_wanted/) by using a trusted VPN. i created a[ threat-model](https://positive-intentions.com/docs/research/threat-model/) for the app in hopes that i could get a pro-bono security assessment, but understandable the project is too complicated for pro-bono work. i created a [decentralized todo list demo](https://p2p.positive-intentions.com/?path=/docs/demo-todo-list--docs) using the p2p framework used in the chat app. this is to demonstrate the bare-minimum functionality of decentralised messaging and state management. while there are several similar apps out there like mine. i think mine is distinctly a different approach so its hard to find best practices for the functionalities i want to achieve. in particular security practices to use when using p2p technology.

a decentralized P2P todo list app to to demo the P2P framework used in the chat app. https://github.com/positive-intentions/chat This is a wrapper around peerjs. peerjs is good, but it can become complicated to use on complicated projects. This implementation is an attempt to create something like a framework/guideline for decentralized messaging and state management. https://positive-intentions.github.io/p2p/?path=/story/demo-todo-list--basic how it works: 1. crypto-random ids are generated and used to connect to peerjs-server (to broker a webrtc connection) 2. peer1 shares this ID to another browser/tab/person (use the storybook props) 3. peers are then automatically connected. 4. add todo item 5. edit todo item There are several things here to improve like: - general cleanup throughout (its early stage for this project and missing all the nice things like good-code and unit-tests) - adding extra encryption keys for messages comming in and going out (webrtc mandates encryption already) - handling message callbacks - key rotation The goal is to create a private and secure messaging library in JavaScript running in a browser.

chat.positive-intentions.com https://github.com/positive-intentions/chat I'm excited to share with you an instant messaging application I've been working on that might interest you. This is a chat app designed to work within your browser, with a focus on browser-based security and decentralization. What makes this app unique is that it doesn't rely on messaging servers to function. Instead, it works based on your browser's javascript capabilities, so even low-end devices should work. Here are some features of the app: - Encrypted messaging: Your messages are encrypted, making them more secure. - File sharing: Easily share files using WebRTC technology and QR codes. - Voice and video calls: Connect with others through voice and video calls. - Shared virtual space: Explore a shared mixed-reality space. - Image board: Browse and share images in a scrollable format. Your security is a top priority. Here's how the app keeps you safe: - Decentralized authentication: No central server is required for login, making it harder for anyone to gain unauthorized access. - Unique IDs: Your ID is cryptographically random, adding an extra layer of security. - End-to-end encryption: Your messages are encrypted from your device to the recipient's device, ensuring only you and the recipient can read them. - Local data storage: Your data is stored only on your device, not on any external servers. - Self-hostable: You have the option to host the app on your own server if you prefer. The app is still in the early stages and I'm exploring what's possible with this technology. I'd love to hear your feedback on the idea and the current state of the app. If you have any feature requests or ideas, I'm all ears in the comments below! Looking forward to hearing your thoughts! [The live app](https://chat.positive-intentions.com) [About the app](https://medium.com/@positive.intentions.com/introducing-decentralized-chat-377c4aa37978) [Docs](https://positive-intentions.com)