cross-posted from: https://feddit.uk/post/1248314
DEF CON Infosec super-band the Cult of the Dead Cow has released Veilid (pronounced vay-lid), an open source project applications can use to connect up clients and transfer information in a peer-to-peer decentralized manner.
The idea being here that apps â mobile, desktop, web, and headless â can find and talk to each other across the internet privately and securely without having to go through centralized and often corporate-owned systems. Veilid provides code for app developers to drop into their software so that their clients can join and communicate in a peer-to-peer community.
In a DEF CON presentation today, Katelyn âmedus4â Bowden and Christien âDilDogâ Rioux ran through the technical details of the project, which has apparently taken three years to develop.
The system, written primarily in Rust with some Dart and Python, takes aspects of the Tor anonymizing service and the peer-to-peer InterPlanetary File System (IPFS). If an app on one device connects to an app on another via Veilid, it shouldnât be possible for either client to know the otherâs IP address or location from that connectivity, which is good for privacy, for instance. The app makers canât get that info, either.
Veilidâs design is documented here, and its source code is here, available under the Mozilla Public License Version 2.0.
âIPFS was not designed with privacy in mind,â Rioux told the DEF CON crowd. âTor was, but it wasnât built with performance in mind. And when the NSA runs 100 [Tor] exit nodes, it can fail.â
Unlike Tor, Veilid doesnât run exit nodes. Each node in the Veilid network is equal, and if the NSA wanted to snoop on Veilid users like it does on Tor users, the Feds would have to monitor the entire network, which hopefully wonât be feasible, even for the No Such Agency. Rioux described it as âlike Tor and IPFS had sex and produced this thing.â
âThe possibilities here are endless,â added Bowden. âAll apps are equal, weâre only as strong as the weakest node and every node is equal. We hope everyone will build on it.â
Each copy of an app using the core Veilid library acts as a network node, it can communicate with other nodes, and uses a 256-bit public key as an ID number. There are no special nodes, and thereâs no single point of failure. The project supports Linux, macOS, Windows, Android, iOS, and web apps.
Veilid can talk over UDP and TCP, and connections are authenticated, timestamped, strongly end-to-end encrypted, and digitally signed to prevent eavesdropping, tampering, and impersonation. The cryptography involved has been dubbed VLD0, and uses established algorithms since the project didnât want to risk introducing weaknesses from ârolling its own,â Rioux said.
This means XChaCha20-Poly1305 for encryption, Elliptic curve25519 for public-private-key authentication and signing, x25519 for DH key exchange, BLAKE3 for cryptographic hashing, and Argon2 for password hash generation. These could be switched out for stronger mechanisms if necessary in future.
Files written to local storage by Veilid are fully encrypted, and encrypted table store APIs are available for developers. Keys for encrypting device data can be password protected.
âThe system means thereâs no IP address, no tracking, no data collection, and no tracking â thatâs the biggest way that people are monetizing your internet use,â Bowden said.
âBillionaires are trying to monetize those connections, and a lot of people are falling for that. We have to make sure this is available,â Bowden continued. The hope is that applications will include Veilid and use it to communicate, so that users can benefit from the network without knowing all the above technical stuff: it should just work for them.
To demonstrate the capabilities of the system, the team built a Veilid-based secure instant-messaging app along the lines of Signal called VeilidChat, using the Flutter framework. Many more apps are needed.
If it takes off in a big way, Veilid could put a big hole in the surveillance capitalism economy. Itâs been tried before with mixed or poor results, though the Cult has a reputation for getting stuff done right. Âź
Iâve built and run it with minimal fuss, but am trying to find a good small app to really wrap my head around how to work in a wildly decentralized space. Anyone got a good idea for a particularly useful app with a solarpunk lean? I was thinking of something like local mutual aid, but am open to all kinds of wild ideas.