Show HN: ShadowCat – file transfer through QR Codes in a Browser

82 pointsposted 6 hours ago
by unprovable

37 Comments

divan

3 hours ago

This method of animated QR data transfer is quite efficient with fountain codes. I had PoC implementation back in the day - Txqr [1] [2]

[1] https://divan.dev/posts/animatedqr/

[2] https://divan.dev/posts/fountaincodes/

Recently I rewrote it in Dart/Flutter and finally implemented RaptorQ codes (way more efficient than Luby used in original Txqr). Testing it internally now, prepareing Appstores/GooglePlay/Web deployment and new article.

unprovable

6 hours ago

Single page file transfer using QR Codes and a browser. Sending device loads a file into the page, gets chunked. Receiver gets all the chunks through a camera, tosses lightly and reassembles, CRC to garnish. Designed to push data from an old phone that had broken comms after it took a swimming lesson in a coffee mug, it's been quite handy.

HanClinto

2 hours ago

If the phone had broken comms, how did you get the code onto the phone to run?

Chant-I-CRW

38 minutes ago

In ye olden days we used cables to sync all of our apps and data to our phones.

wongarsu

19 minutes ago

But why not move the data over that cable? Some kind of iOS thing that made that more complicated than pushing an app to the phone?

pajamasam

4 hours ago

Interesting idea! A demo video would be great :)

jaysyrk

12 minutes ago

I created a file optimizer, one single file. I was wondering if i could work with you to integrate that into your project. Lmk!!

lukew3

5 hours ago

You should turn on github pages so we can see it live. Seems cool but I’m not at my pc rn

encom

7 minutes ago

We used to be able to send arbitrary files between phones using Bluetooth. Where did that go? We had a bit of a music piracy ring going at school for a time. Good times.

MattCruikshank

4 hours ago

I've wanted to use this for an air-gapped communication device.

I have a device with a camera and a touch-screen that only uses capacitive charging. I type a message. Bytes are encrypted. I hit send. QR codes flash on my screen. I use my PC or my normal phone to receive the encrypted bytes, and transmit them to you. You have the same device. You have your PC or phone flash encrypted QR codes. You use your device to receive, and then decrypt.

I've daydreamed about also buying several different hardware random noise generators. XOR all of their bits together. Save a huge one time pad to each of our devices. And then also use public key crypto on top of it.

I'm not really sure why I want this. But, it's my answer for how to reduce attack surface as much as possible, and have truly secret messages.

skinfaxi

3 hours ago

> I have a device with a camera and a touch-screen that only uses capacitive charging. I type a message. Bytes are encrypted. I hit send. QR codes flash on my screen. I use my PC or my normal phone to receive the encrypted bytes, and transmit them to you. You have the same device.

Why do you need a separate device for this and not just an airgapped computer?

MattCruikshank

3 hours ago

Me, in my life, I have a PC that's connected to the internet. I have a phone that's connected to the internet.

I want another device, which I imagine to be a Pi or Esp32 or something with a camera and a touchscreen display, and capacitive charging. After I program it and give it the public/private keypair and the OTP, I imagine physically breaking off a USB port, or sealing one with some hardening resin.

I don't want an entire airgapped computer. Maybe you do, that's fine. For me, I'd love it to be a credit-card sized doodad.

reaperducer

2 hours ago

I have a device with a camera and a touch-screen that only uses capacitive charging. I type a message. Bytes are encrypted. I hit send. QR codes flash on my screen. I use my PC or my normal phone to receive the encrypted bytes, and transmit them to you. You have the same device. You have your PC or phone flash encrypted QR codes. You use your device to receive, and then decrypt.

Congratulations. You just invented IrDA: https://en.wikipedia.org/wiki/IrDA

hootz

5 hours ago

I love this type of stuff. Some years ago I did something similar, but instead of QR Codes it used a convoluted mess of audio frequency modulation to send data through sound between devices. This is much more practical if you have two cameras.

xnx

4 hours ago

> a convoluted mess of audio frequency modulation

Like a modem

hootz

4 hours ago

I guess lmao, but much more rudimentary, less reliable and with loads of issues, as it had to blast piercing sounds through a speaker and then capture those with a microphone. But it was pretty cool when it worked!

skinfaxi

3 hours ago

Did you explore using frequencies outside the range of human hearing?

hootz

3 hours ago

No, but that's a cool idea. I think the main problem is that consumer hardware usually gets kinda inconsistent outside our hearing range.

deletedie

3 hours ago

Apple uses this approach when pairing some devices for verification e.g. setting up HomePods using an iPhone

reaperducer

2 hours ago

Did you explore using frequencies outside the range of human hearing?

Amazon had modems very much like this in its little buttons that you could stick to your refrigerator and automatically order different items. When setting up the device, you could only hear the little clicks as it turned on and off.

I loved the technology. Hated that the prices changed all the time and you never knew what price you were going to pay ahead of time.

tripflag

4 hours ago

Cool! Out of curiosity, since qr-codes can contain binary data -- rather than base64, have you tried inserting the file as-is? That way you could do away with the ASCII separator and have a binary header as well. This would spend less frames for the same amount of data, but I'm not sure if it would be computationally cheaper. The other alternative would be the alphanumeric mode of qr-codes, but then you lose lowercase.

hoansdz

4 hours ago

I once heard someone create a QR code scanner to retrieve gigabytes of data, but the biggest problem is that cameras aren't powerful enough to handle it all. Essentially, the QR code needs to be downloaded to the device for loading; relying on the camera to retrieve it is very difficult. Am I wrong about this project? What's your solution?

0cf8612b2e1e

an hour ago

Why not record with a standard high quality webcam and do the QR processing later? That’s how I would exfiltrate a large volume of data.

rirze

an hour ago

You could also do it the menial way; create multiple QR codes that can connect together. Not very practical for everyone except the very-motivated.

bensyverson

3 hours ago

I've done a POC with the native QR reading code on iOS. The short answer is: it's not a problem at all, and you can drive very large QR codes for more efficient transfer.

thedougd

4 hours ago

I've done this exact approach before. It's a good way to exfiltrate data. Post the software on GitHub pages, or a popular CDN that co-hosts other shared libraries and you've got a very difficult to block method.

Really goes to show that it's very difficult to stop a motivated and informed actor.

skinfaxi

3 hours ago

If you can connect to Github pages couldn't you exfil that way? This takes 2 mins for 100KB.

thedougd

26 minutes ago

Not quietly. Uploads are commonly monitored by data loss prevention (DLP) solutions, especially when MITM is being used for corporate proxy.

Downloading a tiny JS from a CDN, or accessing a GitHub page is mostly noise, especially if obfuscated well.

skeptic_ai

2 hours ago

Npm install qr-made-up-name Can show qr in console. How do you stop that?

thedougd

23 minutes ago

I'm likely being overly specific, but blocking npm downloads, installation on corporate devices, etc is trivial in a restrictive corporate environment.

acrophiliac

2 hours ago

What's the length limit? I tried pasting some text and got this message: code length overflow. (85700>18672)

alex_suzuki

4 hours ago

Cool stuff. I’m fond of the “single HTML file” deployment option.

Aleesha_hacker

an hour ago

Let Ai help you research not write keeps the content human and original

villgax

5 hours ago

What would make this truly portable is being able to generate this consistently with a short prompt and generate with a local LLM. That way no network calls or file hash can prevent this