This is cmd-chat, a Python terminal chat app designed around a few constraints:
- No central servers - No message or key persistence - No plaintext credentials ever sent over the network
Authentication uses *SRP*, and messages are encrypted after key exchange. All data lives in memory only and disappears when the process exits.
This was partly a learning project and partly an experiment in building a “minimum-trust” chat system using standard cryptographic primitives.
Curious to hear thoughts on the threat model, crypto choices, and overall design.
zahlman•1mo ago
A couple things I didn't get:
* This is P2P, so it's arbitrary which side is "client" or "server", right? Users aren't connecting to a common "hub"?
* How are users meant to discover each other, or know what the password is? Is this something where those arrangements are made separately (perhaps in meatspace), and the authentication just cares that both sides use the same password?
Also: I get that the program isn't doing its own persistence, but I don't think "ram only — nothing touches disk" can be guaranteed these days with modern OS attitudes towards virtual memory.