Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

ZeroRelay: Direct Browser-to-Browser Sharing - No Server Ever Sees Your Data

A fully open-source P2P mesh app for sharing text, code, notes, and files directly between browsers. No signup, no accounts, no database. The Pain Point You're sitting next to a colleague. You need to send them a 200MB…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

A fully open-source P2P mesh app for sharing text, code, notes, and files directly between browsers. No signup, no accounts, no database.










The Pain Point



You're sitting next to a colleague. You need to send them a 200MB video file.





  • Email? 25MB limit + compression


  • Drive/Dropbox? Need an account + files sit on their servers forever


  • WhatsApp/Telegram? Compresses media + stores everything on their servers


  • AirDrop? Apple-only, doesn't work half the time


  • USB? Who carries one anymore?


  • SCP/iPerf? Overkill for a quick share



ZeroRelay: Open a tab,drag the file. Done. Direct browser-to-browser. Nothing touches a server.









Demo



Zero Relay Demo









What's ZeroRelay?



A peer-to-peer mesh app where every browser connects directly to every other browser over WebRTC. The signaling server (Cloudflare Durable Object) only exchanges join/leave messages and ICE candidates - it never stores or even sees your messages, files, or avatars.



Each peer is its own database - everything lives in IndexedDB (Dexie) on your browser. When you share something, it's broadcast over WebRTC data channels directly to connected peers. There is no central storage. There is no cloud. Your data never touches a server.






Architecture






                    ┌─────────────────┐
│ Cloudflare DO │ ← signaling only
│ (per room) │ (join/leave/ICE relay)
└────────┬────────┘
│
┌──────────────┼──────────────┐
▼ ▼ ▼
┌────────┐ ┌────────┐ ┌────────┐
│ Peer A │◄──►│ Peer B │◄──►│ Peer C │ ← WebRTC mesh
│(Dexie) │ │(Dexie) │ │(Dexie) │ (data channels)
└────────┘ └────────┘ └────────┘






Each browser stores its own copy of everything in IndexedDB. When you share something, it's broadcast to all connected peers over WebRTC data channels. The signaling server never sees your messages, files, or avatars.



For full architecture deep-dive, see ARCHITECTURE.md on GitHub.









Features








































Full P2P Mesh Every peer connects directly to every other - no central relay
Zero Server Storage No database, no logs, no message history on any server
No Signup or Accounts Open the app, join a room - done
Share Anything Text, code, notes, or files of any size
Password-Protected Rooms Room-level passwords enforced by Cloudflare DO
Retention Per Item Session, 5 min, 1 hour, 1 day, or forever
Open Source MIT - fully auditable and self-hostable








Important Note
























Peer Discovery Works globally - anyone on the internet can see you in the room
Data Transfer Works on same LAN - messages and files flow when peers are on the same network
Cross-Network Not yet - needs a TURN server for symmetric NAT traversal


Peer discovery goes through the Cloudflare DO (WebSocket over TCP) so it works anywhere. Data transfer uses WebRTC which needs STUN/TURN to cross the public internet. Currently STUN-only. TURN support and contributions are welcome:)









Tech Stack








































Layer Choice
Frontend Next.js 15 + React 19
State Zustand (in-memory + localStorage persist)
Persistence Dexie v4 (IndexedDB)
P2P Transport WebRTC (full mesh topology)
Signaling Cloudflare Workers + Durable Objects
Styling Tailwind CSS v4
Tooling Biome, TypeScript, Husky








Why Open Source?





  • Transparency - anyone can audit exactly what the server does (and doesn't) store


  • Self-host - deploy your own signaling worker if you want













MIT License

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense
Syntax validiert (0 Fehler)
title: Detect Exploitation - ZeroRelay: Direct Browser-to-Browser Sharing - No Server Ever Sees Your Data
id: 99b38eef-62fb-4a44-a4da-e8e1dcec6e49
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-26
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-26"
        description = "YARA Signature for "
    strings:
        $str = "ZeroRelay: Direct Browser-to-B" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("ZeroRelay Direct Browser-to-Browser Shar")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*ZeroRelay Direct Browser-to-Browser Shar*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "ZeroRelay Direct Browser-to-Browser Shar"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

CTI Threat Relationship Graph3 Knoten / 2 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich ZeroRelay: Direct Browser-to-Browser Sha.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten ZeroRelay: Direct Browser-to-Browser Sharing - No Server Ever Sees Your Data

Thematisch verwandte Begriffe: ZeroRelay, Direct, BrowsertoBrowser, Sharing · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

💬 Kommentare werden geladen…
Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-100620 | Capgo CLI (npm package @capgo/cli) through 7.98.2 is affected by an ove…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag