Show HN: Send secure, self destructing messages

Back in high school I was an absolute numbskull when it came to math, or exact sciences in general. It wasn’t until I picked up programming that the most basic fundamentals of math sinked in. I’m a lot more advanced now, but I still learn new stuff every day. To get out of my comfort zone, I picked up a book called ‘The Code Book’ by Simon Singh a couple of months ago. The reviews on Amazon were great, but I didn’t expect it to be the pageturner it turned out to be. If you haven’t read it, you really should! It’s amazing how much cryptography changed our society. I particularly enjoyed the part on RSA encryption.

After reading the book I had the idea of creating a system for sending encrypted messages from one person to another. Something that spies in the cold war-era would use. The One Pad Cipher is unbreakable in theory, but is difficult to accomplish because you have to secure the key distribution. RSA encryption is really secure, but there still is no way to tell if the person you’re communicating with is actually the person you think he/she is.

Building cycret.com After reading the book I started out creating a CodeIgniter library for the RSA-encryption part. This was particularly fun because math isn’t my strongest point, but figuring out exactly what does what proved to be really rewarding.

There are a number of threats when it comes to encrypting a message: - Man in the Middle-attack: your message is intercepted - Breaking the cipher (either by clever decrypting or brute-forcing) - Evesdropping on the recipient

With Cycret, there are a number of steps to follow: - The sender asks permission from the recipient to send him/her a message through Cycret - When the recipient accepts, a keypair is shown. This keypair is shown only once, and isn’t stored in the database. Without this keypair, the message can’t be decrypted - The sender is notified and enters a message. The message is encrypted with the RSA algorithm - The recipient is notified, and decrypts the message with the keypair - After decryption, the message along with email addresses and other data is removed from the database

This procedure seems a little cumbersome (it is!) but this procedure addresses the threats I mentioned earlier: - The message isn’t being sent, but is only stored in the database for a short while (until it’s decrypted), in encrypted form. Even if the database is compromised the malicious hacker won’t be able to do anything with the messages. - The message is encrypted with the RSA algorithm. The decryption key isn’t stored or sent anywhere, it is only shown to the recipient once. - Because the message is deleted (burned) right after decryption brute-forcing and evesdropping on the recipient is difficult.

After the RSA encryption-part I built the rest of the website, so the notification system and the stages of the messages.

The ethical side I like to build things that make people think, and cycret is no different. During building it, I realized that a secure communications system can be used for both good and bad. After decryption and burning, there are no traces left of the message itself. At most you have some emails in your inbox that hint to the fact that you used cycret, but there is no way to recover the message itself. This could be great for people that are suppressed by their government and want to cook up a revolution, but can also be used to plan terrorist attacks or to order a murder or something. So the ethical side to cycret raises a bigger question: should you invent something that can be used for both good and bad?

Is it useful? Well, you all be the judge of that. I had fun building Cycret and learned a lot about encryption technology. If you would use Cycret, that would be great, but if you just had a good conversation about the ethics of inventions you made my day, too.

Anyway, the code is on Github if you want to use the CodeIgniter RSA library. Let me know what you think!

EDIT: fixed both the email address issue and the character limit. Thanks again everybody!