Is there a reason why this still relies on a server? I would have thought that the better option would it to be completely P2P, without any servers whatsoever.
Show HN: A decentralized social network with end-to-end encryption
41–50 of 62 posts
Re: Show HN: A decentralized social network with end-to-end encryption
#42I want this to work so much. So many people have tried this, and I have signed up for, or self-hosted, every single one of these things, and even convinced my friends to join a few. None of them ever take off. How is this different?
Yes. There's Diaspora and Frendica already, with maybe a few hundred users.
To launch something like this, you need to figure out some way to get a user base, a user base that people will want to connect with. Something like
- Ivy League students (hey, it worked for Facebook.)
- VC, angels, investors, and startup CEOs. (They might like something with more security, especially since they might be planning to take a bite out of Facebook or Google.)
- Political groups, where there are communities of fund-raisers and lobbyists, people trying to get things done together and concerned with others not listening in.
Consider targeting groups that involve people working together to do something. They need to-do lists, spreadsheets, scheduling tools, and other collaboration support. Basically Box.net's feature set, but without Box, Inc.
Re: Show HN: A decentralized social network with end-to-end encryption
#43I want this to work so much. So many people have tried this, and I have signed up for, or self-hosted, every single one of these things, and even convinced my friends to join a few. None of them ever take off. How is this different?
Yes. There's Diaspora and Frendica already, with maybe a few hundred users. To launch something like this, you need to figure out some way to get a user base, a user base that people will want to connect with. Something like - Ivy League students (hey, it worked for Facebook.) - VC, angels, investors, and startup CEOs. (They might like something with more security, especially since they might be planning to take a bi…
Its a big leap to jump from a centralised social network to a truly distributed self hosted network. The missing link seems to be the semi-central ones, like having few central hosts which allow users to flow between them. Get the protocol to evolve and user adoption to happen on this and subsequently allow anyone to plugin their self hosted server, if they want to and still allow full network discovery across the hosts all over world.
Re: Show HN: A decentralized social network with end-to-end encryption
#44You really need to look on the security perspective to harden it. When it's marketed with security in mind.
And there's so many things wrong with the PHP syntax etc. as well as you have committed the entire Composer vendor/ folder. Put it in gitignore and remove it. You should not commit dependencies to your code base.
Re: Show HN: A decentralized social network with end-to-end encryption
#45Earlier quoted context omitted.
Yes, as written on top this is a technology preview, so it is not safe yet. Furthermore the production version will use the web crypto api. The client software must be shipped packaged as a standalone application (Apache Cordova etc.) with integrity protection or hosted on your own server and served via https. Yeah, the goal is actually to get some feedback about the crypto design and improve it :)
Unfortunately, the Web Crypto API doesn't automatically get you safe cryptography either. It was added by the W3C to allow video vendors to implement content DRM in pure Javascript rather than requiring plugins, and so it includes a great deal of legacy crypto. Long story short, you need an expert in cryptography to design this for you, whether or not you use WebCrypto. This isn't something you should take risks with…
2016 and using crypto as a lib is still so ludicrously difficult you still get advice to "get a crypto expert".
The failure of current crypto experts to create a usable crypto story is 100% why we can't have nice things.
Re: Show HN: A decentralized social network with end-to-end encryption
#46The cryptography in this system does not appear to be safe. Apart from the fact that it's browser Javascript, which can only be as secure as the server's verified TLS key anyways (and thus doesn't add any security TLS doesn't), it's also using outdated RSA crypto constructions that are vulnerable to attacks. I think you should find an expert to work on this project with you and provide the cryptographic design for yo…
> Apart from the fact that it's browser Javascript
Huge red flag.
Re: Show HN: A decentralized social network with end-to-end encryption
#47The cryptography in this system does not appear to be safe. Apart from the fact that it's browser Javascript, which can only be as secure as the server's verified TLS key anyways (and thus doesn't add any security TLS doesn't), it's also using outdated RSA crypto constructions that are vulnerable to attacks. I think you should find an expert to work on this project with you and provide the cryptographic design for yo…
> The cryptography in this system does not appear to be safe.
While one of the fundamentals, I think it's fair to say that swapping out cryptosystems is 0.1% of the work, or if the communication system needs to be redesigned, 1%. There goes a huge amount of work into designing and building all the rest.
Re: Show HN: A decentralized social network with end-to-end encryption
#48This is a serious question, because it's the situation I'm in: Why would somebody who is techy enough to use a decentralized social network, not just use IRC? I have a group of techie friends. We started a "private" IRC channel in 2010-ish and so far have been unable to find something better. Modern clients embed images, embed video links, and so on. We have bots that handle upvotes and offline messaging and a few ot…
In my opinion, IRC does not have the features that Charme can offer right now (not looking at the security perspective right now):
It allows smart ways to filter your friend's messages. For example, you could filter for people driving from point A to point B. Considering some hundred friends within one group (like in FB), you could handle the massive amount of messages manually any more.
So, these context things in Charme look very promising.
For hosting I agree that it might be a problem. But normally, you always know one of these techy guys :)
However, I completely agree with the last part: moving a user base is very tough or even impossible.
Re: Show HN: A decentralized social network with end-to-end encryption
#49The cryptography in this system does not appear to be safe. Apart from the fact that it's browser Javascript, which can only be as secure as the server's verified TLS key anyways (and thus doesn't add any security TLS doesn't), it's also using outdated RSA crypto constructions that are vulnerable to attacks. I think you should find an expert to work on this project with you and provide the cryptographic design for yo…
> The cryptography in this system does not appear to be safe. While one of the fundamentals, I think it's fair to say that swapping out cryptosystems is 0.1% of the work, or if the communication system needs to be redesigned, 1%. There goes a huge amount of work into designing and building all the rest.
Whaaaaat. No way man. Especially if this gains critical mass before it's production-ready for whatever reason (who knows why Farmville and GroupOn hit when they did -- right place, right time) it's nothing short of irresponsible especially without a way to effectively declare the system compromised and pull the plug.
Not only that but there are real social implications in having a system that even drops the word "end-to-end encryption" in its phrasing with the whole "Why Johnny can't have crypto" adoption problem. The average engineer rarely reads the docs, my mom would never read the README.md despite the fact that it explicitly says it's not production ready. That bitter taste is left in ones mouth for years (eg. people still associate Microsoft with unstable, insecure junk a la WinME (or unstable junk like Vista RTM [SP1 was fairly stable, but Vista still is a joke]). If this is Johnny's first exposure to crypto and he's using it to Tinder girls on the side, he's never going to trust crypto again.
Push comes to shove rolling your own crypto is completely irresponsible. There are plenty of 'alternative internet' solutions out there that are doing the responsible thing and following the conventional protocols (i.e., using libraries that have been heavily vetted by those with graduate degrees in cryptography, have protocols to revoke/expire your keys in place, WoT's, etc.)
RE: Designing and building the rest -- just like one should use someone else's crypto libs, there are already tons of 'alt-internet' infrastructures that exist which do something similar. It doesn't have the novelty of a mobile app, but most of them do have the cryptographic security to make up for it. Just to name a few-- https://cryptosphere.io/ uses libsodium, https://github.com/okTurtles/dnschain is based on GPG and standard PKI, https://wiki.enigmabox.net/ (I've only audited the cjdns server but it looks real solid, granted my specialty of mathematics is a whole different branch so I'm not even close to an authority, other than I know enough not to roll my own). Then of course there's all of the Moxie-type projects out there which I'll be damned if they've got any holes in there, the dude is of DJB meticulousness
Edit: Yeah basically what Thomas said below me, re: the responsible thing to do is to advertise it as a product with no cryptography in place. Apologies for the knee jerk reaction, but secure communication is something I've felt awfully strongly about, as exhibited by my post history pretty clearly.
Re: Show HN: A decentralized social network with end-to-end encryption
#50This is a serious question, because it's the situation I'm in: Why would somebody who is techy enough to use a decentralized social network, not just use IRC? I have a group of techie friends. We started a "private" IRC channel in 2010-ish and so far have been unable to find something better. Modern clients embed images, embed video links, and so on. We have bots that handle upvotes and offline messaging and a few ot…
How do you run the bots if you don't self-host them?