Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: A decentralized social network with end-to-end encryption

github.com

Post reply on HN
Print view View original

51–60 of 62 posts

Re: Show HN: A decentralized social network with end-to-end encryption

#51

Post by dutchbrit »

As someone who has been working on something similar (see old proof of concept here: https://ciety.com - sorry for the expired ssl certificate), I applaud your efforts.

I have learned a lot since the version above (a lot has been changed) and I see room for a lot of improvement. I also have a nice desktop client on the way since you shouldn't be doing crypto in the browser/javascript, feel free to add me on Skype (samgranger) or email me: sam.granger@gmail.com - I'd be willing to give you some pointers. I'll be releasing v2 soon (which will also be open source).

Re: Show HN: A decentralized social network with end-to-end encryption

#52

Post by beagle3 »

sedatk wrote: post #32
mschultheiss wrote: post #13

Earlier quoted context omitted.

It has end-to-end encrpytion - so if you are hosted on a friend's server for example, the friend can not read your messages, which might be useful :)

in that case, wouldn't it be better to focus on adding e2e to diaspora? or is there an architectural limitation with it? that seems a lot of redundant work at the moment.

Without knowing anything about the technical difficulties, I would argue that Diaspora as a brand is already dead -- associating with it is basically a guarantee of no users.

Re: Show HN: A decentralized social network with end-to-end encryption

#53

Post by lucb1e »

iheartmemcache wrote: post #49
lucb1e wrote: post #47

Earlier quoted context omitted.

> The cryptography in this system does not appear to be safe. While one of the fundamentals, I think it's fair to say that swapping out cryptosystems is 0.1% of the work, or if the communication system needs to be redesigned, 1%. There goes a huge amount of work into designing and building all the rest.

Whaaaaat. No way man. Especially if this gains critical mass before it's production-ready for whatever reason (who knows why Farmville and GroupOn hit when they did -- right place, right time) it's nothing short of irresponsible especially without a way to effectively declare the system compromised and pull the plug. Not only that but there are real social implications in having a system that even drops the word "end…

> if this gains critical mass before it's production-ready

Yeah, that would be bad. Still, I think that with the warnings in place as they are, someone is going to notice and fix it way before that happens.

> my mom would never read the README.md despite the fact that it explicitly says it's not production ready

No, but anyone deploying it would. Your mom is not going to deploy this on her servers, is she?

Re: Show HN: A decentralized social network with end-to-end encryption

#54

Post by blubb-fish »

rndmind wrote: post #15

I support the idea behind this, but I love the community on Diaspora, and more importantly it is also decentralized and open-source.

The big downside of it is though that your stuff is potentially stored on someone elses pod - okay, you can create your own server for the pod etc but this won't help you if messages from you are insecurely stored on some strangers server.

The solution would be to (somehow) introduce asymmetrical encryption for the content.

Re: Show HN: A decentralized social network with end-to-end encryption

#55

Post by tethra »

It's a nice effort, but it's covered in warnings that say "don't use this" - therefore, not yet interesting.

I'm going to leave this here: https://movim.eu/

Movim is a social networking client that is based on standards. It uses XMPP under the hood, and utilises the XMPP standards for instant messaging, multi-user chats, and microblogging (amongst others). It covers all the major features of facebook (IMO) as well as being federated, so that people can run their own nodes.

Re: Show HN: A decentralized social network with end-to-end encryption

#56

Post by rafael-rinaldi »

moron4hire wrote: post #45
tptacek wrote: post #14

Earlier quoted context omitted.

Unfortunately, the Web Crypto API doesn't automatically get you safe cryptography either. It was added by the W3C to allow video vendors to implement content DRM in pure Javascript rather than requiring plugins, and so it includes a great deal of legacy crypto. Long story short, you need an expert in cryptography to design this for you, whether or not you use WebCrypto. This isn't something you should take risks with…

2016 and using crypto as a lib is still so ludicrously difficult you still get advice to "get a crypto expert". The failure of current crypto experts to create a usable crypto story is 100% why we can't have nice things.

That's exactly what I think as well. It shouldn't be that difficult to get basic crypto to an application.

Re: Show HN: A decentralized social network with end-to-end encryption

#57

Post by iheartmemcache »

dutchbrit wrote: post #51

As someone who has been working on something similar (see old proof of concept here: https://ciety.com - sorry for the expired ssl certificate), I applaud your efforts. I have learned a lot since the version above (a lot has been changed) and I see room for a lot of improvement. I also have a nice desktop client on the way since you shouldn't be doing crypto in the browser/javascript, feel free to add me on Skype (sa…

Not sure if you missed it but letsencrypt.com has first party certificates for free on 90 day renewal terms. Encrypt everything, and then some.

It's at the OS level too, at least on Win10, as I was going through the mmc Cert module to see what was in there and lo-and-behold. I had thought it was just an agreement amongst the three browser developers. I should check my Mac to see if Apple pushed an update too.

Re: Show HN: A decentralized social network with end-to-end encryption

#58

Post by iheartmemcache »

sarciszewski wrote: post #21
jchrisa wrote: post #20

Earlier quoted context omitted.

It seems like there would be a lot of uses for something like a jQuery for the WebCrypto API. There are enough ways to get it wrong, and enough commonality among 80% use cases, I can see something like this being better than the alternative.

WebCrypto is a potluck of popular cryptography standards, chosen by committee. What you want instead is a library that carefully selects primitives with an emphasis on: 1. Security 2. Performance 3. Ease of use You want a high-level API, like I'm building for PHP 7.1, not a low-level API, like openssl, mcrypt, WebCrypto, etc.

Google's NaCL (i.e. NativeClient, not Libsodium-- awful overlap in terminology there) + Crypto_box + PPAPI seems to be really easy to implement as well as really secure, but Mozilla wants nothing to do with NaCL (again, the Google Native Client for Chrome/Chromium - not the DJB lib).

Edit: and that's what I get for skipping over half the posts in this thread. You specifically mentioned crypto_box/libsodium. No surprise there, you seem pretty well-informed from the 50% of the posts I did read in this thread ;). Zimmerman got it right amazingly right with PGP 20 years ago. The men and women at keybase.io are doing a great job trying to bridge the gap in the interim. Your route is the route I'm taking right now as I'm building out but with USB key and/or cell phone authenticators. Speaking of which, Thomas, in a few weeks if you have some spare time I'd love for you to look at what hopefully isn't a travesty of a product. (I minimized as much as I could re-using existing components with the intention of limiting the potential of bugs I could introduce, but Johnny's gonna have crypto soon if I have my way.)

Re: Show HN: A decentralized social network with end-to-end encryption

#59

Post by jaywink »

Animats wrote: post #42
beatpanda wrote: post #3

I want this to work so much. So many people have tried this, and I have signed up for, or self-hosted, every single one of these things, and even convinced my friends to join a few. None of them ever take off. How is this different?

Yes. There's Diaspora and Frendica already, with maybe a few hundred users. To launch something like this, you need to figure out some way to get a user base, a user base that people will want to connect with. Something like - Ivy League students (hey, it worked for Facebook.) - VC, angels, investors, and startup CEOs. (They might like something with more security, especially since they might be planning to take a bi…

diaspora* and Friendica have a combined 80K active users, at least: http://the-federation.info

Re: Show HN: A decentralized social network with end-to-end encryption

#60

Post by jaywink »

beagle3 wrote: post #52
sedatk wrote: post #32

Earlier quoted context omitted.

in that case, wouldn't it be better to focus on adding e2e to diaspora? or is there an architectural limitation with it? that seems a lot of redundant work at the moment.

Without knowing anything about the technical difficulties, I would argue that Diaspora as a brand is already dead -- associating with it is basically a guarantee of no users.

That is so untrue. Diaspora is doing better than ever, after the unrealistic burden of killing Facebook was gotten out of the way. Now it is "just" a well functioning network with tens of thousands of active users and an active development team.
Post reply on HN