Spideroak Kloak: Zero-Knowlege Social Networking • Hacker News Board

Re: Spideroak Kloak: Zero-Knowlege Social Networking

#21

Post by daviddahl » Sat, Dec 12, 2015, 12:20 AM UTC

hackuser wrote: post #19

daviddahl wrote: post #15

Earlier quoted context omitted.

Making the location fuzzy was a notion I had - it's still not great. One problem here is doing location name without calling any external APIs. We store all place names in the app. Not ideal.

How about four options: ( ) Accurate location ( ) Fuzzy location (within 4 miles) ( ) Super-fuzzy location (state/country and time zone) ( ) No location

yes! that is a much better set of options. I will file an issue.

Re: Spideroak Kloak: Zero-Knowlege Social Networking

#22

Post by Taek » Sat, Dec 12, 2015, 12:31 AM UTC

daviddahl wrote: post #14

Kloak's threat model is advertisers and data-miners. It is an experiment in private social networking. It is part of a set of new applications we are building at SpiderOak. Kloak is more or less a lab experiment in the UX of private systems.

How does Kloak handle metadata? If people can see who you communicate with, they can get access to your social network, which contains a lot of information.

By seeing my location dozens of times, a company can figure out where I live. They might not know what bar I went to last night but they will be able to know that I visit Chipotele frequently.

It's better than nothing, but it seems like strong analytics could still access most of the important information.

Re: Spideroak Kloak: Zero-Knowlege Social Networking

#23

Post by daviddahl » Sat, Dec 12, 2015, 12:33 AM UTC

Taek wrote: post #22

daviddahl wrote: post #14

Kloak's threat model is advertisers and data-miners. It is an experiment in private social networking. It is part of a set of new applications we are building at SpiderOak. Kloak is more or less a lab experiment in the UX of private systems.

How does Kloak handle metadata? If people can see who you communicate with, they can get access to your social network, which contains a lot of information. By seeing my location dozens of times, a company can figure out where I live. They might not know what bar I went to last night but they will be able to know that I visit Chipotele frequently. It's better than nothing, but it seems like strong analytics could sti…

You must approve all contacts who get a copy of your feed. There is no way to just follow others. It is a white-listed system. Analytics can only be performed by those you trust

Re: Spideroak Kloak: Zero-Knowlege Social Networking

#24

Post by x1798DE » Sat, Dec 12, 2015, 12:53 AM UTC

daviddahl wrote: post #14

Kloak's threat model is advertisers and data-miners. It is an experiment in private social networking. It is part of a set of new applications we are building at SpiderOak. Kloak is more or less a lab experiment in the UX of private systems.

This is a centralized service, not distributed or decentralized?

Have you given any thought to making it compatible with federated social networks like Diaspora?

Re: Spideroak Kloak: Zero-Knowlege Social Networking

#25

Post by jcwilde » Sat, Dec 12, 2015, 12:53 AM UTC

andyburke wrote: post #2

Is this just a loss-leader for their backup/storage service? I am a big fan of not being the product, but how does this make money?

I would really love an answer to these questions.

Re: Spideroak Kloak: Zero-Knowlege Social Networking

#26

Post by daviddahl » Sat, Dec 12, 2015, 1:04 AM UTC

x1798DE wrote: post #24

daviddahl wrote: post #14

Kloak's threat model is advertisers and data-miners. It is an experiment in private social networking. It is part of a set of new applications we are building at SpiderOak. Kloak is more or less a lab experiment in the UX of private systems.

This is a centralized service, not distributed or decentralized? Have you given any thought to making it compatible with federated social networks like Diaspora?

Would love to, which will require a bit of engineering on Crypton's server

Re: Spideroak Kloak: Zero-Knowlege Social Networking

#27

Post by daviddahl » Sat, Dec 12, 2015, 1:07 AM UTC

jcwilde wrote: post #25

andyburke wrote: post #2

Is this just a loss-leader for their backup/storage service? I am a big fan of not being the product, but how does this make money?

I would really love an answer to these questions.

Earlier in the thread I mentioned that Kloak came about as a UX experiment in private social networking. We are building on these concepts in another project that is underway now.

Re: Spideroak Kloak: Zero-Knowlege Social Networking

#28

Post by shuzchen » Sat, Dec 12, 2015, 1:10 AM UTC

andyburke wrote: post #2

Is this just a loss-leader for their backup/storage service? I am a big fan of not being the product, but how does this make money?

(disclaimer: i used to work at spideroak, but not on the crypton project) I would chalk this up to R&D. I don't think they'll make any money off of Kloak but they do want to bring crypton (the framework on which Kloak is built: https://crypton.io/) into maturity. Another project of note associated with crypton would be the password manager Encryptr (https://spideroak.com/solutions/encryptr). I'm not sure they want to replace their backup/storage service with crypton (although their backup service could use more collaborative features, so R&D into crypton could improve that), but they probably are looking into building other privacy focused products on top of which a better/mature/battle-tested crypton would be necessary.

Re: Spideroak Kloak: Zero-Knowlege Social Networking

#29

Post by darkmighty » Sat, Dec 12, 2015, 1:42 AM UTC

daviddahl wrote: post #21

hackuser wrote: post #19

Earlier quoted context omitted.

How about four options: ( ) Accurate location ( ) Fuzzy location (within 4 miles) ( ) Super-fuzzy location (state/country and time zone) ( ) No location

yes! that is a much better set of options. I will file an issue.

How are you doing fuzzy locations? You're probably not doing it this way, but note that just adding a random 4 mile radius vector to the users location in insecure (against multiple samplings), you need to quantize it to a fixed set like a 4 mile grid or something like that. I remember tinder made this mistake and you could locate users very precisely anonymously.

Re: Spideroak Kloak: Zero-Knowlege Social Networking

#30

Post by adrtessier » Sat, Dec 12, 2015, 1:56 AM UTC

Taek wrote: post #22

daviddahl wrote: post #14

Kloak's threat model is advertisers and data-miners. It is an experiment in private social networking. It is part of a set of new applications we are building at SpiderOak. Kloak is more or less a lab experiment in the UX of private systems.

How does Kloak handle metadata? If people can see who you communicate with, they can get access to your social network, which contains a lot of information. By seeing my location dozens of times, a company can figure out where I live. They might not know what bar I went to last night but they will be able to know that I visit Chipotele frequently. It's better than nothing, but it seems like strong analytics could sti…

I was about to ask a lot of these questions of how deep the metadata layer really goes - including using SpiderOak as the threat. It seems this is built on Crypton, linked below; however, the paper itself [1] goes into a lot of detail on what metadata SpiderOak could see, and what they can infer from it.

I am personally curious why p384/ECDSA was chosen; vs. p521 or Curve25519+Ed25519. I assume this is because p384 is standardized and recommended in NSA Suite B.

[1] https://crypton.io/crypton.pdf