Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Spideroak Kloak: Zero-Knowlege Social Networking

spideroak.com

Post reply on HN
Print view View original

31–40 of 69 posts

Re: Spideroak Kloak: Zero-Knowlege Social Networking

#31

Post by johann28 »

darkmighty wrote: post #29
daviddahl wrote: post #21

Earlier quoted context omitted.

yes! that is a much better set of options. I will file an issue.

How are you doing fuzzy locations? You're probably not doing it this way, but note that just adding a random 4 mile radius vector to the users location in insecure (against multiple samplings), you need to quantize it to a fixed set like a 4 mile grid or something like that. I remember tinder made this mistake and you could locate users very precisely anonymously.

Grids are problematic because one can observe you at the boundaries, moving from one cell to another, so there are moments when you are very accurately localizable.

Re: Spideroak Kloak: Zero-Knowlege Social Networking

#32

Post by level »

I'm not an encryption guy, so I'm probably totally off base, but how does this work in terms of decryption?

When you 'friend' someone, are you sharing your decryption key with that person? That seems very vulnerable to mass data collection when you start emailing it around to friends. Does each friend get a different key that you can disable if you believe they've been mismanaging your key?

Re: Spideroak Kloak: Zero-Knowlege Social Networking

#33

Post by darkmighty »

johann28 wrote: post #31
darkmighty wrote: post #29

Earlier quoted context omitted.

How are you doing fuzzy locations? You're probably not doing it this way, but note that just adding a random 4 mile radius vector to the users location in insecure (against multiple samplings), you need to quantize it to a fixed set like a 4 mile grid or something like that. I remember tinder made this mistake and you could locate users very precisely anonymously.

Grids are problematic because one can observe you at the boundaries, moving from one cell to another, so there are moments when you are very accurately localizable.

Ah yes good point (you'd be briefly localizable to a line), you'd need to add some hysteresis and delay for dynamical targets.

So something like

shown_pos(t) = mode(quantize(pos(t-j)),...,quantize(pos(t-j-k)))

For some delay j and hysteresis k.

Re: Spideroak Kloak: Zero-Knowlege Social Networking

#36

Post by rifung »

level wrote: post #32

I'm not an encryption guy, so I'm probably totally off base, but how does this work in terms of decryption? When you 'friend' someone, are you sharing your decryption key with that person? That seems very vulnerable to mass data collection when you start emailing it around to friends. Does each friend get a different key that you can disable if you believe they've been mismanaging your key?

I don't know how they are doing it, but one way this could be solved is with assymetric encryption.

If a person wants to see your data, that person asks you for it, and you use their public key to encrypt your data, send it over, and then they can use their private key to decrypt said data.

I doubt they are actually doing it this way as I imagine the overhead would be very high, but it need not be as cumbersome as sharing a specific secret key for each person.

Re: Spideroak Kloak: Zero-Knowlege Social Networking

#39

Post by falien »

daviddahl wrote: post #13
darkstar999 wrote: post #5

Earlier quoted context omitted.

> Are they encrypted for each friend with that friend's public key? That sounds about right. However this is a closed-source project, so I don't see why it would be picked up by privacy enthusiasts.

No, it is fully open source from day one: https://github.com/Crypton/statusapp

This seems buried. Is there a reason it's not mentioned or linked on the kloak page? I actually went looking for the code and couldn't find that repository.

Re: Spideroak Kloak: Zero-Knowlege Social Networking

#40

Post by enoch_r »

daviddahl wrote: post #20
hackuser wrote: post #18

Earlier quoted context omitted.

I can't tell you how excited I am to see it. It seems to me that there is no good reason end users shouldn't control their social networking info, to use (e.g., via third party apps, to backup, to migrate) and share as they see fit. > threat model is advertisers and data-miners So many threat models I see are hackers and malware. Those are important, but much more widespread are the threats you identify. > It is part…

I dont think the NSA is the 99% threat model. It is data miners who are building up dossiers on all of us to sell to the highest bidder which will raise costs for all of us in the long run. think Insurance companies raising rates on how often you visit the online whiskey store. We also released a password manager called Encryptr, but there is a larger project underway that I won;t say anything about yet as I am not i…

> I dont think the NSA is the 99% threat model. It is data miners who are building up dossiers on all of us to sell to the highest bidder which will raise costs for all of us in the long run. think Insurance companies raising rates on how often you visit the online whiskey store.

If we banned life insurance companies from considering age or medical status, rates would not go down for everyone--they would go down for the elderly and the very sick, and up for everyone else. In exactly the same way, insurance company "dossiers" would not "raise costs for all of us"--they would raise costs for the risky and decrease costs for the less risky.

Post reply on HN