51–60 of 69 posts
Possibilities for making it easier that are still privacy conscious include IMO: Adding friends of friends. Adding people that are in your local wifi.
As it happens, I don't have credential storage enabled on the spare device I tested it on, so this was a bit annoying.
I've dabbled with several messaging apps from Signal to Telegram and a bunch of others in between, and in fact this is the first time that an app tried to make actual use of Android credential storage. I wonder what the advantage is, and how other security-conscious apps like Signal are doing without it.
Earlier quoted context omitted.
I dont think the NSA is the 99% threat model. It is data miners who are building up dossiers on all of us to sell to the highest bidder which will raise costs for all of us in the long run. think Insurance companies raising rates on how often you visit the online whiskey store. We also released a password manager called Encryptr, but there is a larger project underway that I won;t say anything about yet as I am not i…
> I dont think the NSA is the 99% threat model. It is data miners who are building up dossiers on all of us to sell to the highest bidder which will raise costs for all of us in the long run. think Insurance companies raising rates on how often you visit the online whiskey store. If we banned life insurance companies from considering age or medical status, rates would not go down for everyone--they would go down for…
In practice?
Well, I wouldn't want to be, to pick one example out of millions, a med student, in an age when looking up medical knowledge damages your credit rating. It's not a very distant age.
Earlier quoted context omitted.
This seems buried. Is there a reason it's not mentioned or linked on the kloak page? I actually went looking for the code and couldn't find that repository.
The link to the source code is in the about screen in the app. Hardly buried. I will have it added to the site, I was unaware of this.
I figured it was likely in the app, but for an experiment like this, that appeals to many of the ideals of an open source philosophy, I'm less likely to bother installing it if I'm unaware that it's an open source project.
Obviously the appeal ultimately needs to be greater than just being open source, but that initial bump can't hurt the outcome of the experiment.
I found one other person on G+ and imported their card. I saw it said "adding to trusted contacts". I assume it means that they can read anything I post. I went to timeline and saw nothing new from the other contact. I expect that because I'm not one of their trusted contacts, I can't see what they have posted.
Then I went into contacts. I can view the new contact but not do anything I was expecting like adding to a group. The only thing I could do was delete the contact.
Next I went to write a new post. There was no options I could find to choose my audience. All posts you make will end up going to everyone in your contact list. Hopefully there is a feature in the works to create something like streams or target groups.
If I delete a contact, do they lose access to my posting key? Or do they continue to be able to access all future posts I make?
Funny note: "kloak" means "sewer" in Swedish. An apt name for most social feeds, to be honest.
I'm not an encryption guy, so I'm probably totally off base, but how does this work in terms of decryption? When you 'friend' someone, are you sharing your decryption key with that person? That seems very vulnerable to mass data collection when you start emailing it around to friends. Does each friend get a different key that you can disable if you believe they've been mismanaging your key?
I don't know how they are doing it, but one way this could be solved is with assymetric encryption. If a person wants to see your data, that person asks you for it, and you use their public key to encrypt your data, send it over, and then they can use their private key to decrypt said data. I doubt they are actually doing it this way as I imagine the overhead would be very high, but it need not be as cumbersome as sh…
It wouldn't be very high, they could easily put the burden on the client to do the encryption and like all practical public key encryption they only thing you encrypt with the public key(s) is a symmetric encryption key that the content is encrypted with.
I tested this out. I don't know anyone else to try with, so here is my contact card: https://goo.gl/photos/yhVvYGfy9Vepcp1h9 I found one other person on G+ and imported their card. I saw it said "adding to trusted contacts". I assume it means that they can read anything I post. I went to timeline and saw nothing new from the other contact. I expect that because I'm not one of their trusted contacts, I can't see what…
I tested this out. I don't know anyone else to try with, so here is my contact card: https://goo.gl/photos/yhVvYGfy9Vepcp1h9 I found one other person on G+ and imported their card. I saw it said "adding to trusted contacts". I assume it means that they can read anything I post. I went to timeline and saw nothing new from the other contact. I expect that because I'm not one of their trusted contacts, I can't see what…
The greatest problem is adding friends. It's very important that this is very easy, without friends you can't communicate with anyone. Possibilities for making it easier that are still privacy conscious include IMO: Adding friends of friends. Adding people that are in your local wifi.