Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vuvuzela: private messaging system that protects metadata

vuvuzela.io

Post reply on HN
Print view View original

21–30 of 49 posts

Re: Vuvuzela: private messaging system that protects metadata

#21

Post by ticoombs »

throwaway09987 wrote: post #11
mi100hael wrote: post #7

> To hide metadata, messages are routed through multiple servers, and each server adds noise. This makes the metadata incomprehensible, even to powerful nation-state adversaries. I'm interested to learn more about these servers. Can anyone host one? How are they discovered/networked? Personally I'm still more inclined to stick with Ricochet.IM since it piggybacks Tor so there are already tons of servers out there.

I'm curious about ricochet, but not excited about a service that is integrated with Tor...I've heard a lot of things recently about Tor's insecurity. If this new thing is better about protecting users (as it seems it might be), then I'd definitely stay away from something interfacing with Tor.

You are ill informed. Tor is as safe as it ever was. Just be smart even using it. Please visit /r/tor and learn about it yourself. Instead of spreading disconsent through your vague wording and accepting media outlets at face value

Re: Vuvuzela: private messaging system that protects metadata

#22

Post by libeclipse »

arkadiyt wrote: post #19

FWIW here is the only data that Signal had available to turn over when requested by the government: https://twitter.com/whispersystems/status/783325788883955713

I wonder, why even store those two pieces of information? I mean, they're not exactly essential.

Re: Vuvuzela: private messaging system that protects metadata

#23

Post by mi100hael »

throwaway09987 wrote: post #11
mi100hael wrote: post #7

> To hide metadata, messages are routed through multiple servers, and each server adds noise. This makes the metadata incomprehensible, even to powerful nation-state adversaries. I'm interested to learn more about these servers. Can anyone host one? How are they discovered/networked? Personally I'm still more inclined to stick with Ricochet.IM since it piggybacks Tor so there are already tons of servers out there.

I'm curious about ricochet, but not excited about a service that is integrated with Tor...I've heard a lot of things recently about Tor's insecurity. If this new thing is better about protecting users (as it seems it might be), then I'd definitely stay away from something interfacing with Tor.

A lot of the high profile stories about people being busted over Tor recently have been related to vulnerabilities in FireFox/Tor Browser Bundle and the FBI running honeypots that can exploit those vulnerabilities.

Ricochet works by essentially starting up a Tor Hidden Service and then listening for messages from other users, so there's no exposure to browser-based attacks. It's end-to-end encrypted and less susceptible to traffic analysis attacks because it never hits an exit node.

Re: Vuvuzela: private messaging system that protects metadata

#24

Post by rectang »

zmanian wrote: post #10

Vuvuzela seems great except your anonymity is guaranteed by a set of high availability and capacity servers. Those servers need to independently operated and resistant to global compromise. We don't really have a good template for a system like this. We have centralized HA systems and decentralized high churn systems like Bittorrent and Tor. I've been intrigued by the observation that forthcoming "proof of stake" blo…

> We don't really have a good template for a system like this.

Sounds like the distributed trust system Apache Milagro (incubating). http://milagro.incubator.apache.org/

Re: Vuvuzela: private messaging system that protects metadata

#25

Post by sangel »

ycmbntrthrwaway wrote: post #13
Kenji wrote: post #3

I love this! The only thing it would require in addition is if it was serverless and p2p, like torrent.

It is impossible to build anonymity system without some sort of centralization due to possibility of Sybil attack. You need some trusted entity beforehand, otherwise your ISP can just simulate the whole network for you and never let you connect to the real network without you even noticing this.

I'm not sure that I agree with your point. DC networks (see David Chaum's work and also Dissent by Corrigan-Gibbs and Ford) have no centralized components and provide stronger anonymity than Vuvuzela. However, they are not very efficient for large user bases. This is different from being "impossible" though.

The attack that you are describing seems to be a denial of service rather than a privacy violation. Centralized systems have similar issues though (your ISP could simply block packets to such system, one of the malicious centralized servers could refuse to process messages, etc.).

Re: Vuvuzela: private messaging system that protects metadata

#26

Post by sctb »

nilved wrote: post #5

> Vuvuzela is being developed at MIT CSAIL. Thanks, this almost makes up for killing Aaron Swartz!

This is not an acceptable comment on Hacker News. Please post civilly and substantively or not at all.

https://news.ycombinator.com/newsguidelines.html

Re: Vuvuzela: private messaging system that protects metadata

#28

Post by recordkeepin33 »

libeclipse wrote: post #22
arkadiyt wrote: post #19

FWIW here is the only data that Signal had available to turn over when requested by the government: https://twitter.com/whispersystems/status/783325788883955713

I wonder, why even store those two pieces of information? I mean, they're not exactly essential.

Pure speculation, but backend tidying?

if ( days between acct creation and last check-in > N Days ): archive record; rm prod record;

There may be less identifiable means for these boring operations though. Just the first thing that popped into my head.

Re: Vuvuzela: private messaging system that protects metadata

#30

Post by wheelerwj »

mi100hael wrote: post #23
throwaway09987 wrote: post #11

Earlier quoted context omitted.

I'm curious about ricochet, but not excited about a service that is integrated with Tor...I've heard a lot of things recently about Tor's insecurity. If this new thing is better about protecting users (as it seems it might be), then I'd definitely stay away from something interfacing with Tor.

A lot of the high profile stories about people being busted over Tor recently have been related to vulnerabilities in FireFox/Tor Browser Bundle and the FBI running honeypots that can exploit those vulnerabilities. Ricochet works by essentially starting up a Tor Hidden Service and then listening for messages from other users, so there's no exposure to browser-based attacks. It's end-to-end encrypted and less suscepti…

honeypot has to be the most generous name for "federal government controlled and operated pedophilia distribution network" ever.
Post reply on HN