Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vuvuzela: private messaging system that protects metadata

vuvuzela.io

Post reply on HN
Print view View original

41–49 of 49 posts

Re: Vuvuzela: private messaging system that protects metadata

#41

Post by zby »

zmanian wrote: post #10

Vuvuzela seems great except your anonymity is guaranteed by a set of high availability and capacity servers. Those servers need to independently operated and resistant to global compromise. We don't really have a good template for a system like this. We have centralized HA systems and decentralized high churn systems like Bittorrent and Tor. I've been intrigued by the observation that forthcoming "proof of stake" blo…

There is a proposal from David Chaum called PrivaTegrity: https://eprint.iacr.org/2016/008.pdf

As to the proof of stake algorithms - the efforts to do it in a strict way all fail - I have a feeling that it might be impossible.

Re: Vuvuzela: private messaging system that protects metadata

#43

Post by unhammer »

throwaway09987 wrote: post #11
mi100hael wrote: post #7

> To hide metadata, messages are routed through multiple servers, and each server adds noise. This makes the metadata incomprehensible, even to powerful nation-state adversaries. I'm interested to learn more about these servers. Can anyone host one? How are they discovered/networked? Personally I'm still more inclined to stick with Ricochet.IM since it piggybacks Tor so there are already tons of servers out there.

I'm curious about ricochet, but not excited about a service that is integrated with Tor...I've heard a lot of things recently about Tor's insecurity. If this new thing is better about protecting users (as it seems it might be), then I'd definitely stay away from something interfacing with Tor.

That sounds like an https://en.wikipedia.org/wiki/Argument_from_ignorance . You hear a lot of things about Tor in general because Tor is popular and has existed for many years. Vuvuzuela is new, so we don't actually know whether it's secure or not.

Re: Vuvuzela: private messaging system that protects metadata

#44

Post by vbezhenar »

problems wrote: post #8
vbezhenar wrote: post #6

Earlier quoted context omitted.

Reserve few ports and connect to random IP address until you've found a node. Works only for IPv4, though.

Yikes, no... we have much better ways than that. Typically bootstrapping a list of a few thousand nodes with top uptime is a good starting point, then using peer exchange between the nodes to find more, store them and prefer them when possible. Bittorrent DHT could also be (ab)used as a discovery mechanism.

It's too easy to block those few thousand nodes and render the entire software useless. If I would start Tor on my PC, it won't connect to any nodes, because all bootstrap hosts are blocked by my provider. It's centralization with all related drawbacks.

Re: Vuvuzela: private messaging system that protects metadata

#47

Post by problems »

vbezhenar wrote: post #44
problems wrote: post #8

Earlier quoted context omitted.

Yikes, no... we have much better ways than that. Typically bootstrapping a list of a few thousand nodes with top uptime is a good starting point, then using peer exchange between the nodes to find more, store them and prefer them when possible. Bittorrent DHT could also be (ab)used as a discovery mechanism.

It's too easy to block those few thousand nodes and render the entire software useless. If I would start Tor on my PC, it won't connect to any nodes, because all bootstrap hosts are blocked by my provider. It's centralization with all related drawbacks.

Not really - those few thousand nodes are only used for the initial bootstrap, once you've connected to the network or can get a node list from a friend once, you'll have more than that. And it's very hard to act legally against thousands of nodes instead of a single entity. Or to convince ISPs to block them all. Definitely an improvement over a centralized system. Some services will try to improve this further by only sending random nodes to each person who downloads, using the hash of their IP as an rng seed.

Yes, an ISP who's willing to block a few thousand nodes will be able to take your shit down no matter what. That's why Tor uses private "bridge" servers for people in highly censored countries and tries to mask traffic as some other type. There's no way around that. But that doesn't mean decentralization is useless - it's incredibly useful in most countries and with most ISPs.

If you need to scan IPv4 space randomly to find a node, you can easily find all nodes. This takes about a day or two on a cheap VPS.

Re: Vuvuzela: private messaging system that protects metadata

#48

Post by lazard »

aftbit wrote: post #39

There's very little on the Github page - 18 commits, with the last "real" commit (not just an organizational change) being in September. This might be a thing some day, but right now it's just another clever idea.

Author here.

I've been working on a follow-up system called Alpenhorn that addresses the bootstrapping problem in Vuvuzela: https://vuvuzela.io/alpenhorn-extended.pdf

I will release Alpenhorn and a new version of Vuvuzela in January.

Re: Vuvuzela: private messaging system that protects metadata

#49

Post by lazard »

0xmohit wrote: post #40
aftbit wrote: post #39

There's very little on the Github page - 18 commits, with the last "real" commit (not just an organizational change) being in September. This might be a thing some day, but right now it's just another clever idea.

There may be even lesser activity now, given that the author has moved to Google.

Only temporarily. I'm interning on the Go team, but still working on Vuvuzela and Alpenhorn in my spare time.
Post reply on HN