Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Privacy-Focused Alternative to Google Docs and Microsoft Word

docs.arcaneoffice.com

Post reply on HN
Print view View original

51–60 of 65 posts

Re: Show HN: Privacy-Focused Alternative to Google Docs and Microsoft Word

#51

Post by vorpalhex »

Walterion wrote: post #45
vorpalhex wrote: post #40

Earlier quoted context omitted.

Why are you storing a private key on a blockchain, where the primary purpose of a blockchain is universal visibility?

Surly they are encrypted. But I invite you to check Blockstack authentication and how it works.

With what key are you encrypting someone else's private key? And who holds this master key?

I would love it if you could link a technical deep dive into how Blockstack fundamentally works because I've gotten very few answers from both implementors and founders, and their existing documentation isn't at all helpful.

Re: Show HN: Privacy-Focused Alternative to Google Docs and Microsoft Word

#52

Post by asynchrony »

Walterion wrote: post #47
asynchrony wrote: post #43

Earlier quoted context omitted.

So the only decentralized/blockchain part is authentication?

Yes. But it gives us the power of making sure everything is encrypted and accessible from anyway, and no one beside you can access your data! As for storage, it is configurable, and you can move it anywhere. But you have 10GB free plan if you join us now.

Doesn't it centralize control of the encryption and data to your company and your authentication provider?

Re: Show HN: Privacy-Focused Alternative to Google Docs and Microsoft Word

#54

Post by jude- »

Walterion wrote: post #25
jammygit wrote: post #5

Earlier quoted context omitted.

How does blockchain promote privacy? Doesn’t it just store the data in a decentralized, permanent way?

We use Blockstack for authentication. It is made on Bitcoin blockchain to store your private key that will be used to encrypt all of your stuff. Making the master key will be done just the first time, and after that, every file gets a new password from the master one. No matter what, all the files will be encrypted, so you always have control over your data — something like ProtonMail but for Office.

Blockstack engineer here.

Just providing a bit of background. The private key is _not_ stored on the blockchain; only the hash of the public key is. And even then, there are a couple of layers of indirection between the Bitcoin transaction itself and the storage of your (app-specific) public key. Specifically, one Bitcoin transaction registers a batch of ~160 username/public-key-hash/profile-storage-URL bindings, and from there, the profile storage URL resolves to the user's list of application-specific public keys and application-specific storage URLs.

Pertaining to questions of scalability in other threads, 160 usernames/transaction, when operated at 8 250-byte transactions/block (about 3.4% of Bitcoin's capacity), works out to ~184,000 user registrations/day (about the same as Twitter). Moreover, usernames can be resolved to public keys and storage URLs while the underlying transaction is being confirmed, so users don't have to wait to start using applications. All other user state is stored off-chain in the user's chosen storage provider, managed by a Gaia hub (Gaia being Blockstack's storage system: https://github.com/blockstack/gaia).

EDIT: clarifications

Re: Show HN: Privacy-Focused Alternative to Google Docs and Microsoft Word

#55

Post by jude- »

vorpalhex wrote: post #41
craze3 wrote: post #17

I'm surprised of the amount of blockchain hate in the comments from people who haven't even checked out the product...

There are some reasons to be skeptical of Blockstack in particular. They make a lot of claims, pump cash into apps without disclosing it's actual source (they claim it's from sales of a subtoken, but aside from a blog post, I can't actually find any evidence of that) and in general have built a JS heavy library that is setup for easy code injection. None of these apps need a blockchain. None of these apps gain any be…

Blockstack engineer here.

Regarding financials, I invite you to read our SEC offering circular for details on the source of the money: https://www.sec.gov/Archives/edgar/data/1719379/000110465919...

> None of these apps need a blockchain. None of these apps gain any benefit from a blockchain.

The blockchain serves as a "shared source of truth" for everyone's name/public-key/storage-URL bindings. So as long as you trust that the blockchain doesn't get re-orged, you may assume that your Blockstack node will independently calculate the same such bindings as everyone else's node. All other application activity (rightfully) happens off-chain, via commodity Web infrastructure.

EDIT: typo

Re: Show HN: Privacy-Focused Alternative to Google Docs and Microsoft Word

#56

Post by Walterion »

vorpalhex wrote: post #51
Walterion wrote: post #45

Earlier quoted context omitted.

Surly they are encrypted. But I invite you to check Blockstack authentication and how it works.

With what key are you encrypting someone else's private key? And who holds this master key? I would love it if you could link a technical deep dive into how Blockstack fundamentally works because I've gotten very few answers from both implementors and founders, and their existing documentation isn't at all helpful.

Maybe these help but let me know if you got any question https://docs.blockstack.org/faqs/allfaqs

Re: Show HN: Privacy-Focused Alternative to Google Docs and Microsoft Word

#57

Post by Walterion »

asynchrony wrote: post #52
Walterion wrote: post #47

Earlier quoted context omitted.

Yes. But it gives us the power of making sure everything is encrypted and accessible from anyway, and no one beside you can access your data! As for storage, it is configurable, and you can move it anywhere. But you have 10GB free plan if you join us now.

Doesn't it centralize control of the encryption and data to your company and your authentication provider?

Not at all. Your identity is encrypted with the master key just like when you make a BTC wallet. You can save it and use it even if our servers go down; you can have or use another node. Also, you can choose or make another storage provider to host your docs. We are cool; we want to give people a more secure option ;)

Re: Show HN: Privacy-Focused Alternative to Google Docs and Microsoft Word

#58

Post by Walterion »

jude- wrote: post #55
vorpalhex wrote: post #41

Earlier quoted context omitted.

There are some reasons to be skeptical of Blockstack in particular. They make a lot of claims, pump cash into apps without disclosing it's actual source (they claim it's from sales of a subtoken, but aside from a blog post, I can't actually find any evidence of that) and in general have built a JS heavy library that is setup for easy code injection. None of these apps need a blockchain. None of these apps gain any be…

Blockstack engineer here. Regarding financials, I invite you to read our SEC offering circular for details on the source of the money: https://www.sec.gov/Archives/edgar/data/1719379/000110465919... > None of these apps need a blockchain. None of these apps gain any benefit from a blockchain. The blockchain serves as a "shared source of truth" for everyone's name/public-key/storage-URL bindings. So as long as you tru…

Thanks Jude for helping out ;)

Re: Show HN: Privacy-Focused Alternative to Google Docs and Microsoft Word

#59

Post by russdpale »

Walterion wrote: post #50
russdpale wrote: post #30

I click the login with blockstack button and nothing happens. TypeError: "e is undefined" a base64url.js:17 o base64url.js:14 mounted Redirect.vue:69 VueJS 11 cd49 main.ts:9 Webpack 6

Can I ask what is your browser and its version?

The latest firefox on Windows 10 LTSC

Re: Show HN: Privacy-Focused Alternative to Google Docs and Microsoft Word

#60

Post by jude- »

vorpalhex wrote: post #51
Walterion wrote: post #45

Earlier quoted context omitted.

Surly they are encrypted. But I invite you to check Blockstack authentication and how it works.

With what key are you encrypting someone else's private key? And who holds this master key? I would love it if you could link a technical deep dive into how Blockstack fundamentally works because I've gotten very few answers from both implementors and founders, and their existing documentation isn't at all helpful.

You (the user) hold the master key. It's generated for you when you sign up for a Blockstack ID. From there, the authenticator generates a per-ID, per-application key-pair via BIP32 -- each app key is a hardened child whose path is generated from the key that owns the ID on-chain and the hash of the application's DNS origin.

Authentication happens completely client-side. The Blockstack authenticator registers itself as a protocol handler for the "blockstack:" protocol, such that when you click a sign-in button, you will be redirected to your locally-running authenticator (or to a hosted version of the same, if you don't have the authenticator installed). The authenticator stores your master key, and will derive the ID- and application-specific key-pair for you when you select the ID to sign in as.

Once you sign in, the authenticator redirects you back to the application. The authenticator passes the app the Blockstack ID and application-specific private key via the URL string (encrypted with an ephemeral ECDSA key generated by the app on sign-in), and the blockstack.js library fetches and downloads the user's profile to learn the storage endpoint(s) as part of completing the sign-in. In so doing, the application learns the storage endpoint to which to GET and POST user data, and learns the key to use to sign/encrypt it and to authenticate to the user's preferred storage (access to which is mediated by a Gaia hub that the user selects when onboarding).

Agreed that a deep dive with protocol diagrams would be handy. We're working on it! :)

Post reply on HN