Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ntfy.sh – Send push notifications to your phone via PUT/POST

ntfy.sh

Post reply on HN
Print view View original

81–90 of 306 posts

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#81

Post by krn »

horsawlarway wrote: post #68
krn wrote: post #58

Earlier quoted context omitted.

Why couldn't the entire system be E2E encrypted by default, though? In 2022, that's my standard expectation from any service. Even such things as Pocket / Instapaper / Raindrop should come with E2E encryption by default. It's better for the service provider, too: no issues with GDPR, or in case of a database hack.

Genuine question - have you ever implemented an E2E encrypted system? Because it's not particularly easy to do, and there are a lot of caveats and drawbacks. Let me rephrase your assumption: "Why couldn't you just mail me the letter in a 100lb safe. In 2022, that's my standard expectation from any service". So - are you willing to pay to ship 100lbs for every letter you send? Are you meticulously managing the details…

> Are you working out the details on recovery and storage, handling lost devices, configuring a communication channel for sharing certs/keys, managing several crypto dependencies and libraries - all so that you can go "Hey - what's up!" in a notification to your phone?

In 2022, there is no need to invent anything new about E2E encryption. There are many successful open-source examples, including Keybase and Firefox Sync.

There is no question that it adds development overhead, but I personally wouldn't even run a public service for others without E2E encryption.

> Or should you just stop whining - accept that this is free - and take the authors advice and host it yourself?

I am not attacking the author, nor do I currently care about this particular service he is providing.

This is Hacker News, a discussion platform, and I am raising a question about software development in general.

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#84

Post by krn »

hawski wrote: post #72
krn wrote: post #64

Earlier quoted context omitted.

E2E encryption happens on the client side, not on the server side. Therefore, no need to trust anybody, as long as the software is open-source.

If you run binaries compiled by the author of the software it wouldn't matter that it is open source, so play store is out of the question. So then it must be open source and you must use distributor you trust: your distro maintainers and F-Droid. Also you must trust that people did really take a look at the code.

That's exactly how Signal and Keybase work, and nobody has any problems with that.

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#85

Post by kube-system »

krn wrote: post #64
ilogik wrote: post #61

Earlier quoted context omitted.

If you don't trust the person that wrote the software, it doesn't matter if it's E2E encrypted or not. There could be a back-door

E2E encryption happens on the client side, not on the server side. Therefore, no need to trust anybody, as long as the software is open-source.

> Therefore, no need to trust anybody, as long as the software is open-source.

Demonstrably untrue. You must trust that the contributors are trustworthy, they have implemented a strong security posture for their project, and that the code is reviewed by people who are trustworthy. Many open-source projects have been, and continue to be, compromised on a regular basis.

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#86

Post by oliwarner »

krn wrote: post #58
krono wrote: post #44

From the FAQ[1]: > Will you know what topics exist, can you spy on me? > If you don't trust me or your messages are sensitive, run your own server. This is the way. No pinky promises in whitepaper format[2] that leave out the most important bits, no meticulously constructed but entirely meaningless marketing statements[3][4], but unassuming and deferential logic with a mitigation path. 1: https://ntfy.sh/docs/faq/#wi…

Why couldn't the entire system be E2E encrypted by default, though? In 2022, that's my standard expectation from any service. Even such things as Pocket / Instapaper / Raindrop should come with E2E encryption by default. It's better for the service provider, too: no issues with GDPR, or in case of a database hack.

Go figure out key exchange and use this as transport for encrypted messages.

Encrypting stuff isn't hard.

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#87

Post by EGreg »

krono wrote: post #44

From the FAQ[1]: > Will you know what topics exist, can you spy on me? > If you don't trust me or your messages are sensitive, run your own server. This is the way. No pinky promises in whitepaper format[2] that leave out the most important bits, no meticulously constructed but entirely meaningless marketing statements[3][4], but unassuming and deferential logic with a mitigation path. 1: https://ntfy.sh/docs/faq/#wi…

Why not end to end encrypt notifications with a public key?

Both iOS and Android can run a completionHandler to decrypt them using a private key that can be stolen if the app is disassembled.

But you can generate a private key per user, after install, and each mailbox publisjes a public key.

The thing I find ironic is that the actual encryption is done in JS, which is served by a webserver so anyway you have to trust the webserver. Same as you trust WhatsApp to not send your text to Facebook.

Is there a way around this having to trust an app? Seems the only way to do that would be to have a browser extension or several, that you trust not to collude with a website.

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#88

Post by seqastian »

krn wrote: post #81
horsawlarway wrote: post #68

Earlier quoted context omitted.

Genuine question - have you ever implemented an E2E encrypted system? Because it's not particularly easy to do, and there are a lot of caveats and drawbacks. Let me rephrase your assumption: "Why couldn't you just mail me the letter in a 100lb safe. In 2022, that's my standard expectation from any service". So - are you willing to pay to ship 100lbs for every letter you send? Are you meticulously managing the details…

> Are you working out the details on recovery and storage, handling lost devices, configuring a communication channel for sharing certs/keys, managing several crypto dependencies and libraries - all so that you can go "Hey - what's up!" in a notification to your phone? In 2022, there is no need to invent anything new about E2E encryption. There are many successful open-source examples, including Keybase and Firefox S…

> I personally wouldn't even run a public service for others without E2E encryption.

So don't? seems like everyone got what they wanted.

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#89

Post by kirimita »

atentaten wrote: post #80

Could this potentially replace Firebase Cloud Messaging for push notifications?

It is an UnifiedPush distributor, so it can replace FCM for applications supporting it. Here are most of the applications supporting UnifiedPush right now: https://unifiedpush.org/users/apps/

Re: Ntfy.sh – Send push notifications to your phone via PUT/POST

#90

Post by [deleted] »

binwiederhier wrote: post #65
krn wrote: post #58

Earlier quoted context omitted.

Why couldn't the entire system be E2E encrypted by default, though? In 2022, that's my standard expectation from any service. Even such things as Pocket / Instapaper / Raindrop should come with E2E encryption by default. It's better for the service provider, too: no issues with GDPR, or in case of a database hack.

Encryption and convenience usually don't go well together. ntfy was mainly built for simplicity. That said, I have designed and started working on E2E here: https://github.com/binwiederhier/ntfy/issues/69

[deleted]
Post reply on HN