Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

'Hush,' anonymous messaging app from developers in Myanmar

globalpost.com

Post reply on HN
Print view View original

21–30 of 51 posts

Re: 'Hush,' anonymous messaging app from developers in Myanmar

#21

Post by yemyat91 »

tyho wrote: post #17
swanhtet1992 wrote: post #12

Earlier quoted context omitted.

Hi, great point. Currently, users have to use their phone numbers to login. However, user's phone number is encrypted in the db. To ensure that everyone's comfortable with it, we're adding a new feature which doesn't require the user to login.

This worries me. What exactly do you mean by encrypted in the DB? If you actually mean hashed using a one-way function, it would be very easy to hash every possible phone number (there are not that many) to build a lookup table to deanonymise your users instantly. Even if you individually salt each hash it would not take very long at all to find the phone number for each entry. If you do mean encrypted, then authorit…

Yes, it is possible to match a phone number to a hash. (We are also looking at ways to make it more secure. If you have any suggestion, please let us know.) However, hushes are not connected with the phone number, we created unique token for our user when the hush is created. We needed phone numbers for our upcoming features. The newer version which won't need phone number to login is on its way.

Re: 'Hush,' anonymous messaging app from developers in Myanmar

#25

Post by derpleplex »

tyho wrote: post #17
swanhtet1992 wrote: post #12

Earlier quoted context omitted.

Hi, great point. Currently, users have to use their phone numbers to login. However, user's phone number is encrypted in the db. To ensure that everyone's comfortable with it, we're adding a new feature which doesn't require the user to login.

This worries me. What exactly do you mean by encrypted in the DB? If you actually mean hashed using a one-way function, it would be very easy to hash every possible phone number (there are not that many) to build a lookup table to deanonymise your users instantly. Even if you individually salt each hash it would not take very long at all to find the phone number for each entry. If you do mean encrypted, then authorit…

Perfect security does not currently exist. A trusted source must store the information somewhere, to authorize and validate users without spreading that information elsewhere.

You can't get around this problem unless you invent magic psychic computers. What is the point in finding every possible flaw with security here? There is a gradient of complexity, the time it takes to break these things. Currently, everything that exists is susceptible to being broken, misused, or modified.

If you assume that your attackers know everything, and have the ability to immediately find and apply that knowledge, then yes, it can seem scary. But I tend to think that the more capacity a person has to do, it's really just a bigger intellectual burden.

Re: 'Hush,' anonymous messaging app from developers in Myanmar

#26

Post by DominikD »

knd775 wrote: post #4
dheera wrote: post #2

Great idea, but I don't get why they are based in Myanmar. This is almost asking for trouble from authorities. For something whose direct purpose and sales pitch is to do something that an authoritarian government is against, I would have based the entire company outside the country.

Exactly what I was wondering. What is registering the company in Singapore going to do when the police/military/whoever come to your door?

It's a start if you don't have funds to physical move to a different country. Besides it's 2015, Saffron Revolution pretty much ended around 2008, with new constitution and all. It's not Burma you know from 2008 Rambo. ;)

Re: 'Hush,' anonymous messaging app from developers in Myanmar

#27

Post by 13 »

zmanian wrote: post #15
swanhtet1992 wrote: post #12

Earlier quoted context omitted.

Hi, great point. Currently, users have to use their phone numbers to login. However, user's phone number is encrypted in the db. To ensure that everyone's comfortable with it, we're adding a new feature which doesn't require the user to login.

The minimum I would consider responsible is 1. Use a hashcash style proof of work mechanism to register account. The server send a challenge and have the client compute a nonce under the difficulty. This could be turned to take an average of seconds to minutes on your median users device. This isn't a long term solution because eventually an attacker will realize that they can use more powerful machines to create syb…

Hashcash is broken for any situation like this. The amount of hashcash time needed to thwart spam is higher than any user is willing to wait for, doing proof of work on a phone. Plus, spammers normally have their own Cloud Computing to resort to, and it's cheaper than Amazon AWS.

https://en.wikipedia.org/wiki/Botnet

Re: 'Hush,' anonymous messaging app from developers in Myanmar

#28

Post by aw3c2 »

ngamau wrote: post #20
aw3c2 wrote: post #18

Please update the title to "This new messaging app from developers in Myanmar is kind of revolutionary", the submitted site uses that now. The original was very misleading.

You can update a title? I didn't realize that was possible.

Sorry, I forgot "dear mods" :)

Re: 'Hush,' anonymous messaging app from developers in Myanmar

#29

Post by ape4 »

yemyat91 wrote: post #24
ape4 wrote: post #22

I got autostart video and audio ads that you can't pause :( And they repeat.

Hey, I think you downloaded the wrong app. The article somehow is linked to a wrong website. Our website is http://letshush.com

It was on the globalpost.com site - ie the article.

Re: 'Hush,' anonymous messaging app from developers in Myanmar

#30

Post by towelguy »

yemyat91 wrote: post #21
tyho wrote: post #17

Earlier quoted context omitted.

This worries me. What exactly do you mean by encrypted in the DB? If you actually mean hashed using a one-way function, it would be very easy to hash every possible phone number (there are not that many) to build a lookup table to deanonymise your users instantly. Even if you individually salt each hash it would not take very long at all to find the phone number for each entry. If you do mean encrypted, then authorit…

Yes, it is possible to match a phone number to a hash. (We are also looking at ways to make it more secure. If you have any suggestion, please let us know.) However, hushes are not connected with the phone number, we created unique token for our user when the hush is created. We needed phone numbers for our upcoming features. The newer version which won't need phone number to login is on its way.

> We needed phone numbers for our upcoming features.

> The newer version which won't need phone number to login is on its way.

So which is it? new features need the phone number but the new version won't require it? Are you gonna ask users for permission to use their phone number to access the new features? Will users who prefer their anonymity be able to interact with users who surrender their identification?

Isn't the unique token good enough?

Post reply on HN