Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Send secure, self destructing messages

cycret.com

Post reply on HN
Print view View original

11–20 of 37 posts

Re: Show HN: Send secure, self destructing messages

#12

Post by cypherpunks01 »

This reference installation of the site doesn't use SSL/TLS, and sends the supposedly "secret" message in the clear over the wire to your server. The decryption key is also transmitted in this manner.

As someone else mentioned, the decryption key has almost no entropy at all.

Any upstream provider (your internet cafe, ISP, FBI, etc.) or the site operator (OP) can read your "secure" message with almost no effort. This is false security.

Re: Show HN: Send secure, self destructing messages

#13

Post by llambda »

Interesting: just last night I received an email from the founders of Askolo announcing the their pivot to a service that does exactly this. I believe the name is "Vapor Text".

Edit: here's the email, for reference:

Hi Max,

Since Askolo soft launched earlier this year, our team has been thrilled with the quality of discussion that's taken place on the site. We've realized however, that we could make a greater impact working on other projects and we've made the difficult decision of moving Askolo into maintenance mode. All existing content will remain available on the site but future updates and new features will be discontinued.

We've recently shifted our focus to a new product - Vapor Text - that we're really excited about. Vapor lets you send private messages to friends that disappear once they're read. You can download it now from the Apple App Store: http://itunes.apple.com/app/vapor-text/id563087964?mt=8.

Thanks for all your support and free feel to reach out to hello@ovenlabs.com if you have any questions.

--Ovenlabs Team

Re: Show HN: Send secure, self destructing messages

#14

Post by dirktheman »

llambda wrote: post #13

Interesting: just last night I received an email from the founders of Askolo announcing the their pivot to a service that does exactly this. I believe the name is "Vapor Text". Edit: here's the email, for reference: Hi Max, Since Askolo soft launched earlier this year, our team has been thrilled with the quality of discussion that's taken place on the site. We've realized however, that we could make a greater impact…

Quite a pivot! Are they charging for it?

Re: Show HN: Send secure, self destructing messages

#16

Post by dirktheman »

cypherpunks01 wrote: post #12

This reference installation of the site doesn't use SSL/TLS, and sends the supposedly "secret" message in the clear over the wire to your server. The decryption key is also transmitted in this manner. As someone else mentioned, the decryption key has almost no entropy at all. Any upstream provider (your internet cafe, ISP, FBI, etc.) or the site operator (OP) can read your "secure" message with almost no effort. This…

SSL is something to consider for the future, as is increasing the entropy. I removed the 'military grade' as that might be stretching the claim a bit. Thanks for your feedback!

Re: Show HN: Send secure, self destructing messages

#18

Post by wetherbeei »

This has been done many times before, and all rely on a trusted 3rd party to do what they say. I spent a few years on and off toying with this idea, and came up with a solution that does not need any 3rd party middleman to transmit keys or delete messages after a period of time.

If you want a real challenge, figure out how to do that.

Re: Show HN: Send secure, self destructing messages

#19

Post by fjorder »

Sorry to play the paranoiac, but that is the demographic you're trying to appeal to!

There seems to be a key element of trust required for using this site. How do we know the code cycret.com runs is the same as what's on Github? i.e. How do we know cycret isn't actually running different code that serves as a man-in-the-middle by creating RSA encrypted channels to both the sender and receiver, but archiving plain-text of all their communications as they pass through cycret.com? Programs like GPG can be compiled from source on your own computer so that, if you understand the code, you can trust it. This doesn't appear to have that advantage!

I don't know that much about web stuff, so if there is an easy and trustable way to see what code cycret is actually running without taking your word for it, I'd be very curious to know how!

Post reply on HN