Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

'Hush,' anonymous messaging app from developers in Myanmar

globalpost.com

Post reply on HN
Print view View original

41–50 of 51 posts

Re: 'Hush,' anonymous messaging app from developers in Myanmar

#41

Post by zupreme »

I clicked through to this thinking, for some reason, that this was a new messaging app released by Anonymous (the activist group), and got confused for a second when I saw the picture of the girl, unmasked and not anonymous in the slightest.

Now that I've re-read the article in proper context, it's raises some interesting ideas.

What is currently the closest to an "anonymous" messaging app, and is it even feasible? In theory, in order to have a basis for a conversation there must be some relationship established, either based on a shared membership in a group, familiarity in the online or offline world, etc.

A truly "anonymous" messaging app would have to be more of a chatroom or random "matchmaking" service based on some type of logic, but I don't know if that would actually get traction.

Alternatively an app that is pseudonymous (wherein identities are anonymous to the provider of the platform, but wherein members can either share or hide their identities from each other at will) seems to already have been accomplished many times over, dating all the way back to Myspace.

Thoughts?

Re: 'Hush,' anonymous messaging app from developers in Myanmar

#42

Post by task_queue »

derpleplex wrote: post #25
tyho wrote: post #17

Earlier quoted context omitted.

This worries me. What exactly do you mean by encrypted in the DB? If you actually mean hashed using a one-way function, it would be very easy to hash every possible phone number (there are not that many) to build a lookup table to deanonymise your users instantly. Even if you individually salt each hash it would not take very long at all to find the phone number for each entry. If you do mean encrypted, then authorit…

Perfect security does not currently exist. A trusted source must store the information somewhere, to authorize and validate users without spreading that information elsewhere. You can't get around this problem unless you invent magic psychic computers. What is the point in finding every possible flaw with security here? There is a gradient of complexity, the time it takes to break these things. Currently, everything…

I want to see you design a system so complex it cannot be understood.

Some people think cryptography is this utterly complex thing sitting on the edge of understanding. It isn't.

Evidence of rolling your own crypto, authentication or key-exchange mechanism is the first thing an attacker you'd want to worry about will look for.

Developers design systems that are easy to break because of ignorance and hubris. That's not to say you can't learn how to implement a secure system, just that if you did any research, you'd know that Rolling Your Own Is Bad because proper design is Hard and people, with much more experience than you, are aware of choke points in your design that you aren't aware of.

Re: 'Hush,' anonymous messaging app from developers in Myanmar

#43

Post by lotsofmangos »

derpleplex wrote: post #25
tyho wrote: post #17

Earlier quoted context omitted.

This worries me. What exactly do you mean by encrypted in the DB? If you actually mean hashed using a one-way function, it would be very easy to hash every possible phone number (there are not that many) to build a lookup table to deanonymise your users instantly. Even if you individually salt each hash it would not take very long at all to find the phone number for each entry. If you do mean encrypted, then authorit…

Perfect security does not currently exist. A trusted source must store the information somewhere, to authorize and validate users without spreading that information elsewhere. You can't get around this problem unless you invent magic psychic computers. What is the point in finding every possible flaw with security here? There is a gradient of complexity, the time it takes to break these things. Currently, everything…

perfect security may not exist, but a lot better ideas than storing encrypted phone numbers in a central database have been thought of and are widely explained in the literature on the subject

Re: 'Hush,' anonymous messaging app from developers in Myanmar

#44

Post by ma2rten »

swanhtet1992 wrote: post #5
dheera wrote: post #2

Great idea, but I don't get why they are based in Myanmar. This is almost asking for trouble from authorities. For something whose direct purpose and sales pitch is to do something that an authoritarian government is against, I would have based the entire company outside the country.

Hello everyone, first of all thank you so much. Yes, it is because all of us are Burmese.

Did you guys study abroad or how did you learn the technical skills to build app like this?

Re: 'Hush,' anonymous messaging app from developers in Myanmar

#45

Post by minthd »

swanhtet1992 wrote: post #12
zmanian wrote: post #7

It would be awesome to see more technical discussion of the anonymity mechanism. How do you ensure that users accounts are not linked Personally Identifying Information? We've seen that when folks implement weak anonymity technologies, disaster quickly ensues.

Hi, great point. Currently, users have to use their phone numbers to login. However, user's phone number is encrypted in the db. To ensure that everyone's comfortable with it, we're adding a new feature which doesn't require the user to login.

Have a look at this service:

http://www.networkworld.com/article/2876796/microsoft-subnet...

I think it solves your problem.

It's also outside of myanemar ,so it's helpful with regards to legal issues.

Re: 'Hush,' anonymous messaging app from developers in Myanmar

#46

Post by [deleted] »

task_queue wrote: post #42
derpleplex wrote: post #25

Earlier quoted context omitted.

Perfect security does not currently exist. A trusted source must store the information somewhere, to authorize and validate users without spreading that information elsewhere. You can't get around this problem unless you invent magic psychic computers. What is the point in finding every possible flaw with security here? There is a gradient of complexity, the time it takes to break these things. Currently, everything…

I want to see you design a system so complex it cannot be understood. Some people think cryptography is this utterly complex thing sitting on the edge of understanding. It isn't. Evidence of rolling your own crypto, authentication or key-exchange mechanism is the first thing an attacker you'd want to worry about will look for. Developers design systems that are easy to break because of ignorance and hubris. That's no…

[deleted]

Re: 'Hush,' anonymous messaging app from developers in Myanmar

#47

Post by derpleplex »

task_queue wrote: post #42
derpleplex wrote: post #25

Earlier quoted context omitted.

Perfect security does not currently exist. A trusted source must store the information somewhere, to authorize and validate users without spreading that information elsewhere. You can't get around this problem unless you invent magic psychic computers. What is the point in finding every possible flaw with security here? There is a gradient of complexity, the time it takes to break these things. Currently, everything…

I want to see you design a system so complex it cannot be understood. Some people think cryptography is this utterly complex thing sitting on the edge of understanding. It isn't. Evidence of rolling your own crypto, authentication or key-exchange mechanism is the first thing an attacker you'd want to worry about will look for. Developers design systems that are easy to break because of ignorance and hubris. That's no…

Complexity = time to brute force a crypto algo. I am using the word in the formal, traditional sense, where a brute force solution (and heuristics of intelligent solving) literally is measured in terms of computational complexity metrics (big o) or probability.

Re: 'Hush,' anonymous messaging app from developers in Myanmar

#48

Post by lazylizard »

zmanian wrote: post #7

It would be awesome to see more technical discussion of the anonymity mechanism. How do you ensure that users accounts are not linked Personally Identifying Information? We've seen that when folks implement weak anonymity technologies, disaster quickly ensues.

i think the anonymous part was added by the article. the app's website doesn't make any such claim?

Re: 'Hush,' anonymous messaging app from developers in Myanmar

#49

Post by swanhtet1992 »

ma2rten wrote: post #44
swanhtet1992 wrote: post #5

Earlier quoted context omitted.

Hello everyone, first of all thank you so much. Yes, it is because all of us are Burmese.

Did you guys study abroad or how did you learn the technical skills to build app like this?

Most of us have never been to foreign countries. We graduated from Burmese Universities. (Only the CEO of the company studied in Singapore for about 3 years.)

Re: 'Hush,' anonymous messaging app from developers in Myanmar

#50

Post by drdaeman »

higherpurpose wrote: post #23

So is this like some sort of Secretly and Tinder mix? So then it's not anonymous, only pseudonymous.

IIRC, those are "partially weakly anonymous". There are no pseudonyms in Secretly for the "main" posts - they are anonymous, even though the anonymity isn't even remotely strong. Machine-generated pseudonyms (identicons) are used only for discussion comments there -- don't know about Hush, though.

Either way, there's nothing revolutionary about this sort of apps, but marketing statements. Anonymous BBSes are there for decades, and this app has exactly the same concept except for being a mobile app instead of a website or desktop one. The only relatively novel part here is location-awareness.

Post reply on HN