Encrypted social network vies for disgruntled WhatsApp, Facebook users

http://www.pcworld.com/article/2067920/encrypted-social-network-vies-for-disgruntled-whatsapp-facebook-users.html

by jonajon • 13 years ago

44 25 13 years ago

timbro• 13 years ago

So it's basically the messaging part of http://retroshare.sourceforge.net/

salient• 13 years ago

If only Retroshare had a more modern and easier to use interface. If you want "mainstream users" to use services and apps that are privacy and security oriented, that's kind of a requirement.

Aether is another similar attempt to Syme, although it's more Reddit than Facebook:

http://www.getaether.net/

kunai• 13 years ago

This is the wrong idea of what an encrypted and secure social network should be.

Networks need to be moving away from this centralized model into a system of routed nodes for a secure, encrypted peer-to-peer system. The whole point of something like BitTorrent is that it is distributed -- there's no "middle-manager" you have to go through. Aether has got the right idea and I love its dark, underground aesthetic. But making another social network that exists based on a centralized model is just the wrong way to go. It's another weak spot, and there's no transparency. It's not open either, which is arguably even worse than having a central system in the first place. You're still faced with the absurd bureaucracy of a ToS and proprietary software, and while the content itself is encrypted, the "metadata" still isn't, which renders everything moot anyway. Timestamped messages are still too much information to be giving away to people, and we don't know if the creators of this service are going to hold their ground.

Hell, for all we know it could be a honeypot (probably not though).

mahyarm4• 13 years ago

I would be happy with just OTR style encrypted messaging that actually works on android, ios, windows and osx as a big first step, with the text contents being government subpoena or hacked server proof.

Can't find it. ChatSecure on iOS is a crashy mess and TextSecure is android only. TextSecure oddly requires phone numbers vs some sort of login system too, so I can't even use it with an android tablet for example last time I checked.

jonajon3• 13 years ago

Cryptocat is available for your browser, Mac, and is coming out with iOS and Android apps in December.

XorNot3• 13 years ago

There's no way to stop your communications partner from logging all your chats.

nly• 13 years ago

TextSecure oddly requires phone numbers

That's because it's an SMS app, not an IM app. It probably has the best crypto going though, and the user experience is nice (well, until you move to KitKat where every bloody app wants to eat your text messages and you end up with all your texts across more than one of them).

na85• 13 years ago

The whole point of something like BitTorrent is that it is distributed

Yep that's true, but I'm so sick of projects that shoehorn everything into BitTorrent. The simple fact is that a lot of us don't have epic bandwidth, and BitTorrent is really poorly behaved in terms of how greedily it will saturate your connection.

It's the reason I don't want to run e.g. a Tor node or a CJDNS router.

Call me cheap, but I pay for my bandwidth and I don't want to have to deal with slow video streaming or high ping times just so someone I've never met can buy their drugs on silkroad.

XorNot3• 13 years ago

Which is where everyone seems to forgetting that Facebook, Google - all these services. They're not free. Nothing is.

You get a lot of service storage and availability wise from Facebook and Google and the like, and you pay for it by being not anonymous. The fact that so-called anonymous social network services never get any traction is because when you get down to it, no one wants to pay the costs for Facebook level service directly.

Amadou2• 13 years ago

Call me cheap, but I pay for my bandwidth and I don't want to have to deal with slow video streaming or high ping times just so someone I've never met can buy their drugs on silkroad.

A key thing to remember is that each person's social network is relatively small. You don't have to relay traffic for someone you've never met, just for the people you've added as "friends" plus some relatively small amount of overhead for linking into the rest of the "world" in order to do searches for people you want to add as "friends."

DerpDerpDerp• 13 years ago

You spending your bandwidth so he can buy his drugs safely is the cost of you being able to communicate without people knowing to whom and when.

If you don't think the price is worth it, don't do it. But there's no way to avoid that trade.

jonajon3• 13 years ago

This is the wrong idea of what an encrypted and secure social network should be. Networks need to be moving away from this centralized model into a system of routed nodes for a secure, encrypted peer-to-peer system.

There are many people working on this problem from many different angles. The logical first step for us was to create a zero-knowledge public key infrastructure that decentralizes trust. This system doesn't preclude decentralization of data, which is another problem in itself, and it's something we're working on. The Cryptosphere project (https://github.com/cryptosphere/cryptosphere) has some really neat ideas that need to be discussed more widely.

We have to keep in mind, though, that decentralization of data is not always practical in terms of large-scale adoption and accessibility. It’s one of the reasons why Diaspora didn’t go as far as it could have, IMO.

It's not open either, which is arguably even worse than having a central system in the first place.

We’re progressively releasing our code on Github and plan on being fully open in the near future. If you haven’t already, you can check out our white paper and some of our repositories at https://github.com/symeapp.

while the content itself is encrypted, the "metadata" still isn't, which renders everything moot anyway. Timestamped messages are still too much information to be giving away to people

This is the same as what happens when you use PGP. You have a timestamped message and a clear link between sender and recipient. If you need to hide the fact that you are communicating with a person in particular, Syme (or PGP for that matter) may not be the right tools.

There are several very interesting solutions to the problem of metadata that are being discussed currently (https://leap.se/es/docs/tech/hard-problems#Meta-data.problem). We don't think an acceptable solution has been found yet, but auto-alias pairs seem like a promising avenue.

sillysaurus2• 13 years ago

while the content itself is encrypted, the "metadata" still isn't, which renders everything moot anyway. Timestamped messages are still too much information to be giving away to people

You've set your sights much too low, and it's unfortunately going to limit your product's market value.

Hiding metadata is a difficult problem to solve, but it's vital.

insendx• 13 years ago

Sure, I'll just go ahead and trust you're not giving away the keys like facebook and whatzapp. Ludicrous.

gwu782• 13 years ago

Surprise. Another purportedly "secure" application where the developers are not releasing the full sourse code.

I just don't understand what the theory is behind a closed source application that purports to be "secure". This is a very bold claim to make. How does the educated user decide whether she wants to trust the developers? She is not permitted to see their work.

Maybe there is something to be said for putting your code out in the open and letting everyone see what you've done. Letting others review your code and submit fixes (e.g. for platform specific issues). And then having numerous very determined people try to find serious flaws, and fail to find any.

Then again, maybe not. But one thing is for sure: Closed source does not allow that vetting process to happen.

dweinus• 13 years ago

I don't disagree with your points at all, but for what it is worth, they say they will be opening the source "Soon"[1] and have started populating a Github account[2].

1. https://getsyme.com/faq

2. https://github.com/symeapp

gwu782• 13 years ago

Yes, I didn't mention it, but I have seen this before as well (other projects aimed at secure communications who "launch" but "delay" the release of the source code); I find this "delayed/promised open source" tactic equally perplexing. If they later release the source code, but users are already blindly routing their sensitive information through the system (because they launched first, before releasing the code), then it's too late for those users if it is later found the software is not trustworthy.

Encrypted social network vies for disgruntled WhatsApp, Facebook users

Related Stories