[{"data":1,"prerenderedAt":434},["ShallowReactive",2],{"project-10869046":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":27,"sentiment":28,"stance_mix":29,"scored_comments":33,"aspects":34,"strip":43,"post_text":46,"what":47,"said":95,"maker_in_thread":237,"shape":245,"grid":250,"attempts":394,"same_week":395,"maker_shows":40,"maker_hidden":426,"reader_version":427,"card":428},"10869046","Charme","A decentralized social network with end-to-end encryption","title","Show HN: A decentralized social network with end-to-end encryption","https:\u002F\u002Fgithub.com\u002Fmschultheiss\u002FCharme","github.com","mschultheiss",1452295106,2016,167,61,188,2264,9,"notable","consumer_social","decentralized social network","web_app",[21,24,25,26],"end-to-end encryption","federated social","privacy messaging","curious",-0.255,{"positive":30,"neutral":31,"mixed":30,"critical":32},2,15,11,30,{"privacy":35,"execution":38,"idea":39,"design":41,"docs":42},{"positive":36,"critical":37},0,7,{"positive":36,"critical":30},{"positive":40,"critical":30},1,{"positive":36,"critical":36},{"positive":36,"critical":36},[40,36,36,40,36,36,36,36,36,36,36,36,36,36,36,36,36,40,40,44,44,44,44,40,45,44,44,44,44,40,45,40,40,44,44,44,36,40,44,40],3,5,null,{"problem":48,"audience":46,"pricing":46,"motivation":58,"time_to_build":46,"stack":64,"openness":92,"stage":93,"team_size":94},{"value":49,"source":50,"evidence":51},"Private social networking where the server cannot read messages","maker",[52,55],{"id":53,"by":11,"text":54},"10869550","It has end-to-end encrpytion - so if you are hosted on a friend's server for example, the friend can not read your messages, which might be useful :)",{"id":56,"by":11,"text":57},"10869699","1. The web crypto api was indeed made to secure communications, such as stated by the W3C on http:\u002F\u002Fwww.w3.org\u002FTR\u002FWebCryptoAPI\u002F (...) \"Uses for this API range from user or…",{"value":59,"source":50,"evidence":60},"Build a private alternative social network; get feedback on crypto design",[61],{"id":62,"by":11,"text":63},"10869541","Yes, as written on top this is a technology preview, so it is not safe yet. Furthermore the production version will use the web crypto api. The client software must be shipped…",[65,77,81],{"value":66,"source":67,"evidence":68},"PHP (server)","commenter",[69,73],{"id":70,"by":71,"text":72},"10869880","sarciszewski","https:\u002F\u002Fgithub.com\u002Fmschultheiss\u002FCharme\u002Fblob\u002F7634cd89febbe28825d6d33c012c2fe4754f02c2\u002Fserver\u002Fcharme\u002Flib\u002FApp\u002FUsers\u002FUserRegistration.php#L34 Please see:…",{"id":74,"by":75,"text":76},"10870703","jafingi","You really need to look on the security perspective to harden it. When it's marketed with security in mind. And there's so many things wrong with the PHP syntax etc. as well as…",{"value":78,"source":67,"evidence":79},"Android (Java)",[80],{"id":70,"by":71,"text":72},{"value":82,"source":67,"evidence":83},"JavaScript in browser client",[84,88],{"id":85,"by":86,"text":87},"10869505","tptacek","The cryptography in this system does not appear to be safe. Apart from the fact that it's browser Javascript, which can only be as secure as the server's verified TLS key anyways…",{"id":89,"by":90,"text":91},"10869594","yk","Isn't this the one application were JS crypto is OK? As far as I understand, that is not at all, here JS crypto is used to offload the computation from a trusted server to a…","open_source","prototype","unknown",{"praise":96,"objections":113,"requests":154,"questions":177,"alternatives":210},[97,108],{"value":98,"source":67,"evidence":99},"Good idea that deserves a solution",[100,104],{"id":101,"by":102,"text":103},"10869408","erikbigelow","Nice. Keep working on it. We need a solution. What's your stack?",{"id":105,"by":106,"text":107},"10869345","beatpanda","I want this to work so much. So many people have tried this, and I have signed up for, or self-hosted, every single one of these things, and even convinced my friends to join a…",{"value":109,"source":67,"evidence":110},"Maker was open to feedback and honest about being a preview",[111,112],{"id":62,"by":11,"text":63},{"id":56,"by":11,"text":57},[114,125,132,139,147],{"value":115,"source":67,"evidence":116},"Browser JavaScript crypto is not secure",[117,118,121],{"id":85,"by":86,"text":87},{"id":119,"by":86,"text":120},"10869559","Unfortunately, the Web Crypto API doesn't automatically get you safe cryptography either. It was added by the W3C to allow video vendors to implement content DRM in pure…",{"id":122,"by":123,"text":124},"10870740","nyan4","> Apart from the fact that it's browser Javascript Huge red flag.",{"value":126,"source":67,"evidence":127},"Custom RSA\u002FAES design is unsafe; needs expert audit",[128,129],{"id":85,"by":86,"text":87},{"id":130,"by":71,"text":131},"10869843","> 1. The web crypto api was indeed made to secure communications, such as stated by the W3C on http:\u002F\u002Fwww.w3.org\u002FTR\u002FWebCryptoAPI\u002F (...) \"Uses for this API range from user or…",{"value":133,"source":67,"evidence":134},"No forward secrecy",[135],{"id":136,"by":137,"text":138},"10870003","Canada","Even if he makes all those decisions correctly the system won't support forward secrecy.",{"value":140,"source":67,"evidence":141},"Needs a user base; past decentralized networks never took off",[142,143],{"id":105,"by":106,"text":107},{"id":144,"by":145,"text":146},"10870398","Animats","Yes. There's Diaspora and Frendica already, with maybe a few hundred users. To launch something like this, you need to figure out some way to get a user base, a user base that…",{"value":148,"source":67,"evidence":149},"Passwords cannot be recovered; users lose keys",[150],{"id":151,"by":152,"text":153},"10870149","ex3ndr","One main problem is that you have to make passwords recoverable. In real world message like \"warring! we can't restore your key!\" just doesn't work at all. People ignore it and…",[155,160,167],{"value":156,"source":67,"evidence":157},"Get a cryptography expert audit and design the protocol",[158,159],{"id":85,"by":86,"text":87},{"id":130,"by":71,"text":131},{"value":161,"source":67,"evidence":162},"Use libsodium or the Web Crypto API correctly",[163,164],{"id":130,"by":71,"text":131},{"id":165,"by":71,"text":166},"10869865","WebCrypto is a potluck of popular cryptography standards, chosen by committee. What you want instead is a library that carefully selects primitives with an emphasis on: ``` 1.…",{"value":168,"source":67,"evidence":169},"Build a desktop client instead of browser crypto",[170,173],{"id":171,"by":71,"text":172},"10869976","Sure, but consider this: Do you know what stops all passive attackers and most active attackers? TLS. Do you know what WebCrypto adds that TLS doesn't? Nothing. That's why this…",{"id":174,"by":175,"text":176},"10871009","dutchbrit","As someone who has been working on something similar (see old proof of concept here: https:\u002F\u002Fciety.com - sorry for the expired ssl certificate), I applaud your efforts. I have…",[178,185,196,203],{"value":179,"source":67,"evidence":180},"How is it different from Diaspora?",[181],{"id":182,"by":183,"text":184},"10869534","sedatk","how is it different from diaspora?",{"value":186,"source":67,"evidence":187},"How does discovery work?",[188,192],{"id":189,"by":190,"text":191},"10869427","zitterbewegung","How do you handle discovery is it location based or in person like a darknet?",{"id":193,"by":194,"text":195},"10869440","benwerd","Discovery is crucial. A social network can be thought of as a kind of search engine: you're trying to find people, posts and resources that are relevant to your interests. On the…",{"value":197,"source":67,"evidence":198},"Why not peer-to-peer without a server?",[199],{"id":200,"by":201,"text":202},"10870336","synchronise","Is there a reason why this still relies on a server? I would have thought that the better option would it to be completely P2P, without any servers whatsoever.",{"value":204,"source":67,"evidence":205},"How would bots run without self-hosting?",[206],{"id":207,"by":208,"text":209},"10870929","Quiark","How do you run the bots if you don't self-host them?",[211,219,223,230],{"value":212,"source":67,"evidence":213},"Diaspora",[214,215],{"id":182,"by":183,"text":184},{"id":216,"by":217,"text":218},"10869567","rndmind","I support the idea behind this, but I love the community on Diaspora, and more importantly it is also decentralized and open-source.",{"value":220,"source":67,"evidence":221},"Friendica",[222],{"id":144,"by":145,"text":146},{"value":224,"source":67,"evidence":225},"Movim (XMPP)",[226],{"id":227,"by":228,"text":229},"10871197","tethra","It's a nice effort, but it's covered in warnings that say \"don't use this\" - therefore, not yet interesting. I'm going to leave this here: https:\u002F\u002Fmovim.eu\u002F Movim is a social…",{"value":231,"source":67,"evidence":232},"IRC with private channels",[233],{"id":234,"by":235,"text":236},"10869438","Swizec","This is a serious question, because it's the situation I'm in: Why would somebody who is techy enough to use a decentralized social network, not just use IRC? I have a group of…",{"comments":238,"answered":30,"key":239},4,[240,241,242],{"id":62,"text":63},{"id":56,"text":57},{"id":243,"text":244},"10869815","Yes, exactly :)",{"commenters":246,"max_depth":247,"maker_replies":238,"first_comment_mins":248,"lifespan_hours":249},39,8,43,59,[251,253,255,257,259,260,261,263,267,269,271,274,277,280,283,284,285,288,290,292,294,296,297,299,302,304,306,309,311,313,315,318,322,323,326,329,331,332,336,338,342,343,346,348,350,352,354,355,358,361,364,369,371,373,375,378,380,382,383,385,389],[85,36,40,252,86,36],"project\u002Fcritical\u002Fprivacy",[62,36,36,254,11,40],"maker\u002Fneutral\u002Fprivacy",[119,36,36,256,86,36],"commenter\u002Fneutral\u002Fprivacy",[56,36,36,258,11,40],"project\u002Fneutral\u002Fdesign",[130,36,40,252,71,36],[136,36,40,252,137,36],[262,36,36,256,71,36],"10870059",[264,36,36,265,266,36],"10869860","other\u002Fneutral\u002Fidea","jchrisa",[165,36,36,268,71,36],"other\u002Fneutral\u002Fnone",[270,36,36,268,266,36],"10870047",[272,36,36,268,273,36],"10871731","iheartmemcache",[275,36,36,276,71,36],"10872592","commenter\u002Fneutral\u002Fnone",[278,36,36,268,279,36],"10870724","moron4hire",[281,36,36,268,282,36],"10871433","rafael-rinaldi",[89,36,36,256,90,36],[243,36,36,254,11,40],[286,36,36,256,287,36],"10869917","mehrdada",[289,36,36,256,71,36],"10869926",[291,36,36,256,287,36],"10869932",[293,36,36,256,71,36],"10869936",[295,36,36,256,287,36],"10869953",[171,36,36,256,71,36],[298,36,36,256,287,36],"10869996",[300,36,36,301,86,36],"10870150","other\u002Fneutral\u002Fprivacy",[303,36,36,256,287,36],"10870187",[122,36,40,305,123,36],"project\u002Fcritical\u002Fexecution",[307,36,36,276,308,36],"10870775","lucb1e",[310,36,40,252,273,36],"10870840",[312,36,36,276,308,36],"10871061",[105,40,44,314,106,36],"project\u002Fmixed\u002Fidea",[316,40,44,258,317,36],"10869888","joe_the_user",[319,40,44,320,321,36],"10870044","project\u002Fneutral\u002Fidea","pjbrunet",[144,40,44,320,145,36],[324,40,44,320,325,36],"10870613","eellpp",[327,40,36,268,328,36],"10872487","jaywink",[70,30,40,330,71,36],"maker\u002Fcritical\u002Fprivacy",[234,44,44,320,235,36],[333,44,45,334,335,36],"10870830","project\u002Fpositive\u002Fidea","grandcat",[207,44,44,337,208,36],"maker\u002Fneutral\u002Fnone",[339,238,44,340,341,36],"10869264","project\u002Fneutral\u002Fdocs","twiceaday",[193,45,44,320,194,36],[344,45,44,320,345,36],"10869457","unepipe",[174,347,44,337,175,36],6,[349,347,36,268,273,36],"10871698",[227,37,40,351,228,36],"project\u002Fcritical\u002Fidea",[101,247,45,353,102,36],"maker\u002Fpositive\u002Fnone",[216,18,44,314,217,36],[356,18,40,252,357,36],"10871117","blubb-fish",[74,359,40,360,75,36],10,"maker\u002Fcritical\u002Fexecution",[362,32,36,268,363,36],"10879872","z3t4",[365,366,44,367,368,36],"10869516",12,"maker\u002Fneutral\u002Fdocs","em3rgent0rdr",[182,370,44,320,183,36],13,[53,370,36,372,11,40],"project\u002Fneutral\u002Fprivacy",[374,370,44,320,183,36],"10870002",[376,370,36,268,377,36],"10871060","beagle3",[379,370,36,268,328,36],"10872567",[151,381,40,351,152,36],14,[189,31,44,320,190,36],[200,384,44,258,201,36],16,[386,387,40,252,388,36],"10870010",17,"module17",[390,391,36,392,393,36],"10869885",18,"commenter\u002Fneutral\u002Fidea","dafrankenstein2",[],[396,401,406,411,416,421],{"id":397,"name":398,"points":399,"category":400},"10872143","gradient.quasi.ink",448,"creative",{"id":402,"name":403,"points":404,"category":405},"10896901","awk-raycaster",350,"games",{"id":407,"name":408,"points":409,"category":410},"10890531","2Sli.de",244,"productivity",{"id":412,"name":413,"points":414,"category":415},"10897121","Patchwork",122,"security_privacy",{"id":417,"name":418,"points":419,"category":420},"10887071","Libconcurrent",91,"languages",{"id":422,"name":423,"points":424,"category":425},"10858327","Penny",89,"finance_crypto",false,"v2",{"id":429,"name":5,"line":6,"ai":426,"cat":20,"year":13,"points":14,"comments":15,"rec":27,"s":430,"top":18,"kw":431,"maker":11,"domain":10,"tier":19,"attempts":36,"strip":432,"url":9,"mix":433,"praise":98,"objection":115,"sub":21},10869046,-0.25,[21,24,25,26],"1001000000000000011333315333315113330131",[30,31,30,32],1794036539456]