4 ms·

Unless they release the server code, no, you can't build your own "Telegram" yet. The original article's title was misleading, thankfully the HN submission titl

Unless they release the server code, no, you can't build your own "Telegram" yet. The original article's title was misleading, thankfully the HN submission title was amended to correct it. Still useful of course for anyone creating third-party clients, but an entirely different matter.

marknadal 9y ago
Aye aye! Both Telegram and Signal scare me. We're building an MIT/ZLIB/Apache2 Open Source End-to-End Encrypted alternative that is a fully P2P decentralized app (dApp), see: https://hackernoon.com/so-you-want-to-build-a-p2p-twitter-with-e2e-encryption-f90505b2ff8 https://hackernoon.com/so-you-want-to-build-a-p2p-twitter-wi... ! Currently it supports signed/verified messages, haven't added cyphered/private messages yet to the API, but it is available in the SEA (Security, Encryption, Authorization) utility library underneath - but that should be coming soon, and of course love any contributions! Also, the "server" has no special application logic on it, it is just another peer in the network that can help with WebRTC signaling or being a websocket relay. It cannot middleman the data, because every message is signed via the "client" (technically there are no server/clients, everybody is just a peer) using latest native Web Crypto API! Here is a demo of an example social network app that is syncing character-by-character with cryptographically verifiable sources across a test network of real world devices: https://youtu.be/C3akdQJs55E https://youtu.be/C3akdQJs55E Again, all truly Open Source (ie, MIT/ZLIB/Apache2)!
- eitland 9y ago
  Cool! > So You Want to Build a P2P Twitter with E2E Encryption? Saw this and immediately wondered: is this just twitterish features (primarily broadcast) or are there plans for private and group chats?
- hjek 9y ago
  Tox is also worth checking out. Decentralized, supports video calls, and you're automagically given an ID without having to provide any personal data. https://tox.chat https://tox.chat
- bqe 9y ago
  Why does Signal scare you? All of their code is open source[1] and has had multiple public audits[2]. [1]: https://github.com/signalapp https://github.com/signalapp [2]: https://eprint.iacr.org/2016/1013.pdf https://eprint.iacr.org/2016/1013.pdf
  - codedokode 9y ago
    It requires you to provide a phone number (read disclose your identity) to use it. And its homepage has the word "privacy" repeated several times. It looks like a poor joke.
    - bqe 9y ago
      You can easily use a VoIP number to set up Signal if that's really an issue for you. The alternative (using Telegram's homegrown and dubious cryptography and lack of actually encrypted group messages) is significantly worse. Here's a nice summary of the issues: https://security.stackexchange.com/a/49802/43733 https://security.stackexchange.com/a/49802/43733
      - codedokode 9y ago
        Telegram also requires a phone number so it is not any better than Signal. Regarding cryptography, anything is good as long as three-letter agencies cannot break it.
      - ShabbosGoy 9y ago
        VoIP is easily traceable too. Pay with a credit card for the number? Use Google Voice? Bam, they’ve got you.
    - mashedvikings 9y ago
      Yet the developer is world famous for his security work, not for something like inventing Facebook for Russians. Are you sure you can handle 100% anonymous connection to servers of apps that could at any time identify you based on your IP?
- paule89 9y ago
  In my opinion your top priority should be to make every message e2e encrypted between sender and recipient. Else your idea is just as useless as telegram
codedokode 9y ago
The client-server protocol is published. What stops you from writing your own server implementation?

marknadal 9y ago

Aye aye! Both Telegram and Signal scare me. We're building an MIT/ZLIB/Apache2 Open Source End-to-End Encrypted alternative that is a fully P2P decentralized app (dApp), see: https://hackernoon.com/so-you-want-to-build-a-p2p-twitter-with-e2e-encryption-f90505b2ff8 https://hackernoon.com/so-you-want-to-build-a-p2p-twitter-wi... ! Currently it supports signed/verified messages, haven't added cyphered/private messages yet to the API, but it is available in the SEA (Security, Encryption, Authorization) utility library underneath - but that should be coming soon, and of course love any contributions! Also, the "server" has no special application logic on it, it is just another peer in the network that can help with WebRTC signaling or being a websocket relay. It cannot middleman the data, because every message is signed via the "client" (technically there are no server/clients, everybody is just a peer) using latest native Web Crypto API! Here is a demo of an example social network app that is syncing character-by-character with cryptographically verifiable sources across a test network of real world devices: https://youtu.be/C3akdQJs55E https://youtu.be/C3akdQJs55E Again, all truly Open Source (ie, MIT/ZLIB/Apache2)!

eitland 9y ago
Cool! > So You Want to Build a P2P Twitter with E2E Encryption? Saw this and immediately wondered: is this just twitterish features (primarily broadcast) or are there plans for private and group chats?
hjek 9y ago
Tox is also worth checking out. Decentralized, supports video calls, and you're automagically given an ID without having to provide any personal data. https://tox.chat https://tox.chat
bqe 9y ago
Why does Signal scare you? All of their code is open source[1] and has had multiple public audits[2]. [1]: https://github.com/signalapp https://github.com/signalapp [2]: https://eprint.iacr.org/2016/1013.pdf https://eprint.iacr.org/2016/1013.pdf
- codedokode 9y ago
  It requires you to provide a phone number (read disclose your identity) to use it. And its homepage has the word "privacy" repeated several times. It looks like a poor joke.
  - bqe 9y ago
    You can easily use a VoIP number to set up Signal if that's really an issue for you. The alternative (using Telegram's homegrown and dubious cryptography and lack of actually encrypted group messages) is significantly worse. Here's a nice summary of the issues: https://security.stackexchange.com/a/49802/43733 https://security.stackexchange.com/a/49802/43733
    - codedokode 9y ago
      Telegram also requires a phone number so it is not any better than Signal. Regarding cryptography, anything is good as long as three-letter agencies cannot break it.
    - ShabbosGoy 9y ago
      VoIP is easily traceable too. Pay with a credit card for the number? Use Google Voice? Bam, they’ve got you.
  - mashedvikings 9y ago
    Yet the developer is world famous for his security work, not for something like inventing Facebook for Russians. Are you sure you can handle 100% anonymous connection to servers of apps that could at any time identify you based on your IP?
paule89 9y ago
In my opinion your top priority should be to make every message e2e encrypted between sender and recipient. Else your idea is just as useless as telegram

codedokode 9y ago

The client-server protocol is published. What stops you from writing your own server implementation?