4 ms·

Aye aye! Both Telegram and Signal scare me. We're building an MIT/ZLIB/Apache2 Open Source End-to-End Encrypted alternative that is a fully P2P decentralized a

Aye aye! Both Telegram and Signal scare me. We're building an MIT/ZLIB/Apache2 Open Source End-to-End Encrypted alternative that is a fully P2P decentralized app (dApp), see: https://hackernoon.com/so-you-want-to-build-a-p2p-twitter-with-e2e-encryption-f90505b2ff8 https://hackernoon.com/so-you-want-to-build-a-p2p-twitter-wi... ! Currently it supports signed/verified messages, haven't added cyphered/private messages yet to the API, but it is available in the SEA (Security, Encryption, Authorization) utility library underneath - but that should be coming soon, and of course love any contributions! Also, the "server" has no special application logic on it, it is just another peer in the network that can help with WebRTC signaling or being a websocket relay. It cannot middleman the data, because every message is signed via the "client" (technically there are no server/clients, everybody is just a peer) using latest native Web Crypto API! Here is a demo of an example social network app that is syncing character-by-character with cryptographically verifiable sources across a test network of real world devices: https://youtu.be/C3akdQJs55E https://youtu.be/C3akdQJs55E Again, all truly Open Source (ie, MIT/ZLIB/Apache2)!

eitland 9y ago
Cool! > So You Want to Build a P2P Twitter with E2E Encryption? Saw this and immediately wondered: is this just twitterish features (primarily broadcast) or are there plans for private and group chats?
hjek 9y ago
Tox is also worth checking out. Decentralized, supports video calls, and you're automagically given an ID without having to provide any personal data. https://tox.chat https://tox.chat
bqe 9y ago
Why does Signal scare you? All of their code is open source[1] and has had multiple public audits[2]. [1]: https://github.com/signalapp https://github.com/signalapp [2]: https://eprint.iacr.org/2016/1013.pdf https://eprint.iacr.org/2016/1013.pdf
- codedokode 9y ago
  It requires you to provide a phone number (read disclose your identity) to use it. And its homepage has the word "privacy" repeated several times. It looks like a poor joke.
  - bqe 9y ago
    You can easily use a VoIP number to set up Signal if that's really an issue for you. The alternative (using Telegram's homegrown and dubious cryptography and lack of actually encrypted group messages) is significantly worse. Here's a nice summary of the issues: https://security.stackexchange.com/a/49802/43733 https://security.stackexchange.com/a/49802/43733
    - codedokode 9y ago
      Telegram also requires a phone number so it is not any better than Signal. Regarding cryptography, anything is good as long as three-letter agencies cannot break it.
    - ShabbosGoy 9y ago
      VoIP is easily traceable too. Pay with a credit card for the number? Use Google Voice? Bam, they’ve got you.
  - mashedvikings 9y ago
    Yet the developer is world famous for his security work, not for something like inventing Facebook for Russians. Are you sure you can handle 100% anonymous connection to servers of apps that could at any time identify you based on your IP?
    - codedokode 9y ago
      I am not trying to discuss who is the developer, I just wanted to say that you cannot require a phone number and talk about privacy at the same time. Phone number discloses your location and identity. IP address is much easier to hide, for example by using a VPN.
paule89 9y ago
In my opinion your top priority should be to make every message e2e encrypted between sender and recipient. Else your idea is just as useless as telegram

eitland 9y ago

Cool! > So You Want to Build a P2P Twitter with E2E Encryption? Saw this and immediately wondered: is this just twitterish features (primarily broadcast) or are there plans for private and group chats?

hjek 9y ago

Tox is also worth checking out. Decentralized, supports video calls, and you're automagically given an ID without having to provide any personal data. https://tox.chat https://tox.chat

bqe 9y ago

Why does Signal scare you? All of their code is open source[1] and has had multiple public audits[2]. [1]: https://github.com/signalapp https://github.com/signalapp [2]: https://eprint.iacr.org/2016/1013.pdf https://eprint.iacr.org/2016/1013.pdf

codedokode 9y ago
It requires you to provide a phone number (read disclose your identity) to use it. And its homepage has the word "privacy" repeated several times. It looks like a poor joke.
- bqe 9y ago
  You can easily use a VoIP number to set up Signal if that's really an issue for you. The alternative (using Telegram's homegrown and dubious cryptography and lack of actually encrypted group messages) is significantly worse. Here's a nice summary of the issues: https://security.stackexchange.com/a/49802/43733 https://security.stackexchange.com/a/49802/43733
  - codedokode 9y ago
    Telegram also requires a phone number so it is not any better than Signal. Regarding cryptography, anything is good as long as three-letter agencies cannot break it.
  - ShabbosGoy 9y ago
    VoIP is easily traceable too. Pay with a credit card for the number? Use Google Voice? Bam, they’ve got you.
- mashedvikings 9y ago
  Yet the developer is world famous for his security work, not for something like inventing Facebook for Russians. Are you sure you can handle 100% anonymous connection to servers of apps that could at any time identify you based on your IP?
  - codedokode 9y ago
    I am not trying to discuss who is the developer, I just wanted to say that you cannot require a phone number and talk about privacy at the same time. Phone number discloses your location and identity. IP address is much easier to hide, for example by using a VPN.

paule89 9y ago

In my opinion your top priority should be to make every message e2e encrypted between sender and recipient. Else your idea is just as useless as telegram