4 ms·

As we keep hearing about data breach news of big companies like Dropbox or WhatsApp, it is harder for us to keep trusting them with our file and personal data,

As we keep hearing about data breach news of big companies like Dropbox or WhatsApp, it is harder for us to keep trusting them with our file and personal data, and it made us think about finding a better way. We believe the best way to keep data secure is not having them in the first place. That's why we choose the server-less solution, in another word, blockchain. Here is a link to our launch on Product Hunt that was #1 of the day! You can find more info, images, and gifs there: https://www.producthunt.com/posts/arcane-docs https://www.producthunt.com/posts/arcane-docs Please hit me up with any question and I will be happy to answer.

jammygit 7y ago
How does blockchain promote privacy? Doesn’t it just store the data in a decentralized, permanent way?
- ucaetano 7y ago
  > How does blockchain promote privacy? There are no privacy leaks when everything is public :)
- joeyrideout 7y ago
  To piggyback on this question, does Arcane provide any forward secrecy?
  - Walterion 7y ago
    Each of your documents has a different key generated from your private key and are encrypted in your private hub with ECDSA encryption. So no server can compromise your data.
- Walterion 7y ago
  We use Blockstack for authentication. It is made on Bitcoin blockchain to store your private key that will be used to encrypt all of your stuff. Making the master key will be done just the first time, and after that, every file gets a new password from the master one. No matter what, all the files will be encrypted, so you always have control over your data — something like ProtonMail but for Office.
  - vorpalhex 7y ago
    Why are you storing a private key on a blockchain, where the primary purpose of a blockchain is universal visibility?
    - Walterion 7y ago
      Surly they are encrypted. But I invite you to check Blockstack authentication and how it works.
      - vorpalhex 7y ago
        With what key are you encrypting someone else's private key? And who holds this master key? I would love it if you could link a technical deep dive into how Blockstack fundamentally works because I've gotten very few answers from both implementors and founders, and their existing documentation isn't at all helpful.
        Walterion 7y ago
        Maybe these help but let me know if you got any question https://docs.blockstack.org/faqs/allfaqs https://docs.blockstack.org/faqs/allfaqs
        jude- 7y ago
        You (the user) hold the master key. It's generated for you when you sign up for a Blockstack ID. From there, the authenticator generates a per-ID, per-application key-pair via BIP32 -- each app key is a hardened child whose path is generated from the key that owns the ID on-chain and the hash of the application's DNS origin. Authentication happens completely client-side. The Blockstack authenticator registers itself as a protocol handler for the "blockstack:" protocol, such that when you click a sign-in button, you will be redirected to your locally-running authenticator (or to a hosted version of the same, if you don't have the authenticator installed). The authenticator stores your master key, and will derive the ID- and application-specific key-pair for you when you select the ID to sign in as. Once you sign in, the authenticator redirects you back to the application. The authenticator passes the app the Blockstack ID and application-specific private key via the URL string (encrypted with an ephemeral ECDSA key generated by the app on sign-in), and the blockstack.js library fetches and downloads the user's profile to learn the storage endpoint(s) as part of completing the sign-in. In so doing, the application learns the storage endpoint to which to GET and POST user data, and learns the key to use to sign/encrypt it and to authenticate to the user's preferred storage (access to which is mediated by a Gaia hub that the user selects when onboarding). Agreed that a deep dive with protocol diagrams would be handy. We're working on it! :)
- russdpale 7y ago
  Well for one no one can just query your Gaia data for anyone who wants to purchase your data..
  - Walterion 7y ago
    Yes your private key is needed for that, and that is encrypted and will not leave your browser at all without that.

jammygit 7y ago

How does blockchain promote privacy? Doesn’t it just store the data in a decentralized, permanent way?

ucaetano 7y ago
> How does blockchain promote privacy? There are no privacy leaks when everything is public :)
joeyrideout 7y ago
To piggyback on this question, does Arcane provide any forward secrecy?
- Walterion 7y ago
  Each of your documents has a different key generated from your private key and are encrypted in your private hub with ECDSA encryption. So no server can compromise your data.
Walterion 7y ago
We use Blockstack for authentication. It is made on Bitcoin blockchain to store your private key that will be used to encrypt all of your stuff. Making the master key will be done just the first time, and after that, every file gets a new password from the master one. No matter what, all the files will be encrypted, so you always have control over your data — something like ProtonMail but for Office.
- vorpalhex 7y ago
  Why are you storing a private key on a blockchain, where the primary purpose of a blockchain is universal visibility?
  - Walterion 7y ago
    Surly they are encrypted. But I invite you to check Blockstack authentication and how it works.
    - vorpalhex 7y ago
      With what key are you encrypting someone else's private key? And who holds this master key? I would love it if you could link a technical deep dive into how Blockstack fundamentally works because I've gotten very few answers from both implementors and founders, and their existing documentation isn't at all helpful.
      - Walterion 7y ago
        Maybe these help but let me know if you got any question https://docs.blockstack.org/faqs/allfaqs https://docs.blockstack.org/faqs/allfaqs
      - jude- 7y ago
        You (the user) hold the master key. It's generated for you when you sign up for a Blockstack ID. From there, the authenticator generates a per-ID, per-application key-pair via BIP32 -- each app key is a hardened child whose path is generated from the key that owns the ID on-chain and the hash of the application's DNS origin. Authentication happens completely client-side. The Blockstack authenticator registers itself as a protocol handler for the "blockstack:" protocol, such that when you click a sign-in button, you will be redirected to your locally-running authenticator (or to a hosted version of the same, if you don't have the authenticator installed). The authenticator stores your master key, and will derive the ID- and application-specific key-pair for you when you select the ID to sign in as. Once you sign in, the authenticator redirects you back to the application. The authenticator passes the app the Blockstack ID and application-specific private key via the URL string (encrypted with an ephemeral ECDSA key generated by the app on sign-in), and the blockstack.js library fetches and downloads the user's profile to learn the storage endpoint(s) as part of completing the sign-in. In so doing, the application learns the storage endpoint to which to GET and POST user data, and learns the key to use to sign/encrypt it and to authenticate to the user's preferred storage (access to which is mediated by a Gaia hub that the user selects when onboarding). Agreed that a deep dive with protocol diagrams would be handy. We're working on it! :)
russdpale 7y ago
Well for one no one can just query your Gaia data for anyone who wants to purchase your data..
- Walterion 7y ago
  Yes your private key is needed for that, and that is encrypted and will not leave your browser at all without that.