5 ms·

I couldn't agree more, and it's actually something I've been working on for the last few months, though in a sense for the last few years. I was going to do a S

by tasn 6y ago

I couldn't agree more, and it's actually something I've been working on for the last few months, though in a sense for the last few years. I was going to do a Show HN in the next few weeks, but heck, may as well mention it now too. What I'm working on is called Etebase. Etebase makes it easy to build end-to-end encrypted applications by taking care of the encryption and its related challenges such as data-integrity, data-deduplication, collaboration and etc. Everything is open-source, it uses libsodium[0] behind the scenes, and we plan on releasing a full spec soon as well as formally verify the protocol using Verifpal[1]. Website: https://www.etebase.com https://www.etebase.com Docs: https://docs.etebase.com https://docs.etebase.com It's essentially a spin-off of the next version that powers my other project, EteSync[2] - a secure, end-to-end encrypted, and privacy respecting sync for your contacts, calendars and tasks. Would love to hear your thoughts! [0] https://doc.libsodium.org/ https://doc.libsodium.org/ [1] https://verifpal.com/ https://verifpal.com/ [2] https://www.etesync.com https://www.etesync.com

uryga 6y ago
i don't wanna sound dismissive, i'm sure Etebase is a good fit for some things. but GP was asking for a crypto library, not a whole SaaS that will host all their chat data
- tasn 6y ago
  No worries, you don't sound dismissive, though let me address your points: First of all, Etebase is not "a whole SaaS", since it's open-source you can self host it, so the SaaS is optional. As for what the GP was asking, I disagree. I think it's exactly what he was asking for. He was lamenting the lack of complete solutions, and having to figure out things on your own. Without the server part and network protocol, Etebase is essentially just libsodium, which GP already mentioned.
NetOpWibby 6y ago
I'm glad I found this, I've been spending my morning looking at libsodium and it's secure box function. I'm doing a refactoring of Socii, my social network project, and want to add E2E encrpytion. Your pricing looks good and I don't expect to have users for quite some time, haha.
- tasn 6y ago
  Haha. :P Please let me know (email: tom @ the domain) if you have any questions or feedback! Though I'd love to hear what you are working on anyway (I love hearing about new privacy projects!) so would be great to chat regardless.
lawl 6y ago
This looks pretty cool, but to be perfectly honest. At the moment I'd be quite weary to use this. And the reason is that I have no idea who you are and if you can write crypto code. Please don't take this as an offence, i'm sure you do, but I have no way of verifying this. So my heuristic so far has basically been "is this from someone who's known to know their shit", e.g. djb and/or "has this been audited by someone/some company that's known to know their shit". In general though, an end2end encrypted open source firebase-like stack does sound pretty awesome though. But you'd need to publish at least one external audit of the crypto for me to consider using it. Anyways, I have it bookmarked and wish you success!
- tasn 6y ago
  Thanks for the feedback, and these are all fair concerns. Some points that would hopefully alleviate some of them: 1. We have been running EteSync for >3.5 years and have been in the space for much longer, so I'm not just some rando, though yes, I'm definitely not djb. :) 2. We use libsodium for everything so the harder crypto parts are audited and battle-tested. 3. We are going to formally verify the protocol. 4. We have been been awarded a grant by NLnet's PET fund and as part of that we will get a mini security audit. Though to be honest, I think the formal verification is a much more serious assurance. With that being said, I'm not trying to convince you. I think it's a very important point that we are working on addressing.

by tasn 6y ago

uryga 6y ago

i don't wanna sound dismissive, i'm sure Etebase is a good fit for some things. but GP was asking for a crypto library, not a whole SaaS that will host all their chat data

tasn 6y ago
No worries, you don't sound dismissive, though let me address your points: First of all, Etebase is not "a whole SaaS", since it's open-source you can self host it, so the SaaS is optional. As for what the GP was asking, I disagree. I think it's exactly what he was asking for. He was lamenting the lack of complete solutions, and having to figure out things on your own. Without the server part and network protocol, Etebase is essentially just libsodium, which GP already mentioned.

NetOpWibby 6y ago

I'm glad I found this, I've been spending my morning looking at libsodium and it's secure box function. I'm doing a refactoring of Socii, my social network project, and want to add E2E encrpytion. Your pricing looks good and I don't expect to have users for quite some time, haha.

tasn 6y ago
Haha. :P Please let me know (email: tom @ the domain) if you have any questions or feedback! Though I'd love to hear what you are working on anyway (I love hearing about new privacy projects!) so would be great to chat regardless.

lawl 6y ago

This looks pretty cool, but to be perfectly honest. At the moment I'd be quite weary to use this. And the reason is that I have no idea who you are and if you can write crypto code. Please don't take this as an offence, i'm sure you do, but I have no way of verifying this. So my heuristic so far has basically been "is this from someone who's known to know their shit", e.g. djb and/or "has this been audited by someone/some company that's known to know their shit". In general though, an end2end encrypted open source firebase-like stack does sound pretty awesome though. But you'd need to publish at least one external audit of the crypto for me to consider using it. Anyways, I have it bookmarked and wish you success!

tasn 6y ago
Thanks for the feedback, and these are all fair concerns. Some points that would hopefully alleviate some of them: 1. We have been running EteSync for >3.5 years and have been in the space for much longer, so I'm not just some rando, though yes, I'm definitely not djb. :) 2. We use libsodium for everything so the harder crypto parts are audited and battle-tested. 3. We are going to formally verify the protocol. 4. We have been been awarded a grant by NLnet's PET fund and as part of that we will get a mini security audit. Though to be honest, I think the formal verification is a much more serious assurance. With that being said, I'm not trying to convince you. I think it's a very important point that we are working on addressing.