3 ms·
While we are at fb alternatives, here is one more that attempts at protecting user privacy: Privachi. Privachi is a privacy-centric social network which attempt
by privachi123 15y ago
While we are at fb alternatives, here is one more that attempts at protecting user privacy: Privachi. Privachi is a privacy-centric social network which attempts at putting users back in control of their social data with a combination of scattering user's data online so no one service provider knows everything about the user, and "locking" user data in such a way that only the user and her friends can "unlock" the data. Even Privachi will not be able to "unlock" the data.
- yid 15y agoNot sure why you were downvoted. Your site is a little light on the details of your encryption scheme, would you care to elaborate?
- privachi123 15y agoSure. Public/private keys for all users. Private key encrypted with a user's pin that is not known to us, and encrypted private key stored on servers. All of this happens at the user's browser. We don't don't have access to your private keys, so, can't decrypt posts on the server.
- beza1e1 15y agoDoesn't that lead to a lot of overhead? If i have a hundred friends and i broadcast a message, then the message must be encrypted a hundred times with each friend's public key.
- privachi123 15y agoYes, you are right there is overhead involved. In our tests, however, the delays didn't end up being too high for users with up to 125 friends (even on mobile devices). Delays will be worse beyond that, but will have ways around it if it comes down to it. Will be a good problem to have :)
- michaelchisari 15y agoUntil a user provides their pin, and you decrypt their private key. Then you have the private key, although you may choose not to remember it. This doesn't solve the privacy issues such as with Facebook and other centralized servers, where you distrust the host as much as hackers or other users. EDIT: You may want to read this: http://wiki.appleseedproject.org/doku.php?id=future:encryption:client-side_encryption http://wiki.appleseedproject.org/doku.php?id=future:encrypti...
- privachi123 15y agoThe decryption of private key happens in the user's browser, not on the server. We still don't know user's decrypted private key on the server. Thanks for the link.
- michaelchisari 15y agoSo you're doing the data encryption/decryption through a browser plugin, then? Is the source available? If it occurs in the browser, why are the (encrypted) private keys stored on the server? Why not store them in the browser?
- privachi123 15y agoNope. No plugin involved. Encryption/decryption carried out in JS. Storing it on a particular browser will limit user's access to the service from any other browser :)
- michaelchisari 15y agoHmmm, again, that assumes trust of the host serving up the Javascript. I know it may seem nit-picky, but it's not a concern that can be easily dismissed.
- yid 15y agoAt some point, you're going to have to trust software that someone else has written. I understand that you see Appleseed as the solution, but it really doesn't solve the problem of 99% of users downloading a binary that they blindly run. When you're at that level, a Javascript file is as transparent (if not more) than an Appleseed binary.
- drdaeman 15y agoNate Lawson on in-browser JS crypto: http://rdist.root.org/2010/11/29/final-post-on-javascript-crypto/ http://rdist.root.org/2010/11/29/final-post-on-javascript-cr... For example, you (or any powerful-enough third party,as you don't even have HTTPS), could anytime throw in any malicious JS code to get whatever data he wants. And, given that PIN is limited to 4 digits, it's not a protection at all, just a snake oil.
- toyg 15y agoI'm quite interested in the concept, but it looks like your site has been "hackernewsed".
- privachi123 15y agoEh? Not sure I understand :(