10 ms·
Cwtch: Decentralized, privacy-preserving, multi-party messaging protocol
- r721 5y agoTwitter thread from a dev: https://twitter.com/SarahJamieLewis/status/1408501258852311046 https://twitter.com/SarahJamieLewis/status/14085012588523110...
- max1cc 5y agoHaven't looked in to this properly yet but already in love with the name!
- geoah 5y agoFrom their faq. > How do I pronounce Cwtch? Like "kutch", to rhyme with "butch". > Cwtch (/kʊtʃ/ - a Welsh word roughly translating to “a hug that creates a safe place”) is a decentralized, privacy-preserving, multi-party messaging protocol that can be used to build metadata resistant applications
- canadaduane 5y agoSuch an odd word. My 1-second judgment of it sent me in an entirely different direction: cthulhu, witch, crotch. I wonder if the emotional gap between cover and contents will be a problem.
- celticninja 5y agoIt is a word from the Welsh language, so it may seem weird to someone unfamiliar with the language.
- hkt 5y agoYour name couldn't be more appropriate unless it was "brythonicninja"
- Mizza 5y agoCwtch is an important word in Welsh, like hyggelig in Danish or koselig in Norwegian, etc. It's kind of a "national identity" word, you see it on tourist souvenirs.
- ljm 5y agoIt's a word from another language, what purpose would a 1 second judgment like that serve when the post you're replying to already explains that it's Welsh?
- novok 5y agoThey do need to localize the name to fit the language of people using it although. It's like Kakaotalk insisting keep all written forms of their app's name in hangul: 카카오톡, which sounds like "kakaotog" in korean. That would be a recipie for not being searchable outside of Korea. Similarly, for English, I would label it Kutch and probably make other appropriate photogenic transliterations for other languages.
- geoah 5y agoReally like the idea behind this. The basic premise is really interesting: Conversation between two people is direct p2p through tor, while groups require a server that people need to host. It's a really interesting middle ground between having to trust a single party with all your conversations and making everything truly p2p.
- sanity31415 5y agoTor isn't really P2P since messages need to go through Tor's network of routers.
- bastawhiz 5y agoThe whole internet requires that any connection traverses numerous switches and routers. Unless you're pointing a microwave antenna at the destination to deliver your packets, the distinction here is pointless.
- teorema 5y agoTo be fair to the grandparent poster, who was downvoted, in the decentralized networking community there are protocols designed to be robust to different hardware setups, like over wifi or other ad hoc systems. Depending on tor from that perspective might be seen as restrictive.
- bastawhiz 5y agoCwtch isn't made specifically for the decentralized networking community. The properties of a globally-usable, decentralized, and private system are almost entirely at odds with the constraints of decentralized networking. Making such a system robust against network partitions and latency and keeping your IP/location private while still being truly decentralized (and not federated) is an incredibly hard—and perhaps unsolved—problem.
- cortesoft 5y agoSo nothing on the internet is peer to peer, since you have to go through ISP’s network of routers?
- udia 5y agoHow does this compare with something like Matrix, which also does decentralized encrypted communications? https://matrix.org/ https://matrix.org/
- dane-pgp 5y agoI'm wondering that too, or specifically how it compares to Matrix run as a Tor hidden service, which is apparently possible: https://github.com/matrix-org/synapse/issues/2111#issuecomment-474269271 https://github.com/matrix-org/synapse/issues/2111#issuecomme...
- remram 5y agoI'm not sure if Cootch is federated, like Matrix, or peer-to-peer. I assume the first, if Tor is being used? Berry also sounds similar, although it is not released yet: https://berty.tech/ https://berty.tech/
- celticninja 5y agoIt's Cwtch, pronounced more like Cutch than Cootch Edit. Cutch was supposed to be more of a phonetic way to pronounce it as opposed to a word with a similar sound.
- some_furry 5y agoLike "clutch" without the "L"?
- celticninja 5y agoClose. This is from the homepage: How do I pronounce Cwtch? Like "kutch", to rhyme with "butch". In common use you might say "Cwtch in" to mean "snuggle in" or "cuddle in close'
- some_furry 5y agoThat is a really damn cute name
- otabdeveloper4 5y ago"Cootch"? Really?
- remram 5y agoThe competitors found that "Riot" was too controversial a name for popular adoption... good luck to "Cootch"...
- celticninja 5y agoNo, not really. It more like Kutch. They have a section as follows: How do I pronounce Cwtch? Like "kutch", to rhyme with "butch". Just scroll down the homepage
- retube 5y agoNo. It's Welsh
- sschueller 5y agoMany words have some not ideal meaning in another language. We (Switzerland) have cities with names that in other languages mean male genitalia yet we are not going to rename them.
- giantrobot 5y agoThe township of Dickcöcknbahls is not going to abandon their proud heritage due to prudish Anglophones!
- vr46 5y agoNo, not really. It's Welsh for "Hug".
- sneak 5y agoAndroid and desktop only, so most people I know won't be able to use it on the only device they message on.
- some_furry 5y agoIf you're speaking about iOS, the dev just tweeted this: https://twitter.com/SarahJamieLewis/status/1408857316087058432 https://twitter.com/SarahJamieLewis/status/14088573160870584... > The answer to why is there no Mac/iOS version of Cwtch / why does Cwtch not have feature X is that last year we raised only a fraction of our donation target. You can help change that! > @OpenPriv is powered by hundreds of individual donors just like you! > https://openprivacy.ca/donate/ https://openprivacy.ca/donate/
- sneak 5y agoThey are competing with Signal (and also every other insecure messenger like WhatsApp and Telegram), and Signal already exists. Cross-platform support is table stakes for a messenger. This will likely go the way of Ricochet.
- brutal_chaos_ 5y agoDecentralized vs Centralized is the competition. Cross platform is a goal, but, I believe, user privacy comes first for Cwtch.
- snowwrestler 5y agoThe status of Cwtch right now is probably more analogous to Moxie’s work on Axolotl before he launched Signal: a boundary-pushing messaging protocol that looks promising but is not yet widely deployed.
- mindstab 5y agoMaybe talk to Apple, whom have made it increasingly hard to theoretically impossible for our type of privacy preserving app to run on iOS. We aren't the first, and Brair has been around a bit longer and has run into the same problem. https://briarproject.org/news/2018-1.0-released-new-funding/ https://briarproject.org/news/2018-1.0-released-new-funding/ https://code.briarproject.org/briar/briar/-/issues/445 https://code.briarproject.org/briar/briar/-/issues/445 As an even smaller team with less funding, we have so far decided it would be irresponsible to risk sinking a sizable portion of our limited funds into trying to port to iOS when it may be impossible. But if you really want it, please, donate, we need iphones, macs, dev accounts and budget for the research and work!
- some_furry 5y agoFirst impression: I created an account on desktop and on mobile. I used the same display name and password in both cases. I got two different addresses. Good. I don't see any means to copy an identity across the boundary (e.g. with Telegram, I can participate in the same conversation as the same identity from multiple devices). Which means one of two things happens: 1. Users are encouraged to use on dedicated device for all private communications. 2. If users want multi-device, they have to leak facts about their setup (one public key per device) to the people they're talking to. (This isn't a criticism; I'm just observing the user experience.)
- SavantIdiot 5y agoWait, why do we dislike Signal? I'm always late to the secure comm party... EDIT: Got it, Cwtch is decentralized p2p, Signal ain't. Thanks!
- MarcelProust 5y agoSignal requires a phone number for contact discovery, which many people have given out about because it's tied to your meatspace identity, so it's harder to be anonymous with Signal.
- ludamad 5y agoSignal is encrypted and likes to show off how little they store, but it is not decentralized. Not being decentralized has many advantages, but a paranoid enough approach does see it as a point of failure for security (I use and love Signal, fyi)
- drdaeman 5y agoMy understanding is that Signal is centralized, and this is not. That's an important difference.
- lucb1e 5y agoNot merely centralized, but also openly hostile to decentralization. Going so far as to hold talks about why decentralization is a bad thing for a chat app. I also never heard a rebuttal to this claim of Wire's: > Moxie et al have publicly stated that they want wide adoption of the Axolotl [Signal] protocol — but if you do an independent implementation, using the published reference documentation and background knowledge from having seen their code online, you can be accused of copyright infringement and asked to pay a “license fee.” Or that fiasco with integrating a shitcoin in the application: https://www.stephendiehl.com/blog/signal.html https://www.stephendiehl.com/blog/signal.html I'm on Signal because of the network effect and its reliability, and I actively invite people to use it over things like Telegram, but I do wish we had a better alternative. Matrix (Element) is buggy, Threema people need to pay for, Jami and this Tor-based chat app (I forget the name) don't have the features people expect, Wire is a good contestant but also not decentralized (nor does it have fancy things like sealed sender), and of course nobody has the network effect that Signal has... no good alternatives.
- anotheryou 5y agoCan it handle multiple devices of the same account?
- detaro 5y agoAccording to the FAQ on the linked page, not yet.
- anotheryou 5y agothanks! It's where telegram won over signal for me for a long time. It's still not perfect, but ok now :)
- kgraves 5y agoWhy do we need decentralisation in a chat app?
- opan 5y agoMore robust. You can use P2P stuff offline in a disaster scenario. The entire thing will never be down for maintenance or from an error. I haven't yet familiarized myself with this particular protocol, I have something like Briar in mind when it comes to P2P chat.
- blooalien 5y agoWhy do we need decentralization in any app? Short answer; When done well, it makes the app more resilient against a variety of issues/risks that arise from relying on a server/service/single-point-of-failure.
- julienreszka 5y agodamn I can't even imagine the level of autism of those who decided that cwtch is an ok name, interesting product tho
- noxer 5y agoCrashed with no message within the first 30 seconds clicking around on the UI (windows build) I'll try again in a year or so if it still exists.
- 627467 5y agoSo... Why does Alice and Bob need to be online to be able to communicate? Can't Alice place a message in a outbox while waiting for Bob to be online? Also, couldn't we avoid having a server for group chat based on same idea (cache messages in outbox until other parties come online?)
- cristoperb 5y agoThe outbox has to exist somewhere. Instead of a central server like the group chat you could use some sort of distributed storage... but then some node(s) need to be online at all times to deliver asynchronous messages.
- 627467 5y agoI supposed I'm (and you seem to be) implying that in the scenario of a group made up of A, B and C, if A and C are online when A sends a message (and then A goes offline) then B can receive A's message forwarded by C. We wouldn't need a server in this case, would we?
- conradev 5y agoI do want to point out that it is possible to use a central server while keeping metadata private if you use noise
- ebb_earl_co 5y agoHow do you mean? Could you link to where you could find that? Because I searched for 'metadata' in the Noise Protocol repository and came up with nothing (https://github.com/noiseprotocol/noise_wiki/search?q=metadata https://github.com/noiseprotocol/noise_wiki/search?q=metadat...) N.b. I am very much an amateur and am fascinated by private communication methods
- conradev 5y agoThe Noise Protocol is a specific project, that, funnily enough, doesn’t include generating noise. I believe the name is intended to mean that the messages look like noise. Here are some protocols that use noise (specifically differentially private noise): https://vuvuzela.io/research https://vuvuzela.io/research https://people.csail.mit.edu/nickolai/papers/tyagi-stadium-eprint.pdf https://people.csail.mit.edu/nickolai/papers/tyagi-stadium-e...
- conradev 5y agoOne thing I realized with this is that there are multiple levels of metadata privacy: 1. Messaging provider cannot see which accounts message each other 2. ISP cannot see which IP addresses message each other Using Tor here gets you both 1 and 2, but at the cost of latency: it is something like 6 hops to rendezvous with a hidden service. WebRTC (assuming Tor as a TURN fallback) would be a lot faster, but would not include 2.