3 ms·

What did you use to implement end-to-end encryption?

asim 3y ago
There's no end to end encryption right now but it's interesting the thought immediately goes there. This is not a replacement for signal, WhatsApp, etc. It's more like an advancement on forums or replacement for Facebook groups that takes things private in the sense that it's invite only and no one outside your group can talk to you. The recent community chats product from Facebook has also foregone end to end encryption because they want to be able to centralise the tech and moderation as it's much simpler for group products. Again this is not a replacement for whatsapp, signal or related messengers.
- vitehozonage 3y ago
  Difficult to have "real connections" in a small, intimate group if you know you're being watched. Putting a 1984 telescreen in the room has a chilling effect. Without E2EE that's what you are building. Small, encrypted groups with people you know makes sense (like Signal). Large, unencrypted, open groups make sense (like reddit, facebook groups). I don't understand how you're trying to make something with parts of each, it doesnt make sense to me
  - asim 3y ago
    Do you believe slack messages are private? Or DMs on twitter? How about the content you store on Notion or Google docs. I guess what I'm saying is there's a lot of places where it doesn't matter as long as your data is stored securely and privately in a way that no one can access it and the operators are not mistreating it. At the end of the day we still need a way to ensure certain terrible content never exists on the platform which is illegal but we're also doing this because we're not happy with the state of corporate run systems at the moment. I think there's the potential for a "community interest" platform where we actually trust the people who run it and they're totally aligned in doing it for the public good. I'm still figuring out how to convey that message more broadly to people.
    - vitehozonage 3y ago
      >Do you believe slack messages are private? Or DMs on twitter? How about the content you store on Notion or Google docs. No, so I would never choose to use them for communications with my intimate small groups, and nobody should. >securely and privately You cannot do that without E2EE. There are hacks constantly, if you have any security awareness. >At the end of the day we still need a way to ensure certain terrible content never exists on the platform which is illegal E2EE is not illegal and in reasonable jurisdictions you can simply have a report function so users can report something if they see it in their groups. >totally aligned in doing it for the public good Given your posture on E2EE, you seem to have a completely different alignment than me and I would expect most hackers who tend to see the issues with mass surveillance and how difficult it is to make a secure platform. You seem to be intent on wanting people to just trust that you'll never sell the business and all the communication history, for confusing reasons
      - asim 3y ago
        > You seem to be intent on wanting people to just trust that you'll never sell the business and all the communication history, for confusing reasons I think the words "just trust" here are not right. No I don't want people to "just" trust me because I wouldn't "just" trust someone else. I think the E2E thing is important but we already have platforms that facilitate this really well. If it's technically feasible to do in a way that doesn't slow product development, sure we'd do it, but if it's going to take me months on end and it will largely hinder a lot of what we're trying to build feature wise, then it's not really worth it. I think where pure privacy on that level is important to people they really should pick signal or similar. For me, I think what's more important is, can I trust the people running this platform to host that infrastructure well, to continue to put the community first and to drive maybe an alternative path that a lot of people are about e.g self host the data part. Self hosting comes up a lot but in the context of "I want to host the whole thing", what if it was just, where the data lives. At the same time, we're really thinking consumer first and no consumer wants to host anything, they're quite happy using existing services and E2E is not the first thing they think about, it's the frictionless communication or the features of the service. In the case where the consumer really cares about E2E its because they're doing something they don't want anyone to know about. Saying all this, look if I'm putting my personal details into it, or family photos, etc. I want to know no one is going to see or touch that, but maybe it's as basic as we use AES-256 on the client side and a randomly generated secret, or we just delete the data after 30 days and that's the policy. I think there are services that really focused heavily on E2E but their goal was purely communication whereas we're sort of pushing towards doing more around community coordination.

asim 3y ago

There's no end to end encryption right now but it's interesting the thought immediately goes there. This is not a replacement for signal, WhatsApp, etc. It's more like an advancement on forums or replacement for Facebook groups that takes things private in the sense that it's invite only and no one outside your group can talk to you. The recent community chats product from Facebook has also foregone end to end encryption because they want to be able to centralise the tech and moderation as it's much simpler for group products. Again this is not a replacement for whatsapp, signal or related messengers.

vitehozonage 3y ago
Difficult to have "real connections" in a small, intimate group if you know you're being watched. Putting a 1984 telescreen in the room has a chilling effect. Without E2EE that's what you are building. Small, encrypted groups with people you know makes sense (like Signal). Large, unencrypted, open groups make sense (like reddit, facebook groups). I don't understand how you're trying to make something with parts of each, it doesnt make sense to me
- asim 3y ago
  Do you believe slack messages are private? Or DMs on twitter? How about the content you store on Notion or Google docs. I guess what I'm saying is there's a lot of places where it doesn't matter as long as your data is stored securely and privately in a way that no one can access it and the operators are not mistreating it. At the end of the day we still need a way to ensure certain terrible content never exists on the platform which is illegal but we're also doing this because we're not happy with the state of corporate run systems at the moment. I think there's the potential for a "community interest" platform where we actually trust the people who run it and they're totally aligned in doing it for the public good. I'm still figuring out how to convey that message more broadly to people.
  - vitehozonage 3y ago
    >Do you believe slack messages are private? Or DMs on twitter? How about the content you store on Notion or Google docs. No, so I would never choose to use them for communications with my intimate small groups, and nobody should. >securely and privately You cannot do that without E2EE. There are hacks constantly, if you have any security awareness. >At the end of the day we still need a way to ensure certain terrible content never exists on the platform which is illegal E2EE is not illegal and in reasonable jurisdictions you can simply have a report function so users can report something if they see it in their groups. >totally aligned in doing it for the public good Given your posture on E2EE, you seem to have a completely different alignment than me and I would expect most hackers who tend to see the issues with mass surveillance and how difficult it is to make a secure platform. You seem to be intent on wanting people to just trust that you'll never sell the business and all the communication history, for confusing reasons
    - asim 3y ago
      > You seem to be intent on wanting people to just trust that you'll never sell the business and all the communication history, for confusing reasons I think the words "just trust" here are not right. No I don't want people to "just" trust me because I wouldn't "just" trust someone else. I think the E2E thing is important but we already have platforms that facilitate this really well. If it's technically feasible to do in a way that doesn't slow product development, sure we'd do it, but if it's going to take me months on end and it will largely hinder a lot of what we're trying to build feature wise, then it's not really worth it. I think where pure privacy on that level is important to people they really should pick signal or similar. For me, I think what's more important is, can I trust the people running this platform to host that infrastructure well, to continue to put the community first and to drive maybe an alternative path that a lot of people are about e.g self host the data part. Self hosting comes up a lot but in the context of "I want to host the whole thing", what if it was just, where the data lives. At the same time, we're really thinking consumer first and no consumer wants to host anything, they're quite happy using existing services and E2E is not the first thing they think about, it's the frictionless communication or the features of the service. In the case where the consumer really cares about E2E its because they're doing something they don't want anyone to know about. Saying all this, look if I'm putting my personal details into it, or family photos, etc. I want to know no one is going to see or touch that, but maybe it's as basic as we use AES-256 on the client side and a randomly generated secret, or we just delete the data after 30 days and that's the policy. I think there are services that really focused heavily on E2E but their goal was purely communication whereas we're sort of pushing towards doing more around community coordination.