4 ms·

Is author new at the whole web thing? Yes, people trust remote web servers. Yes, if you link multiple apps to an identity server (be it atproto, google, or self

by theamk 4mo ago

Is author new at the whole web thing? Yes, people trust remote web servers. Yes, if you link multiple apps to an identity server (be it atproto, google, or self-hosted OpenID server), and your identity server is compromised, attacker will be able to impersonate you or lock you out. This is just how the web works, and there is no easy around it without losing features people care about. Sure, you can do client-side encryption and pretend serve can't see the plaintext, but it's just a theatre, see Hushmail incident for example. And having people export uber-key by default is pretty terrible idea. Sure, allow advanced users (like post author) to do it. But for the common person, the exported key is just another way to get account compromised, via malware or backup provider hacking. Or if they are not backing up stuff, then the key will get lost next time they upgrade.

logifail 4mo ago
> This is just how the web works, and there is no easy around it without losing features people care about [...] Well, apart from using a separate email address for every single "provider"? (Spoiler: there's no way I'm going to sign into your service with a shared email ... you get <youservice>@<me>.com)
- ranger_danger 4mo ago
  Some services only allow signups from the big free providers like gmail/outlook/etc. because those providers are doing more consistent KYC and anti-spam measures than anyone else by far, and unfortunately it does cut down on the amount of spam by a lot. For most people nowadays you cannot even create a new gmail account without directly linking it to a mobile phone.
Aurornis 4mo ago
> Sure, you can do client-side encryption and pretend serve can't see the plaintext, but it's just a theatre, Keeping a private keep on the client to sign your activity is a fundamental cryptography practice. If you use a private key to sign your emails or git commits, it’s not security theater. If you were to have to upload your private key to GitHub or your email provider, that would be severity theater. > Is author new at the whole web thing? Unnecessarily mean comment.
- theamk 4mo ago
  The key word is "web", and all associated ecosystem - the place where local devices are transient, and everything is in the cloud. I personally have multiple regular PCs, sync the files around, do encrypted backups, and so on. I still have my files from 20 years ago, and I manage my personal keys. But when I talk to other people, most people aren't like that! They don't do regular backups, they lose files all the time (phone broke -> files are gone), and when they transfer files, they do it via 3rd party, by emailing, dropboxing or uploading to Google Drive. So how would they handle "private key"? Most of then will never download the app, and will only use the website. I guess you can use browser web storage to store the key, but next time they run out of space and clear internet files, it would be gone. Or if their phone breaks. Or if the computer starts to behave strangely, so they wipe it all (not exaggerating, I've seen people do that). So keeping the key only in the browser is a terrible idea. You can force them to download private key, but then what? Most people will simply forget it (after all, "I am just trying out this thing, no need to both with all the complex backups"), and the key will sit in Download folder until the PC/phone breaks. If you got lucky, they'll upload this to Google Drive/iCloud, so that megacrop will have a private key. But the worst of all, even if you somehow magically get them to preserve the private key, it's useless. Remember, we are talking rogue operator here, and those are very likely the same people who are serving you the webpage and javascript blob that will obtain the key from local storage and decrypt. They will do the same thing hushmail did, which is to modify the webpage so it exfiltrates the private key. (And yes, all of this can be worked around if you don't use web, and run the stuff locally. But this severely restricts users, and will kill the adoption)
tarpitt 4mo ago
Are you new to the whole p2p thing? This is a terrible standard to hold new technology to. The web is broken. https://secushare.org/broken-internet https://secushare.org/broken-internet
- theamk 4mo ago
  Yes, I am familiar with multiple solution that want to replace the web. They can solve all sorts of interesting problems, except one: how to get adoption. I have nothing against people exploring alternative networking systems, but let's be clear: the only reason to run GNUnet (or Nostr, or SSB) is if you are interested in GNUnet/Nostr/SSB itself, or if you want to add exclusivity and wall your garden away from random visitors. But many people have the opposite goal - they want their content to be accessible, and they want everyone to be able to participate, even if they are a high school student with 10 year old iPhone. And this means web. So let's talk about how we can actually reach people, and this means figuring out how to get this web thing to work.

by theamk 4mo ago

logifail 4mo ago

> This is just how the web works, and there is no easy around it without losing features people care about [...] Well, apart from using a separate email address for every single "provider"? (Spoiler: there's no way I'm going to sign into your service with a shared email ... you get <youservice>@<me>.com)

ranger_danger 4mo ago
Some services only allow signups from the big free providers like gmail/outlook/etc. because those providers are doing more consistent KYC and anti-spam measures than anyone else by far, and unfortunately it does cut down on the amount of spam by a lot. For most people nowadays you cannot even create a new gmail account without directly linking it to a mobile phone.

Aurornis 4mo ago

> Sure, you can do client-side encryption and pretend serve can't see the plaintext, but it's just a theatre, Keeping a private keep on the client to sign your activity is a fundamental cryptography practice. If you use a private key to sign your emails or git commits, it’s not security theater. If you were to have to upload your private key to GitHub or your email provider, that would be severity theater. > Is author new at the whole web thing? Unnecessarily mean comment.

theamk 4mo ago
The key word is "web", and all associated ecosystem - the place where local devices are transient, and everything is in the cloud. I personally have multiple regular PCs, sync the files around, do encrypted backups, and so on. I still have my files from 20 years ago, and I manage my personal keys. But when I talk to other people, most people aren't like that! They don't do regular backups, they lose files all the time (phone broke -> files are gone), and when they transfer files, they do it via 3rd party, by emailing, dropboxing or uploading to Google Drive. So how would they handle "private key"? Most of then will never download the app, and will only use the website. I guess you can use browser web storage to store the key, but next time they run out of space and clear internet files, it would be gone. Or if their phone breaks. Or if the computer starts to behave strangely, so they wipe it all (not exaggerating, I've seen people do that). So keeping the key only in the browser is a terrible idea. You can force them to download private key, but then what? Most people will simply forget it (after all, "I am just trying out this thing, no need to both with all the complex backups"), and the key will sit in Download folder until the PC/phone breaks. If you got lucky, they'll upload this to Google Drive/iCloud, so that megacrop will have a private key. But the worst of all, even if you somehow magically get them to preserve the private key, it's useless. Remember, we are talking rogue operator here, and those are very likely the same people who are serving you the webpage and javascript blob that will obtain the key from local storage and decrypt. They will do the same thing hushmail did, which is to modify the webpage so it exfiltrates the private key. (And yes, all of this can be worked around if you don't use web, and run the stuff locally. But this severely restricts users, and will kill the adoption)

tarpitt 4mo ago

Are you new to the whole p2p thing? This is a terrible standard to hold new technology to. The web is broken. https://secushare.org/broken-internet https://secushare.org/broken-internet

theamk 4mo ago
Yes, I am familiar with multiple solution that want to replace the web. They can solve all sorts of interesting problems, except one: how to get adoption. I have nothing against people exploring alternative networking systems, but let's be clear: the only reason to run GNUnet (or Nostr, or SSB) is if you are interested in GNUnet/Nostr/SSB itself, or if you want to add exclusivity and wall your garden away from random visitors. But many people have the opposite goal - they want their content to be accessible, and they want everyone to be able to participate, even if they are a high school student with 10 year old iPhone. And this means web. So let's talk about how we can actually reach people, and this means figuring out how to get this web thing to work.