5 ms·
Show HN: Faceless – Open-source version of Secret
- sarciszewski 12y agoI like that you made this open source. I'll reserve criticism for GitHub issues / pull requests, but overall I applaud your efforts. :D
- marco1 12y agoThank you! That's great, criticism is probably most durable and helpful on GitHub, anyway :)
- tabrischen 12y agoInteresting concept of pseudonymity. If your friend only has one or a few friends, there's a pretty good chance that they'll the identify of the poster. In generally, I love the call to 'Enjoy openness and kindness'. We can definitely benefit from more of that :)
- marco1 12y agoThanks! I hope this open-source project can help so that we all benefit from such openness. And I'm convinced that such software should not be closed-source and in the need for a business model.
- marco1 12y agoBy the way, to address the problem of guessing your friends' identity: I know this is a critical point in the system and thus I added something to prevent that guessing, of course. However, it's a dirty fix, as it may introduce new issues (but of course that may be improved soon): When address books are synced with the friend lists in the app, those "friend" connections are always reciprocal. So even if you have only one single person in your address book, and you're seeing posts from friends in the app, you don't know if that's the person in your address book or any of your friends who has started using the app as well. Someone that you don't want to hear from may add your phone number to their contacts, but you may block any user inside of the app and this blocking is persistent.
- marco1 12y agoAuthor here -- feel free to share your criticism and questions :)
- deleted 12y ago[deleted]
- marco1 12y agoDone :)
- deleted 12y ago[deleted]
- vdaniuk 12y agoFirst of all, good job. Secondly, do you have any plans to put the project to practical use? Or is it a research/tinkering project?
- marco1 12y agoThank you :) First and foremost, this has indeed been a tinkering project. But now, I think there may be enough potential to put this to a good use. Did you think of anything specific when you referred to "practical use"? Actually, the app is live on Google Play and this may already provide some practical help to users.
- NoahTheDuke 12y agoI can't install it on my Nexus 7 tablet. Maybe because it expects a phone?
- marco1 12y agoExactly. Sorry, should have mentioned that. I wasn't really sure how to handle this. The problem is that (a) the app is optimized for phones and (b) it has to ask the user to enter their phone number manually if the device has no telephony features and (c) it can run on a single device only. I wanted to prevent users from the confusion that arises when they have the app on their phone already, install it on their tablet as well and then see that it stops working on the phone.
- Hortinstein 12y agothanks for putting this out here, I will use this as a resource for a project I was planning on getting started on. I am excited to play around with it. Do you have any screenshots of the android application you could put on the github or an imgur link. Thanks!
- marco1 12y agoThanks! On the GitHub page, there is a link to the app in Google Play [1] and this is where the screenshots can be found. I'm quite sure the app is not really beautiful (yet), so it was an intentional decision not to put up screenshots on the GitHub page which would impair the first impression ;) [1] https://play.google.com/store/apps/details?id=im.delight.faceless https://play.google.com/store/apps/details?id=im.delight.fac...
- Hortinstein 12y agogreat one more question, on my rough inspection it looks like the encrypted text and the key is stored in the same database entry. pardon my lack of knowledge, but this seems insecure. Can you explain your decision?
- marco1 12y agoThere is a server secret that is not stored in the database at all and there is a message secret (unique per message) that is stored in each message's database entry. They are combined to the actual key for decryption.
- Hortinstein 12y agooh okay, thank you very much!
- arasmussen 12y agoWhy PHP? I would argue that in this day and age, that is a bad decision. There are simply better, lighter weight languages to use that will get you going faster and cause less problems down the road. Maybe not you personally if you're a PHP wizard, but certainly the industry in average. I'd recommend you skate to where the puck is going. :)
- arasmussen 12y agoIf you downvoted, feel free to share your opinion on why this is wrong. I could care less about the votes, I want to hear your discussion! Why would you use PHP? Here's an excerpt from a Facebook engineer explaining why we still use PHP: "The reason Facebook hasn't migrated away from PHP is because it has incumbent inertia (it's what's there) and Facebook's engineers have managed to work around many of its flaws through a combination of patches at all levels of the stack and excellent internal discipline via code convention and style - the worst attributes of the language are avoided and coding style is rigidly enforced through a fairly tight culture of code review"
- federico3 12y agoVulnerabilities in the vm only, not including libraries and frameworks: http://www.cvedetails.com/vendor/74/PHP.html http://www.cvedetails.com/vendor/74/PHP.html Feel free to compare it with other languages.
- tene 12y agoI'm curious what happened in 2007; why were there so many more vulnerabilities, especially code execution?
- eropple 12y agoI'm not a habitual PHP user, and I have perturbed many electrons on why I wouldn't use it for nontrivial projects, but I could slam out something for which I don't care about security or performance in a very short period of time. Rails, Play, etc. have some friction; Sinatra makes you reinvent a lot of wheels. You really can just fart something out in PHP very rapidly.
- dmbass 12y agoThe title makes a dubious connection between their valuation and their technology. I guess that Secret investors are not interested in the technology but rather the network of users.
- tibbon 12y agoI guess it just points out that technology != valuation. However, it also highlights that what Secret is doing isn't terribly special (nor Twitter, etc) and that they have a pretty reasonable chance of someone swooping in and taking over their market (happened with MySpace for example) at some point if the community becomes bored.
- marco1 12y agoSorry for that! I just wanted to show the connection to a quite recent event, and I actually thought that anybody who knows about Secret already knew that their value is not 100% in their technology.
- gremlinsinc 12y agoawesome would like to use this to build an app around organizing protests, flashmobs, etc...
- marco1 12y agoYou are free to do so :) It's GPLv3, as noted in the repository.
- crystaln 12y agoCurious if this takes the same pains with anonymity as Secret itself, where identities and post associations are, supposedly, opaque even to individual founders - it takes at least two to reveal the identity behind a post, and only reveals it for a single post.
- marco1 12y agoI've made this open-source so that anybody can check for security weaknesses and report/fix them. And, of course, nobody has to use the app that is already live on Google Play, but you are free to host your own version.
- sarciszewski 12y agoI've taken the liberty of doing just that. :D
- drdaeman 12y agoDidn't we learned it the hard way we can't trust anyone's claims about their services, unless it's really verifiable? There are loads of services who claim one thing, but that's either completely untrue or somehow true but filled with "if"s and "but"s. Say, Dropbox had claimed they do encrypt everything in a manner they don't have any way to access to user data, but it occurred they had just lied. Or, Secret claims they don't send phone numbers and email addresses and says nothing about names but from reverse engineering their app I found out they do for whatever reason send contact names - which, for many Google/Gmail contacts, are the same as email address - and if you use "invite" function they do send unmangled number/address (the latter's reasonable, but still it's an exception from the claim and users aren't really warned about it).
- marco1 12y agoExactly, this is why I hope this app can prove beneficial and I hope that any weaknesses are found by people checking the code. And, of course, the possible risk factors "lies" and "hidden practices" are off the table for this app. Not to forget: Services that are valued at $100M need to find a proper business model. True anonymity/pseudonymity prevents you from pursuing ideas for potential business models in many cases.
- api 12y agoThese kinds of startups really aren't tech startups. They're media startups. It's not about their technology. When Facebook bought WhatsApp they were not buying technology. That being said-- trying to replicate such thing is not a bad programming exercise.
- jmhobbs 12y agoNot at all? WhatsApp has a phenomenal engineering team from what I have read.
- timtamboy63 12y agoThey do - but Facebook didn't buy Whatsapp for the technology. They bought them for the users. If the technology was absolutely horrible, but they still had the same users, etc, it still would have been $19B
- api 12y agoI didn't say it was bad, just that it wasn't the primary asset that was acquired. Facebook could easily have built a massively cross platform mobile chat app in-house. ... and it wasn't the best, either... look up their single hard-coded AES key for example.
- marco1 12y agoFully agree. Same is true for Poke/Snapchat. And WhatsApp was also using plain HTTP for a long time.
- marco1 12y agoI agree that the technology part is not the hardest and a large part of the success or failure is marketing and media issues. But lots of startups have a lot of CRUD and I wouldn't call every technology product that isn't really pioneering a simple media product.
- mo 12y agoThere's no way to "securely encrypt" a phone number.
- marco1 12y agoOf course, you can "securely encrypt" things, and it doesn't matter if this is a phone number. But you're probably referring to the fact that the phone number is used as an identifier and is thus hashed and not encrypted. Nevertheless, it makes sense to call it "encryption" when describing the app to non-tech people and give the technical terms (i.e. hashing) in brackets etc.
- drdaeman 12y agoI'm not sure, but I suspect there's a fairly good word for such case: "mangled"
- marco1 12y agoDo you really think so? Technical descriptions always differ from "mainstream" descriptions for the end-user.
- maineldc 12y agoI am not an expert but it seems to me that hashing of phone numbers is relatively useless here because there is a relatively small search space of potential phone numbers so I can just brute force check, right?
- marco1 12y agoWell, the search space is certainly small and thus brute force becomes much easier. But I wouldn't really call this "useless". You can, of course, apply your hashing repeatedly too make brute force slower.
- Lidador 12y agoIs this post sponsored by Twilio?
- marco1 12y agoNo, why do you think so? :) Twilio is actually only a very small part of what makes the app work. It's used for the verification via SMS only, i.e. usually once per usage on a device.