7 ms·

Show HN: So.ciety, an end-to-end encrypted social network

44 points by dutchbrit 12y ago

dutchbrit 12y ago
Quick note, this is currently a proof-of-concept (work in progress).
inovica 12y ago
Looks quite interesting. What did you create this with? I think you should have a better intro and maybe some video or something to outline what it is without people needing to log in
- dutchbrit 12y ago
  AngularJS, Express, Socket.io & MongoDB. However, I'm considering switching over to Postgres. Encryption wise, I'm using CryptoJS for AES256 and OpenPGP.js for PGP. All messages get encrypted in AES256 with a randomly created passphrase. The passphrase is then distributed to the recipients using PGP.
  - Xeoncross 12y ago
    If it's a single server then PostgreSQL would certainly give the best performance considering how invasive MongoDB is. However, I'm sure you'll soon grow to multiple servers so that wouldn't be as big of a problem. Keep MongoDB on it's own server.
- eclipse31 12y ago
  I agree, a better intro, or a link to/picture of a sample profile would be nice. I hate having to sign up for things before I can see what I'm getting myself into. Other than that, nice idea.
AdmiralAsshat 12y ago
Might be cool for some technical discussion forms between other security-conscious, although as far as practical value goes, I'd probably have about as much luck getting my friends to use it as using PGP...
tptacek 12y ago
As drily as I can, given the rules of Show HN, but it's not end-to-end if the crypto is delivered over browser Javascript. Every time a user's browser touches your server for any reason, the server has the option to fatally compromise security. End-to-end means you don't have to trust the server; that's real privacy. So, given that this is a proof-of-concept, my advice is to back off on the web app part of this, and develop an installable client.
- rubbingalcohol 12y ago
  tptacek is right. In order to trust your crypto we have to trust that your server isn't compromising your crypto via malicious JavaScript, so when you claim that we don't have to trust the server, you're asking us to both trust and not trust the server. You could do a Chrome extension with all the frontend code baked into the extension's static JavaScript. Firefox still has no sandboxing for add-ons, so you wouldn't have luck there. Desktop / installed apps would be the way to go. See https://turtl.it https://turtl.it for an example of this (shameless plug)
  - nhayden 12y ago
    I wonder if it'd be possible to sign the JS a site serves you, so you know it's unchanged from when you originally got it?
    - nunyabuizness 12y ago
      You can sign it, but then your clients would have to install an extension to verify it.
      - handsomeransoms 12y ago
        I think it's theoretically possible to use Service Workers to do this, giving you a TOFU trust guarantee, although I think there are some issues due to the spec-mandated auto-updating of Service Workers every 24 hours.
- 12y ago
djb_hackernews 12y ago
Your bitcoin plea breaks the back button. Not cool.
- dutchbrit 12y ago
  Yikes, I didn't know that (will remove the link on it)
nhayden 12y ago
I've always thought this was a good idea, glad to see someone doing it.
- dutchbrit 12y ago
  Thanks!
matthuggins 12y ago
All I see is a page that says "Do you like this concept? Please donate via Bitcoin and help me build this further: 1CietyCHJi42RR1xb1nxVkdrdsRu3PbD5s". Am I missing something?
- dutchbrit 12y ago
  Do you mean after signing up? You can post a message - when you sign up, you don't have any friends or posts, so what you're essentially seeing is the footer. I will make this more clear - thanks for bringing it up. If you can't even see the login/register part, may I ask which browser you are using?
  - oneeyedpigeon 12y ago
    I get the same, on mobile (nexus 5, kitkat). This behaviour also occurs if javascript is disabled. I'm guessing, because of the back-button-breaking, that you've implemented the redirect using javascript - correct?
    - dutchbrit 12y ago
      Strange, I haven't encountered any real issues on android yet, will try tomorrow on a virtual machine. JavaScript needs to be turned on, otherwise it will indeed show nothing content wise (angularjs)
      - oneeyedpigeon 12y ago
        Well, I've checked again and now, to be honest, it looks fine. I'm certain it didn't process the redirect earlier, and I know this isn't the most helpful bug report in the world - sorry! I'll let you know if it happens again.
        dutchbrit 12y ago
        I'll keep an eye out, maybe it was due to high traffic or something, but I can understand how confusing it must of been! Thanks for checking it out :)
deleted 12y ago
[deleted]
walshie4 12y ago
Any chance on open-sourcing this?
- dutchbrit 12y ago
  I probably will yes
palakchokshi 12y ago
Some feedback on the landing page. Please don't hijack my browser's Back button so clicking back just stays on your site. Please provide more visuals before signup especially if you claim my account might get deleted while you develop this thing. Did not sign up, did not understand exactly how you plan to keep the information secure and private from that short blurb on the landing page. Wouldn't trust you with my data.
- dutchbrit 12y ago
  Sorry about that, a redirect occurs to /login when you aren't authenticated, I will get this solved asap. Will make the homepage a bit more informative too.
Xeoncross 12y ago
Building a social network takes a lot of work. If you open source this codebase you will have people to help you build it and you will get the product launched faster. As long as we can trust you to share your code, we don't mind helping you build this and using your server as the network hub. If the server was ever taken over, only a couple days (or hours) worth of posts would be compromised before someone noticed. That is no comparison to google plus, facebook, or hacker news - even with nasty in-browser encryption.
- dutchbrit 12y ago
  The more help, the better! I will be open sourcing this ASAP, just want to iron out the biggest bugs and clean up the source (just a little) before putting it on Github. Giving access to my server however isn't something I'd really consider, without physically being next to the person.
  - Xeoncross 12y ago
    Oh, I wasn't suggesting that you give access to your server. Just that I wouldn't mind using a site hosted on your server (it has to be hosted somewhere).
GrinningFool 12y ago
Interesting POC, I'll be keeping an e ye on it. I wanted to thank you for meaningful text right there on the landing page that tells me exactly what the project is (and isn't). No needless scrolling, no giant-sized pictures that convey nothing. Just a concise description and a login box.
shazow 12y ago
Any reason why it makes sense to ask for two different passwords? If we're going to trust the Javascript, then does it make sense to derive the server-side password from the same client-side password?
subpixel 12y ago
Wow - I thought you had dropped six figures on the .ciety TLD at first glance. I couldn't figure out whether that was genius or stupid. Thankfully you didn't do that, so I don't have to figure that out.

44 points by dutchbrit 12y ago

Quick note, this is currently a proof-of-concept (work in progress).

Looks quite interesting. What did you create this with? I think you should have a better intro and maybe some video or something to outline what it is without people needing to log in

dutchbrit 12y ago
AngularJS, Express, Socket.io & MongoDB. However, I'm considering switching over to Postgres. Encryption wise, I'm using CryptoJS for AES256 and OpenPGP.js for PGP. All messages get encrypted in AES256 with a randomly created passphrase. The passphrase is then distributed to the recipients using PGP.
- Xeoncross 12y ago
  If it's a single server then PostgreSQL would certainly give the best performance considering how invasive MongoDB is. However, I'm sure you'll soon grow to multiple servers so that wouldn't be as big of a problem. Keep MongoDB on it's own server.
eclipse31 12y ago
I agree, a better intro, or a link to/picture of a sample profile would be nice. I hate having to sign up for things before I can see what I'm getting myself into. Other than that, nice idea.

AdmiralAsshat 12y ago

Might be cool for some technical discussion forms between other security-conscious, although as far as practical value goes, I'd probably have about as much luck getting my friends to use it as using PGP...

tptacek 12y ago

As drily as I can, given the rules of Show HN, but it's not end-to-end if the crypto is delivered over browser Javascript. Every time a user's browser touches your server for any reason, the server has the option to fatally compromise security. End-to-end means you don't have to trust the server; that's real privacy. So, given that this is a proof-of-concept, my advice is to back off on the web app part of this, and develop an installable client.

rubbingalcohol 12y ago
tptacek is right. In order to trust your crypto we have to trust that your server isn't compromising your crypto via malicious JavaScript, so when you claim that we don't have to trust the server, you're asking us to both trust and not trust the server. You could do a Chrome extension with all the frontend code baked into the extension's static JavaScript. Firefox still has no sandboxing for add-ons, so you wouldn't have luck there. Desktop / installed apps would be the way to go. See https://turtl.it https://turtl.it for an example of this (shameless plug)
- nhayden 12y ago
  I wonder if it'd be possible to sign the JS a site serves you, so you know it's unchanged from when you originally got it?
  - nunyabuizness 12y ago
    You can sign it, but then your clients would have to install an extension to verify it.
    - handsomeransoms 12y ago
      I think it's theoretically possible to use Service Workers to do this, giving you a TOFU trust guarantee, although I think there are some issues due to the spec-mandated auto-updating of Service Workers every 24 hours.
12y ago

djb_hackernews 12y ago

Your bitcoin plea breaks the back button. Not cool.

dutchbrit 12y ago
Yikes, I didn't know that (will remove the link on it)

nhayden 12y ago

I've always thought this was a good idea, glad to see someone doing it.

dutchbrit 12y ago
Thanks!

matthuggins 12y ago

All I see is a page that says "Do you like this concept? Please donate via Bitcoin and help me build this further: 1CietyCHJi42RR1xb1nxVkdrdsRu3PbD5s". Am I missing something?

dutchbrit 12y ago
Do you mean after signing up? You can post a message - when you sign up, you don't have any friends or posts, so what you're essentially seeing is the footer. I will make this more clear - thanks for bringing it up. If you can't even see the login/register part, may I ask which browser you are using?
- oneeyedpigeon 12y ago
  I get the same, on mobile (nexus 5, kitkat). This behaviour also occurs if javascript is disabled. I'm guessing, because of the back-button-breaking, that you've implemented the redirect using javascript - correct?
  - dutchbrit 12y ago
    Strange, I haven't encountered any real issues on android yet, will try tomorrow on a virtual machine. JavaScript needs to be turned on, otherwise it will indeed show nothing content wise (angularjs)
    - oneeyedpigeon 12y ago
      Well, I've checked again and now, to be honest, it looks fine. I'm certain it didn't process the redirect earlier, and I know this isn't the most helpful bug report in the world - sorry! I'll let you know if it happens again.
      - dutchbrit 12y ago
        I'll keep an eye out, maybe it was due to high traffic or something, but I can understand how confusing it must of been! Thanks for checking it out :)

deleted 12y ago

[deleted]

walshie4 12y ago

Any chance on open-sourcing this?

dutchbrit 12y ago
I probably will yes

palakchokshi 12y ago

Some feedback on the landing page. Please don't hijack my browser's Back button so clicking back just stays on your site. Please provide more visuals before signup especially if you claim my account might get deleted while you develop this thing. Did not sign up, did not understand exactly how you plan to keep the information secure and private from that short blurb on the landing page. Wouldn't trust you with my data.

dutchbrit 12y ago
Sorry about that, a redirect occurs to /login when you aren't authenticated, I will get this solved asap. Will make the homepage a bit more informative too.

Xeoncross 12y ago

Building a social network takes a lot of work. If you open source this codebase you will have people to help you build it and you will get the product launched faster. As long as we can trust you to share your code, we don't mind helping you build this and using your server as the network hub. If the server was ever taken over, only a couple days (or hours) worth of posts would be compromised before someone noticed. That is no comparison to google plus, facebook, or hacker news - even with nasty in-browser encryption.

dutchbrit 12y ago
The more help, the better! I will be open sourcing this ASAP, just want to iron out the biggest bugs and clean up the source (just a little) before putting it on Github. Giving access to my server however isn't something I'd really consider, without physically being next to the person.
- Xeoncross 12y ago
  Oh, I wasn't suggesting that you give access to your server. Just that I wouldn't mind using a site hosted on your server (it has to be hosted somewhere).

GrinningFool 12y ago

Interesting POC, I'll be keeping an e ye on it. I wanted to thank you for meaningful text right there on the landing page that tells me exactly what the project is (and isn't). No needless scrolling, no giant-sized pictures that convey nothing. Just a concise description and a login box.

shazow 12y ago

Any reason why it makes sense to ask for two different passwords? If we're going to trust the Javascript, then does it make sense to derive the server-side password from the same client-side password?

subpixel 12y ago

Wow - I thought you had dropped six figures on the .ciety TLD at first glance. I couldn't figure out whether that was genius or stupid. Thankfully you didn't do that, so I don't have to figure that out.