7 ms·

'Hush,' anonymous messaging app from developers in Myanmar

90 points by ngamau 12y ago

dheera 12y ago
Great idea, but I don't get why they are based in Myanmar. This is almost asking for trouble from authorities. For something whose direct purpose and sales pitch is to do something that an authoritarian government is against, I would have based the entire company outside the country.
- ngamau 12y ago
  Because they are Burmese? They did register the company in Singapore, according to the article. Also, the government isn't exactly authoritarian anymore (we all hope). Nevertheless, it does seem risky.
- knd775 12y ago
  Exactly what I was wondering. What is registering the company in Singapore going to do when the police/military/whoever come to your door?
  - swanhtet1992 12y ago
    Our country is somehow moving to a little good side, we don't really have to worry about the govt (at least for now 😁).
    - notahacker 12y ago
      Do you think most of your users are outside Burma? Your website seems to be advertising the app in English and Chinese but not Burmese?
      - swanhtet1992 12y ago
        Which site are you referring to? If it is www.letshush.com, it is in English and Burmese.
        notahacker 12y ago
        The article links to a Facebook page for imhush.com which also appears to be a social network. Looks like it could be their mistake, unless you are also launching a different app with public identities.
        swanhtet1992 12y ago
        Oh, thanks for the info. Our facebook page is fb.com/letshush.
  - DominikD 12y ago
    It's a start if you don't have funds to physical move to a different country. Besides it's 2015, Saffron Revolution pretty much ended around 2008, with new constitution and all. It's not Burma you know from 2008 Rambo. ;)
- swanhtet1992 12y ago
  Hello everyone, first of all thank you so much. Yes, it is because all of us are Burmese.
  - ma2rten 12y ago
    Did you guys study abroad or how did you learn the technical skills to build app like this?
    - swanhtet1992 12y ago
      Most of us have never been to foreign countries. We graduated from Burmese Universities. (Only the CEO of the company studied in Singapore for about 3 years.)
zmanian 12y ago
It would be awesome to see more technical discussion of the anonymity mechanism. How do you ensure that users accounts are not linked Personally Identifying Information? We've seen that when folks implement weak anonymity technologies, disaster quickly ensues.
- StavrosK 12y ago
  From the little detail in the article, I gather that they don't, which is pretty bad in the context of the article.
- swanhtet1992 12y ago
  Hi, great point. Currently, users have to use their phone numbers to login. However, user's phone number is encrypted in the db. To ensure that everyone's comfortable with it, we're adding a new feature which doesn't require the user to login.
  - zmanian 12y ago
    The minimum I would consider responsible is 1. Use a hashcash style proof of work mechanism to register account. The server send a challenge and have the client compute a nonce under the difficulty. This could be turned to take an average of seconds to minutes on your median users device. This isn't a long term solution because eventually an attacker will realize that they can use more powerful machines to create sybils and abuse your network. I'm actively working on alternatives ATM. 2. Embed Tor. The Guardian Project folks will be able to give advice on embedding a tor proxy in your app. There is documentation online as well. Chatsecure has done this. This would reduce the amount of information you have in your possession for authorities to seize. This would not protect your user base if authorities compel you to ship a malicious software update. 3. Also use SSL and pin your public key for your SSL cert
    - 13 12y ago
      Hashcash is broken for any situation like this. The amount of hashcash time needed to thwart spam is higher than any user is willing to wait for, doing proof of work on a phone. Plus, spammers normally have their own Cloud Computing to resort to, and it's cheaper than Amazon AWS. https://en.wikipedia.org/wiki/Botnet https://en.wikipedia.org/wiki/Botnet
UserRights 12y ago
How can the source be checked if it is really anon?
aw3c2 12y ago
Please update the title to "This new messaging app from developers in Myanmar is kind of revolutionary", the submitted site uses that now. The original was very misleading.
- ngamau 12y ago
  You can update a title? I didn't realize that was possible.
  - aw3c2 12y ago
    Sorry, I forgot "dear mods" :)
johnbenwoo 12y ago
For those intrigued by the state of tech in Myanmar, there was a very interesting a16z podcast about it - http://a16z.com/2014/12/09/a16z-podcast-technology-and-the-opening-of-myanmar/ http://a16z.com/2014/12/09/a16z-podcast-technology-and-the-o... .
ape4 12y ago
I got autostart video and audio ads that you can't pause :( And they repeat.
- yemyat91 12y ago
  Hey, I think you downloaded the wrong app. The article somehow is linked to a wrong website. Our website is http://letshush.com http://letshush.com
  - ape4 12y ago
    It was on the globalpost.com site - ie the article.
higherpurpose 12y ago
So is this like some sort of Secretly and Tinder mix? So then it's not anonymous, only pseudonymous.
- drdaeman 12y ago
  IIRC, those are "partially weakly anonymous". There are no pseudonyms in Secretly for the "main" posts - they are anonymous, even though the anonymity isn't even remotely strong. Machine-generated pseudonyms (identicons) are used only for discussion comments there -- don't know about Hush, though. Either way, there's nothing revolutionary about this sort of apps, but marketing statements. Anonymous BBSes are there for decades, and this app has exactly the same concept except for being a mobile app instead of a website or desktop one. The only relatively novel part here is location-awareness.
rdl 12y ago
This is amazing (that someone is doing this). If there's anything the global tech community can do to help this team, I suspect it would be freely available -- anything to make Myanmar people better able to communicate safely is a huge win.
zupreme 12y ago
I clicked through to this thinking, for some reason, that this was a new messaging app released by Anonymous (the activist group), and got confused for a second when I saw the picture of the girl, unmasked and not anonymous in the slightest. Now that I've re-read the article in proper context, it's raises some interesting ideas. What is currently the closest to an "anonymous" messaging app, and is it even feasible? In theory, in order to have a basis for a conversation there must be some relationship established, either based on a shared membership in a group, familiarity in the online or offline world, etc. A truly "anonymous" messaging app would have to be more of a chatroom or random "matchmaking" service based on some type of logic, but I don't know if that would actually get traction. Alternatively an app that is pseudonymous (wherein identities are anonymous to the provider of the platform, but wherein members can either share or hide their identities from each other at will) seems to already have been accomplished many times over, dating all the way back to Myspace. Thoughts?

90 points by ngamau 12y ago

Great idea, but I don't get why they are based in Myanmar. This is almost asking for trouble from authorities. For something whose direct purpose and sales pitch is to do something that an authoritarian government is against, I would have based the entire company outside the country.

ngamau 12y ago
Because they are Burmese? They did register the company in Singapore, according to the article. Also, the government isn't exactly authoritarian anymore (we all hope). Nevertheless, it does seem risky.
knd775 12y ago
Exactly what I was wondering. What is registering the company in Singapore going to do when the police/military/whoever come to your door?
- swanhtet1992 12y ago
  Our country is somehow moving to a little good side, we don't really have to worry about the govt (at least for now 😁).
  - notahacker 12y ago
    Do you think most of your users are outside Burma? Your website seems to be advertising the app in English and Chinese but not Burmese?
    - swanhtet1992 12y ago
      Which site are you referring to? If it is www.letshush.com, it is in English and Burmese.
      - notahacker 12y ago
        The article links to a Facebook page for imhush.com which also appears to be a social network. Looks like it could be their mistake, unless you are also launching a different app with public identities.
      - swanhtet1992 12y ago
        Oh, thanks for the info. Our facebook page is fb.com/letshush.
- DominikD 12y ago
  It's a start if you don't have funds to physical move to a different country. Besides it's 2015, Saffron Revolution pretty much ended around 2008, with new constitution and all. It's not Burma you know from 2008 Rambo. ;)
swanhtet1992 12y ago
Hello everyone, first of all thank you so much. Yes, it is because all of us are Burmese.
- ma2rten 12y ago
  Did you guys study abroad or how did you learn the technical skills to build app like this?
  - swanhtet1992 12y ago
    Most of us have never been to foreign countries. We graduated from Burmese Universities. (Only the CEO of the company studied in Singapore for about 3 years.)

zmanian 12y ago

It would be awesome to see more technical discussion of the anonymity mechanism. How do you ensure that users accounts are not linked Personally Identifying Information? We've seen that when folks implement weak anonymity technologies, disaster quickly ensues.

StavrosK 12y ago
From the little detail in the article, I gather that they don't, which is pretty bad in the context of the article.
swanhtet1992 12y ago
Hi, great point. Currently, users have to use their phone numbers to login. However, user's phone number is encrypted in the db. To ensure that everyone's comfortable with it, we're adding a new feature which doesn't require the user to login.
- zmanian 12y ago
  The minimum I would consider responsible is 1. Use a hashcash style proof of work mechanism to register account. The server send a challenge and have the client compute a nonce under the difficulty. This could be turned to take an average of seconds to minutes on your median users device. This isn't a long term solution because eventually an attacker will realize that they can use more powerful machines to create sybils and abuse your network. I'm actively working on alternatives ATM. 2. Embed Tor. The Guardian Project folks will be able to give advice on embedding a tor proxy in your app. There is documentation online as well. Chatsecure has done this. This would reduce the amount of information you have in your possession for authorities to seize. This would not protect your user base if authorities compel you to ship a malicious software update. 3. Also use SSL and pin your public key for your SSL cert
  - 13 12y ago
    Hashcash is broken for any situation like this. The amount of hashcash time needed to thwart spam is higher than any user is willing to wait for, doing proof of work on a phone. Plus, spammers normally have their own Cloud Computing to resort to, and it's cheaper than Amazon AWS. https://en.wikipedia.org/wiki/Botnet https://en.wikipedia.org/wiki/Botnet

UserRights 12y ago

How can the source be checked if it is really anon?

aw3c2 12y ago

Please update the title to "This new messaging app from developers in Myanmar is kind of revolutionary", the submitted site uses that now. The original was very misleading.

ngamau 12y ago
You can update a title? I didn't realize that was possible.
- aw3c2 12y ago
  Sorry, I forgot "dear mods" :)

johnbenwoo 12y ago

For those intrigued by the state of tech in Myanmar, there was a very interesting a16z podcast about it - http://a16z.com/2014/12/09/a16z-podcast-technology-and-the-opening-of-myanmar/ http://a16z.com/2014/12/09/a16z-podcast-technology-and-the-o... .

ape4 12y ago

I got autostart video and audio ads that you can't pause :( And they repeat.

yemyat91 12y ago
Hey, I think you downloaded the wrong app. The article somehow is linked to a wrong website. Our website is http://letshush.com http://letshush.com
- ape4 12y ago
  It was on the globalpost.com site - ie the article.

higherpurpose 12y ago

So is this like some sort of Secretly and Tinder mix? So then it's not anonymous, only pseudonymous.

drdaeman 12y ago
IIRC, those are "partially weakly anonymous". There are no pseudonyms in Secretly for the "main" posts - they are anonymous, even though the anonymity isn't even remotely strong. Machine-generated pseudonyms (identicons) are used only for discussion comments there -- don't know about Hush, though. Either way, there's nothing revolutionary about this sort of apps, but marketing statements. Anonymous BBSes are there for decades, and this app has exactly the same concept except for being a mobile app instead of a website or desktop one. The only relatively novel part here is location-awareness.

rdl 12y ago

This is amazing (that someone is doing this). If there's anything the global tech community can do to help this team, I suspect it would be freely available -- anything to make Myanmar people better able to communicate safely is a huge win.

zupreme 12y ago

I clicked through to this thinking, for some reason, that this was a new messaging app released by Anonymous (the activist group), and got confused for a second when I saw the picture of the girl, unmasked and not anonymous in the slightest. Now that I've re-read the article in proper context, it's raises some interesting ideas. What is currently the closest to an "anonymous" messaging app, and is it even feasible? In theory, in order to have a basis for a conversation there must be some relationship established, either based on a shared membership in a group, familiarity in the online or offline world, etc. A truly "anonymous" messaging app would have to be more of a chatroom or random "matchmaking" service based on some type of logic, but I don't know if that would actually get traction. Alternatively an app that is pseudonymous (wherein identities are anonymous to the provider of the platform, but wherein members can either share or hide their identities from each other at will) seems to already have been accomplished many times over, dating all the way back to Myspace. Thoughts?