4 ms·
The minimum I would consider responsible is 1. Use a hashcash style proof of work mechanism to register account. The server send a challenge and have the clien
by zmanian 11y ago
The minimum I would consider responsible is
1. Use a hashcash style proof of work mechanism to register account. The server send a challenge and have the client compute a nonce under the difficulty. This could be turned to take an average of seconds to minutes on your median users device.
This isn't a long term solution because eventually an attacker will realize that they can use more powerful machines to create sybils and abuse your network.
I'm actively working on alternatives ATM.
2. Embed Tor. The Guardian Project folks will be able to give advice on embedding a tor proxy in your app. There is documentation online as well. Chatsecure has done this.
This would reduce the amount of information you have in your possession for authorities to seize.
This would not protect your user base if authorities compel you to ship a malicious software update.
3. Also use SSL and pin your public key for your SSL cert
- 13 11y agoHashcash is broken for any situation like this. The amount of hashcash time needed to thwart spam is higher than any user is willing to wait for, doing proof of work on a phone. Plus, spammers normally have their own Cloud Computing to resort to, and it's cheaper than Amazon AWS. https://en.wikipedia.org/wiki/Botnet https://en.wikipedia.org/wiki/Botnet
- zmanian 11y agoJust proposed as interim solution that is easy to implement and escapes the PII collection model. Blind signed auth tokens are way better but much more resource intensive to implement
- patcon 11y agoInteresting observation. I wonder if you could hide this work behind an approval period, much like waiting for a beta invite. When framed like this, it just builds anticipation, and the users doesn't necessarily need to know. But of course, this would most obviously involve a client-side component with access to system resources. Workable for a native android app, but perhaps not for desktop/browser...