Slashdot Mirror
Encrypted Social Network Vies For Disgruntled Facebook Users
angry tapir writes "With the look of Google Plus and Facebook-like elements, a new social network named "Syme" feels as cozy as a well-worn shoe. But beneath the familiar veneer, it's quite different. Syme encrypts all content, such as status updates, photos and files, so that only people invited to a group can view it. Syme, which hosts the content on its Canada-based servers, says it can't read it. "The overarching goal of Syme is to make encryption accessible and easy to use for people who aren't geeks or aren't hackers or who aren't cryptography experts," co-founder Jonathan Hershon said in an interview about the service." See also Diaspora.
Syme—Winston's colleague at the Ministry of Truth, whom the Party "vaporised" because he remained a lucidly thinking intellectual. He was a lexicographer who developed the language and the dictionary of Newspeak, in the course of which he enjoyed destroying words, and wholeheartedly believed that Newspeak would replace Oldspeak (Standard English) by the year 2050. Although Syme's politically orthodox opinions aligned with Party doctrine, Winston noted that "He is too intelligent. He sees too clearly and speaks too plainly". After noting that Syme's name was deleted from the members list of the Chess Club, Winston infers he became an unperson who never had existed. Goldstein's book says that "Between the two branches of the Party there is a certain amount of interchange, but only so much as will ensure that weaklings are excluded from the Inner Party and that ambitious members of the Outer Party are made harmless by allowing them to rise." It is unknown whether Syme has been killed or promoted in the Inner Party in another province.
I read the article expecting it to be crap, ignore meta-data etc. What I found however was a decent article discussing that the service used open source client side crypto libraries, and they even acknowledged the meta-data problem and how it makes their service not truly private. They also mentioned how its very unlikely to go big like facebook and it summed up with some reasonable example use cases. I haven't see such a non crap article in a long time!
Except that they don't encrypt your data, you do. Probably would have helped to RTFA, huh bub? =p
It is pitch black. You are likely to be eaten by a grue.
So it's a social network that "protects your data" ... and requires Google Chrome. :/
Why am I skeptical?
"Somebody has to do something. It's just incredibly pathetic it has to be us."
--- Jerry Garcia
.. with more or less everything else broken into how secure should I really feel using it?
I can see two ways to do groups:
1: The group is a collection of private keys, so when one encrypts to Alice's group, in reality, Alice, Bob, Charlie, David, Elizabeth, and Frank have a key encrypted with their public keys and stored. The good about this is that the keys are secured, and there are no intermediate steps. The bad is that if Alice boots Charlie from the group and adds Mallory, stuff encrypted to the group is still readable by Charlie and not by Mallory until the object's core unlock key [1] is unlocked, the old names removed and new ones added.
The second is having the group have its own key, which is unlocked by Alice, Bob, etc. If someone is booted from the group, their user has the key removed from it. This makes things easier in not having to partially decrypt an object to add stuff, but it means one more key generated and possibly compromisable.
[1]: Most encryption uses a core symmetric key that is randomly generated, then encrypts that core key using the user's hashed passphrase, their public key, or both. Public key crypto is very rough on the CPU, so it is only used as little as possible, and in general, symmetric key algorithms are more secure than public/private key ones.
Exactly. Reminds me of the stuff about Dropbox telling everybody their stuff was encrypted, and that even employees of Dropbox couldn't read the files. But it turned out that it wasn't true, and that files weren't actually being encrypted with the user's password, but with a single master key that was in the hands of Dropbox.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
A truly free social network would have no ads, no profit motive, no logs, no intrusion; just a way for people to share as much or as little with only those they wish to share with.
Is there really no true libre social network, and if not, why not?
Money.
Facebook and Google don't do the things they do simply because they are evil. They do it because that;s how they get the money to pay for those giant buildings full of servers that they run, which provide the services you use.
Maybe in the 24th century when The Federation is building starships, colonizing the galaxy and zooming around the universe, all without any apparent need for money, they can also build your "no ads, no profit motive" social network.
If you aren't being charged for the product, you are the product.
This axiom has been true for a very long time and it's true for this site as well as any other such thing. How are they making money? I'm not objecting to their making money, after all they have to pay for their servers, bandwidth and admins and so on.
It's a fundamental question that you simply can't ignore and economics requires that you have to deal with it whether you want to or not. You can have sponsors that donate time and materials, you have generic ads, volunteers to a certain point, you can charge people for your service and so on.
The point is somehow or another you have to get money, and this site is claiming that they get money in ways that don't exploit your privacy. Since exploiting your privacy is how these sites normally pay your bills, this leaves serious questions on how they are monetizing their site.
I love the idea that a site can raise money without exploiting privacy in an evil manner, but before I can give them any credibility to their model I have to know their model works. I hate to rain on people's feel good parade, but you can' run a website on community goodwill, hugs and unicorn farts.
When I read the summary I immediately thought to myself that I have similar goals to these guys, in that I want to make cryptography easily accessible to a wide variety of users. I'm specifically focused on secure file transfer, and am in open beta. You guys can check it out at https://www.senderdefender.com/ and let me know what you think. Given how insecure cloud data is in general I suspect we will see a growing number of client side encrypted communication tools.
Matt
well, if they're looking to woo disgruntled users, then slashdot is a great place to advertise!
Yeah, I understand Economics 101. I also understand that Firefox, Linux, Wikipedia, Apache, PHP, etc. are not all about the money (thought money is tied to most of them extraneously; but not really at all to Wikipedia).
There are these things called non-profits. A non-profit social network seems like a no-brainer, and I'm not sure why it doesn't exist; let alone rule them all.
A non-profit social network could show ads... to people who felt like seeing them. Money gets made (enough to buy servers & connectivity), but the profit itself isn't the core motive. And the users are not product.
How about a "different Facebook" where they didn't censor the things you write and post, but instead, your content is judged, and viewed (or not viewed) based on the opinions of those you've invited to share your pages? How about a "different Facebook" where anyone can join? How about a "different Facebook" where you can cleanly choose ads, or paid presence? How about a "different Facebook" where you control how your personal information is accessed, instead of having control assumed by the social network?
Your focus on "libre" is incomprehensible to me. Of all the myriad things wrong with Facebook -- and by that I mean things directly harmful to its users and potential users, and unchangeable by them -- "libre" is far down any list ranked by importance.
I've fallen off your lawn, and I can't get up.
you have no right to violate my privacy as i tell the world about everything in my entire life!
The discussion here is about sharing within a controlled group.
}}controlled group.
Impossible. If i can see it. I can copy it. No matter what. I CAN make a copy. Even going all the way to manual transcription or recording my monitor.
Your group just lost complete control. And we're back to the world.
There is always a weak link in any chain. One will always break first.
So you can pretty much guarantee anything you 'share' with a controlled group will be available to the world. Especially if there's gain to be made. Even faster among people who have no severe life punishment for 'sharing'. But even then with severe penalties such as the NSA. Who STILL can't keep control of their secret information among a controlled group.
You share. You're sharing with the world. Bet on it.
If the content's viewable in a regular Web browser without needing special plug-ins...
It is not. It requires a browser plugin.
I browse on +1 so AC's need not respond, I won't see it.
So what? The threat from pedos is insignificant compared to the threat from politicians.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I guess I'll wait for the Firefox version.
I'm looking at the source to Syme's Google Chrome plug-in. While I'm not a crypto expert, I've found three things that seem to weaken the encryption.
return privateKey.dh(publicKey);
},
Note the commented-out line for strengthening the key. That looks like something was done to weaken the key generation.
This is highly suspicious. This code needs a close look by a security expert before anyone trusts it.
Paid for either as part of your ISP bill when you use their servers, or when you sign up to a USENET provider. I never saw a free provider which gave you all branches, especially alt.binary etc.
There are these things called non-profits. A non-profit social network seems like a no-brainer, and I'm not sure why it doesn't exist; let alone rule them all.
A non-profit social network could show ads... to people who felt like seeing them. Money gets made (enough to buy servers & connectivity), but the profit itself isn't the core motive. And the users are not product.
I think that was rudy_wayne's point ... that one doesn't exist, let alone rule them all, would suggest that the economics of that idea don't work, for that particular problem space anyway. At least at this time.
Wikipedia does frequent fundraising. Linux is all about the money—there are amateur linux hackers, but more professionals. Firefox makes money. Of course they aren't all about the money, but money is important. A geek's got to eat. So if you don't think about the economics of the development cycle, you are being unrealistic. It may well be that the economics of a good distributed social network do require that the hacking be done by amateurs; it may be that there's a way to make a business of it.
I don't know why a non-profit social network would be better. Have you looked in your email inbox recently? I get constant spam from the nonprofits I've made the mistake of supporting, even the ones I think are really important. And nonprofits can get harvested—IIRC some big church I won't name sued a nonprofit that had targeted it into oblivion, and then purchased the assets.
Personally I think the right distribution model is lots of smart CPE routers, with no paid hosting at all except maybe for some kind of DNS rendezvous system. The Diaspora model seems too centralized, despite the fact that it's technicall a distributed architecture. But I have no idea how it gets paid for, and apparently the Diaspora folks don't either, now that the initial funding is finished. Crowdfunding features and maintenance might be the best model.
That said, there has to be a model. It's not going to Just Happen.
It is impossible to control the dissemination of information that you make available to other people. But it is not impossible to make it expensive to crack an entire social network and feast on the gooey interior. Best is the enemy of good enough. Right now it is clearly the case that everything that happens on Facebook and Google is visible and mineable at least by Facebook and Google, and possibly by interested governments. A peer-to-peer social network makes that kind of data mining much more expensive.
This is an attitude I wish more people would understand; Big Brother vs. Criminals ... I'll take criminals.
- Michael T. Babcock (Yes, I blog)
Actually check out friendica. Much more reasonable than diaspora.
But the problem with social networks is that people have accepted the panopticon that is facebook. If you even try to talk to a facebooker about why facebook is bad they fall all over themselves to rationalize why its okay.