Slashdot Mirror
Encrypted Social Network Vies For Disgruntled Facebook Users
angry tapir writes "With the look of Google Plus and Facebook-like elements, a new social network named "Syme" feels as cozy as a well-worn shoe. But beneath the familiar veneer, it's quite different. Syme encrypts all content, such as status updates, photos and files, so that only people invited to a group can view it. Syme, which hosts the content on its Canada-based servers, says it can't read it. "The overarching goal of Syme is to make encryption accessible and easy to use for people who aren't geeks or aren't hackers or who aren't cryptography experts," co-founder Jonathan Hershon said in an interview about the service." See also Diaspora.
Syme—Winston's colleague at the Ministry of Truth, whom the Party "vaporised" because he remained a lucidly thinking intellectual. He was a lexicographer who developed the language and the dictionary of Newspeak, in the course of which he enjoyed destroying words, and wholeheartedly believed that Newspeak would replace Oldspeak (Standard English) by the year 2050. Although Syme's politically orthodox opinions aligned with Party doctrine, Winston noted that "He is too intelligent. He sees too clearly and speaks too plainly". After noting that Syme's name was deleted from the members list of the Chess Club, Winston infers he became an unperson who never had existed. Goldstein's book says that "Between the two branches of the Party there is a certain amount of interchange, but only so much as will ensure that weaklings are excluded from the Inner Party and that ambitious members of the Outer Party are made harmless by allowing them to rise." It is unknown whether Syme has been killed or promoted in the Inner Party in another province.
I read the article expecting it to be crap, ignore meta-data etc. What I found however was a decent article discussing that the service used open source client side crypto libraries, and they even acknowledged the meta-data problem and how it makes their service not truly private. They also mentioned how its very unlikely to go big like facebook and it summed up with some reasonable example use cases. I haven't see such a non crap article in a long time!
Except that they don't encrypt your data, you do. Probably would have helped to RTFA, huh bub? =p
It is pitch black. You are likely to be eaten by a grue.
They answered that themselves:
https://getsyme.com/about
So something like "not much, but at least we're trying."
So it's a social network that "protects your data" ... and requires Google Chrome. :/
Why am I skeptical?
The extension should work just fine with Chromium, I would expect. And they said Firefox is in the works.
Personally, I think the idea is an interesting one. In general, I think it's on the right track. The only way to get the masses to use encryption is to make it invisible. The flaws of SSL are well-known, but the fact is that in practice it mostly works really well, and it is used by basically everyone on the web. Making it invisible means that you have to embed key management seamlessly into the infrastructure, and making it have some hope of being secure means that it has to be pushed out to the endpoints -- including key management.
On the right track, but this is a really, really hard problem to solve fully.
One issue is that although the keys are generated in the browser plugins, they're obviously exchanged through the Syme server, putting it in an ideal position to completely subvert the claimed security. Making security both transparent and strong is hard.
Another issue is portability. I can log into Google+ or Facebook from any computer. But if my browser is holding my keys, then I can only use my browser. If the keys are stored in the cloud, well, that's great for portability, but the keys then have to be secured from whoever is holding them.
Still, I like to see initiatives like this. The only way hard problems get solved is by clever people trying.
(Disclaimer: Since this post mentions Google+ and Chrome, I should probably mention that I'm a Google engineer, but I'm not speaking for Google.)
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
A truly free social network would have no ads, no profit motive, no logs, no intrusion; just a way for people to share as much or as little with only those they wish to share with.
Is there really no true libre social network, and if not, why not?
Money.
Facebook and Google don't do the things they do simply because they are evil. They do it because that;s how they get the money to pay for those giant buildings full of servers that they run, which provide the services you use.
Maybe in the 24th century when The Federation is building starships, colonizing the galaxy and zooming around the universe, all without any apparent need for money, they can also build your "no ads, no profit motive" social network.
well, if they're looking to woo disgruntled users, then slashdot is a great place to advertise!
Yeah, I understand Economics 101. I also understand that Firefox, Linux, Wikipedia, Apache, PHP, etc. are not all about the money (thought money is tied to most of them extraneously; but not really at all to Wikipedia).
There are these things called non-profits. A non-profit social network seems like a no-brainer, and I'm not sure why it doesn't exist; let alone rule them all.
A non-profit social network could show ads... to people who felt like seeing them. Money gets made (enough to buy servers & connectivity), but the profit itself isn't the core motive. And the users are not product.
you have no right to violate my privacy as i tell the world about everything in my entire life!
The discussion here is about sharing within a controlled group.
I'm looking at the source to Syme's Google Chrome plug-in. While I'm not a crypto expert, I've found three things that seem to weaken the encryption.
return privateKey.dh(publicKey);
},
Note the commented-out line for strengthening the key. That looks like something was done to weaken the key generation.
This is highly suspicious. This code needs a close look by a security expert before anyone trusts it.
It is impossible to control the dissemination of information that you make available to other people. But it is not impossible to make it expensive to crack an entire social network and feast on the gooey interior. Best is the enemy of good enough. Right now it is clearly the case that everything that happens on Facebook and Google is visible and mineable at least by Facebook and Google, and possibly by interested governments. A peer-to-peer social network makes that kind of data mining much more expensive.