No End-to-End Encrypted Fediverse?
No End-to-End Encrypted Fediverse?
I really want a Facebook (the old Facebook timeline) replacement, but end-to-end encrypted, and decentralised so there's longevity.
Edit for clarity: I'm looking for a way to share things online, end-to-end encrypted to a wide-audience that knows you but doesn't necessarily know each other.
This is why messaging apps don't fulfil this requirement, and chat rooms (like Matrix) also don't fit.
I love Lemmy, I like the idea of Mastodon (twitter-like sites just aren't my thing. ActivityPub rocks. However, none of them are encrypted.
PixelFed is neato, but I don't plan sharing my personal photos with the whole of the internet, which seems to be the only choice with ActivityPub.
Signal and other encrypted messaging apps are great, but are for direct messaging. Where are the encrypted social media apps?
Matrix is cool and all, but it's aimed at groups. Like discord / MS teams replacement.
Someone told me about Futo Circles, which seems to tick all the boxes and built on top of Matrix, but it's currently abandoned.
Are there any other alternatives? My wallet is open, I would very much like to use such an app. I am no programmer, so sadly cannot take on the mantle of continuing the Futo Circles project.
I remember thinking about this long time ago and even asking some hackers about it to get blank stares back. Basically, there are multiple problems around data access.
Take the simple scenario of a unfriending. Let's say you have 12 friends, but Susie turned out to be a real bitch and you unfriended her. You don't want Susie to have access to your photos, messages, and basically anything anymore! That means the encryption key has to change -->
Where is all the data hosted and who is going to reencrypt all the entire history from the point Susie became your friend until you unfriended her? The most secure would be that you have all your data and that you re-encrypt it. Great, you are data-frugal and have maybe 10MB you have to re-encrypt. But Karl, your photography pal paid for gigabytes of storage and now has to rencrypt a good chunk of that if he unfriends somebody.
You could of course say "fuck it, the asshole friend probably made a copy and re-encrypting is pointless", but then your ex-friend can just share the private key with the world and TADA, everybody has access to the files you shared with said friend.And that's just one problem I can think of right now. When you take more time to think about it, you'll run into more and more stuff.
I'm not saying it's impossible, but it definitely isn't easy. Add to that that many people don't care and it's less likely. The closest I get to that is Signal.
Once you share a file with someone, they already have it. There's no point in trying to make them unable to view it after the fact.
Sharing != downloading forever. When you browse it, yes, technically it's in your cache, but that's why it's called a cache. Most people won't install a client that puts their browsing into long-term storage (unless Microsoft takes a screenshot for them and promises never to upload it somewhere). Regardless, it is still a security issue (as I just described with releasing the encryption key). You can choose to ignore it, until someone comes along and exploits it. Then you have a bunch of angry people screaming at you because you "didn't close an obvious security hole".
Damn, thank you for this response, I really appreciate it. This does make sense, and I do not understand a lot of the technical details, or how this problem would be solved. I just wish it was haha
The circles project, at least claims, to be built on top of Matrix, where everyone who you accept to follow you essentially joins a seperate matrix room with your content in it, and the "timeline" compilation is done via UI.
Can't say I understand what happens technically when someone is kicked from a matrix room, so what what happen with the encryption keys I dunno.
This does make sense, and I do not understand a lot of the technical details, or how this problem would be solved. I just wish it was haha
:D same. I think the solutions could be applied elsewhere too. They'd be very interesting.
Can’t say I understand what happens technically when someone is kicked from a matrix room, so what what happen with the encryption keys I dunno.
That depends on the client. Some clients will exit, some will stay in the room. Encrypted matrix rooms use "perfect forward secrecy", meaning new people can't read the past, and old people removed from the group/chain/chat cannot read new messages. So, being kicked from a room would still allow you to see all the chat history you stored. Or if you sign in with a device that didn't get the "kick" message yet, the server could still send you all the messages up until the point of the kick message.
I'm not sure how Matrix implements it and server + client implementations can differ.
I personally don't see the value add of e2e encryption to public posts in a federated social media.
DMS are the only place I could see it being beneficial.
Not public posts, rather posts to anyone who you have added. Similar to Facebook
I'm happy with Lemmy and Mastodon as is as it's a different purpose.
You are looking for https://movim.eu/
Appreciate you taking the time to reply, but this isn't what I'm looking for
At least I couldn't find any mention of end-to-end encryption outside messaging.
And it doesn't appear to be timeline (i.e. you post and anyone who you've connected with can see it), it's fully public blogs, private (but no mention of e2ee) chatrooms, and videoconferencing.
It's built on XMPP. XMPP provides direct and group (room) communications. If you set up OMEMO, any message you send will be encrypted and only visible to the recipient(s).
What you are calling "timeline" is equivalent to what they are calling "blog", the concept is the same: sorted feed of events which are published to network.
The closest you'd get would be with Hubzilla or (streams). Or Forte if it wasn't experimental with no public instances yet. They even have file spaces with WebDAV on which you can upload files and then define who is permitted to see/access these files or the folders they're in.
However:
What you want isn't their default M.O. You'll have to get used to and think yourself into something with a learning curve that's even steeper than Friendica's. You'll have to learn and understand the permissions system, including giving nobody permission to see your connections. Ideally, all your connections would have to be smart enough to know how to to hide being connected to you from the public and to actually do so.
Encryption is optional and "uninstalled" by default for everyone, and it isn't even available on all server instances (it's up to the admin to activate that add-on, and then the user has to activate it, too). Also, it uses passphrases and not automatically generated key pairs.
Finally, if you insist in using it with a mobile app, you're completely out of luck. It's browser or PWA for all of them.
Hubzilla looks interesting, I'll give it a go, thanks!
For end to end encrypted photo sharing there are these two open source projects that also offer a for pay cloud storage:
The only Fediverse project that offers optional e2ee messages is Hubzilla afaik.
Yeah I've seen these photo storage apps, they are neato but not what I'm looking for unfortunately, and I already use Signal for e2ee messaging
Really wish Futo Circles wasn't abandoned :(
Pixelfed dev was working on such app, named Sup, but it's not available anywhere for now as the focus is on pixelfed and Loops for the moment.
Oh neato, thanks for sharing. Hope some other kind soul takes it up (and takes my donation money :3)
With Friendica you have a picture gallery and can set for each picture whether it should be public or private; same with calendars. However, I can't say how private it will be from a technical point. You can also define contact circles.
Here on the Features list it says "Privacy with military encryption" but I don't know what that refers to exactly.
The direct messages are definitely more private than with Mastodon (they don't work with Mastodon). Sharkey / Misskey also have some.
Here is a good video introduction to Friendica : https://peertube.stream/w/p/1e4ebc30-d582-4067-97d8-3de59bdaf330?playlistPosition=1
Yeah I considered Friendica, but I believe it's not end-to-end encrypted :/
Thanks though!
Hubzilla certainly has the most options for privacy. But it is ‘not perfect’. More detailed here (in German):
"Full disclosure: The encryption that hubzilla uses by default is not absolutely watertight. There are known methods to circumvent it. However, this is very time-consuming and has to be done individually for each channel. And to be clear: Other services store your messages in plain text, so we see this approach as a significant improvement for your privacy. Furthermore, you are always free to use additional encryption and password protection if you wish. To explain this in more detail:
- each channel has its own key pair
- every non-public post is automatically encrypted
- optional password protection for content via crypto javascript, browser-to-browser encryption (must be enabled in settings) Full disclosure: A malicious hub administrator could inject malicious javascript code (e.g. keylogging capabilities) into the code. Encrypt our data with GPG, become a hub administrator yourself, or use other means of communication if that bothers you.
So what is the scope of security? To put it bluntly, it may be great, but it's not perfect."