Hacker News Reader

> Scuttlebutt is fully encrypted.. doesn't that make the API vastly more locked down than Facebook/etc?

Encryption has nothing to do with it. The whole issue with CA was that they (just as many apps before them) were using Facebook social graph data that was available for them to access via the API. Encryption on any layer has nothing to do with it - if you have access to the API, you get the data. In distributed system, if you are a node in the system, you have to have access to social graph data - otherwise the whole concept of social network does not work. You can't "see what your friends are doing" if there's no information about who your "friends" are. And if the nodes on the network have information about who your friends are - or can get that information - then they have the same access as CA (and many other apps before them) had. Facebook can at least (if they wanted to) cut off the external API and not tell the social graph structure to anybody outside Facebook. I don't see how this is possible in a distributed network.

You very definitely don't need to expose the social graph to the api. We are doing exactly that in Peergos [1][2]. Your social graph is only stored in encrypted form in your own storage space (in IPFS). The source of a follow request can't be deduced by anyone except the recipient.

If you start integrating Tor/i2p hidden services, even global passive network adversaries will struggle to figure out the social graph from network monitoring.

[1] https://github.com/peergos/peergos

[2] https://peergos.github.io/book

If the recipient can access it, then the recipient can grant access to a third party- which is what happened with Facebook/CA. People unwittingly shared the information their friends had shared with them with a third party.

That is clearly fundamentally true of any information. The question is what is shared by default. We don't even share your friend list by default, so the exposure is much less.

Default are powerful, but you are always one "Please click this to enable new exciting ways to play Candy Crush" away from any non-default setting. It may be true that FB users value their privacy, but reflecting these values in minute-to-minute behavior is a much more complex question. People are not always vigilant or realize what exactly is the consequence of their actions.

From what I understand, in Peergos the friend list is stored on certain node. Which means software running on that node can see your friend list - which is essentially what happened in CA case, except maybe Peergos does not allow to run third-party apps on private node, but even if they didn't currently, I see nothing preventing from this happening in the future. What happened in CA case, AFAIK, is that users allowed the software to access their social graph data, and that software compiled it into a database that was used for purposes the users didn't intend to. If we assume that the users can run third-party plugins on a Peergos node, why isn't that possible with Peergos?

Nope. Nothing (apart from your username, which is public) is ever stored unencrypted anywhere. Even your own Peergos server can't see your friend list. It is decrypted by your client when you log in.

We don't currently allow third party apps in Peergos, and when we do they won't be able to access the social graph, nor will they be able to connect to the internet, nor anything else outside peergos. So that data can't be exfiltrated.

Scuttlebutt is not at all "fully encrypted", it's fairly trivial to spider and download just about everything. The hardest part is the first foothold (which can be found posted various places, including the official docs on ssb), from there, downloading the entire "social web" it has can be done with the "main client" by basically changing a single config value.

I haven't looked into the protocol in any depth yet but it does seem like it supports end-to-end encrypted updates.

What data are you talking about that can easily be crawled without any permissions?

If it is that simple then maybe Scuttlebutt isn't a good protocol, but a secure end-to-end platform like this is definitely possible. And if anyone is going to build it it's not going to be a company who makes all of their cash from harvesting user data.

I've written a partial implementation of the scuttlebutt p2p protocol (not the encryption, but everything on top). While point to point is encrypted, the bulk of the data is not encrypted. You can specifically send "private" messages that are encrypted such that only a set of keys (users) can decrypt (read) them, but this is by no means the default for anything.

So the feed is public like Twitter?

essentially public, and also basically requires downloading and storing the entire history of a "feed" to verify it.

Sure you can download everything, but you can't read it...

you can read 90+% of it (only specifically private messages are unreadable, and most of the systems are not built on those)

It's worse than facebook because there's no one to have responsibility to be accountable. This ties in with your question about GDPR. While I'm not a lawyer, as far as I know it doesn't matter if you're a person or a company, if you're collecting data, it's something you can be liable for. So in a distributed system, all parties who maintain the data sources would be liable. I actually wonder how this works logistically in terms of storing account info on something like Ethereum.

> It's worse than facebook because there's no one to have responsibility to be accountable.

I guess I just don't understand what accountability there is to be even had? If I send an encrypted message to my friend, who is accountable? What are they accountable for?

If I'm sending illegal content to someone only I can be held accountable (and possibly the person I'm sending to). Is that any different in Scuttlebutts case?

Ah i think i may have misunderstood how the system is made. It is purely peer to peer. So any issues could be if the software has a security vulnerability, but I'm not sure how that ties in with things like "as-use" open source licensing. This post explained the network fairly well I found: https://staltz.com/an-off-grid-social-network.html

As far as GDPR goes, you're right because you're specifically choosing people to send it to. However, having a mechanism to delete your messages on other people's systems when they sync would probably go a long way.

Are you claiming that GDPR holds individuals liable to delete info they might have about another person on request?

Only if they are using that data in a professional or commercial activity.

> having a mechanism to delete your messages on other people's systems when they sync would probably go a long way.

It is my understanding at the moment that it's not scientifically possible to do this. If I'm mistaken I would love to hear a proposal for doing this, but I don't understand how full read access can be revokable once you have the data and a way to decrypt it. DRM doesn't count/work.

Not technically possible currently (well, last I checked). A client could be configured to send a "please delete message id 29342" type post, but other clients would have to know how to understand that and to honor it. The functionality would be similar to "sender has recalled this message" in exchange.

Also, the way the protocol works is that clients discover the most recent log entry number, and then request all "missing" ones. So that delete message would be more like a "please overwrite message id 29342 with zeros or something".

Is it possible to do revocable private messages in a decentralized system. My understanding it that the Zot protocol (used by Hubzilla) deals with this by keeping private data on the hub of the user sharing it, while public message can be mirrored to the hubs of any users receiving it. "Sending" a private message (or media file) to another user actually sends a notification to that user that they have permission to access it. When the receiver wants to access the message, their hub has to correctly identify them to the sender's hub, using credentials sent as part of that notification. But all of that is handled in the background, not a painful, confusing manual process users have to know about. See: https://github.com/friendica/friendica/issues/2894#issuecomm...

From what I understand of SSB,it works by distributing messages to receiving users as part of a blockchain, making all messages effectively public, even if not published with the goal of giving the public access. But maybe similar functionality could be added by setting up private "clubs" - pub servers set up by groups of users who know and trust each other - which would play the same role as a Hubzilla hub, storing private messages and displaying them to users who can authenticate correctly.

>It's worse than facebook because there's no one to have responsibility to be accountable.

Yeah, it is worse because if you screw up, you don't have anyone to blame but yourself.

You have complete control over your data.

It is no worse than email is now. In fact, it's better because only allowed clients can read messages authorized for them.

True for 1to1 messages, everything else is stored in plaintext and public.

> Scuttlebutt is fully encrypted.. doesn't that make the API vastly more locked down than Facebook/etc?

No, not at all! TOR is fully encrypted, but there are somewhat regular vulnerability reports about various parts of the stack. Including criticial vulnerabilities that can and have been exploited by nation states, for example.

> This is no worse than Facebook though

This is not at all clear to me. The attack surface for Scuttlebutt is much larger, and I trust Facebook's security team to audit and patch much more than I trust any random friend.

> I trust Facebook's security team to audit and patch much more than I trust any random friend.

Sure, but I wouldn't choose "a random friend" to run my FB replacement service, I'd choose a trusted friend. And more importantly, no matter how good Facebooks security team are at patching and auditing servers - THEY ARE THE ADVERSARY IN THIS CONTEXT!

> Sure, but I wouldn't choose "a random friend" to run my FB replacement service, I'd choose a trusted friend.

How does this relate to scuttlebutt? There's no scuttlebutt “service”; it's a tool and a protocol, like a pen and the English language.

> no matter how good Facebooks security team are at patching and auditing servers - THEY ARE THE ADVERSARY IN THIS CONTEXT!

I think this is the salient point: if you send data to your friend, they necessarily have that data and can leak it; but there's no need for a stranger with unknown motives (Facebook) to also have that data.

> This is no worse than Facebook though. With Facebook, your friend could steal all of the data you let them see. With Scuttlebutt, your friend could steal all of the data you let them see.

Your friend can, but Facebook can scrutinize third-party apps. In a decentralized world, there's no one who has access to holistically examine automated access and detect shady activity. In a decentralized world, everything is essentially a third-party app.

>Facebook can scrutinize third-party apps

I can assure you that they don't. Anyone can have a third-party app that scavenges for private info.

See: Cambridge Analytica.

>there's no one who has access to holistically examine automated access and detect shady activity

There is. It is you. You can shut off access your data any time you want to. Yes, if you give someone access to some data, that data could potentially be out there forever but you can revoke access to your (future) data freely.

> Yes, if you give someone access to some data, that data could potentially be out there forever but you can revoke access to your (future) data freely.

And, most importantly, the same is true for literally any platform.

One quick look at people taking screen shots of snapchat posts shows how deletion of data from a platform like FB or Snapchat is irrelevant - viewers of that data can always copy it.

Facebook is going to scrutinize third-party apps now. They don't want another scandal similar to the Cambridge Analytica one.

Do apps really bring that much value to the social network experience? I know for myself I have not found a single Facebook app that brings any positive value to my life.

A lot of people like using them as a login system. Maybe WebAuthn will help with that since it’s a valid use but most people didn’t see what else they were agreeing to.

The other thing I’ve seen a lot of people use are notifications / invites. e.g. most big gaming communities are bad experiences but you can bootstrap your friends into a better group. That seems harder to change and it’s definitely a real need.

Services like Buffer.io or custom mobile/desktop clients that post on your behalf.

Basically only automation & power users.

Have any of your friends installed a Facebook app? Because it doesn’t matter if you decide they're not worth using, you have to make sure nobody in your network uses them either.

I see that you don't understand the problems raised.

About accountability: if YOU are compromised, your friends' data are compromised, and vice versa. Are you saying that the median security skill of your friends are higher than Facebook? Because any of them can leak your data unintentionally.

About encryption: it's freaking useless in this case. Remember, some people fall for Nigeria prince scam. And what happen when their keys are compromised? See above.

That's the crux of the argument: you can't guarantee that your precious friends and family can safeguard their keys (in fact, I doubt my personal security practice is remotely as good as FB or Google or Amazon or MS or Apple). In that case, by the virtual of distribution, your data is copied everywhere, waiting for any key to compromise.

It boggles the mind that people still have the blissful trust in the security chops of giant corporations. I could give you a long list of well-funded corporations whose servers have been cracked in the last few years (remember Ashley Madison?!?), but I really only need to mention one; GitHub ...