Show HN: Mentat – group chat with tags and pretty good privacy | Hacker News Reader

Show HN: Mentat – group chat with tags and pretty good privacy

github.com

35 pointskenforthewin15 comments

> When you first join a chat room, a personal keypair will be generated and stored in browser storage. If you are the creator of this room, the client will also generate a keypair for the room

I'm trying to wrap my head around the security model here. What bothers me is the key distribution problem and the fact that a server still has to handle key distribution messages.

With PGP, a "web of trust" is assumed where people have static long-lived public keys you can verify using existing trust relationships. The key pair in this app is being generated as you join or participate which makes "web of trust" impossible to use.

So,I am assuming the security model is similar to end to end chat apps like signal? Those protocols assume the initial key exchange was authenticated by the users out of band and allow users to verify the "safety number". They assume the users already know each other and can succesfully perform out of band authentication for at least the first key exchange.

My question is, is there a "safety number" for mentant? Is it straight forward and obvious when navigating the UI? (Signal's isn't) and will the compromise of an old key pair (personal or room forward secrecy) result in compromise of future messages?

If you security is done right I love the idea,especially if you can integrate existing user directories (AD/ldap for example) where user keys for the chat can be verified in the directory db.

You're right in concluding that Mentat doesn't use the web of trust concept from PGP. Each device is assigned a UUID which serves as the safety number binding ownership between a keypair and a device. This number isn't displayed yet which is a clear flaw but a quick one to fix. See this issue for more of my idea on identity and proving ownership of keys: https://github.com/kenforthewin/mentat/issues/50

Thanks for the insightful comment.

Thanks for taking the time to respond,I will look at the issue.

I created a room, but I wasn't asked to set a name on creation, nor can I change it (seems broken). Also I have no idea how to actually invite anyone else to chat with me...

https://groupchat.kenforthewin.com/t/b001beb0-7273-11e8-82a9...

There's already a mentat, name change please

Is it trademarked?

It's from the book series Dune. A fictional name for humains trained to be computers. A bit like the word "hobbit" from LotR

There are three active trademarks on that name in the US alone. One is from Otsuka Pharmaceutica and might have some overlap with a chat program (you only register trademarks for certain product categories, so you can have Apple computers and Apple Music, as long as they don't sell similar products)

Having recently been involved in trademarking some company assets, it seems that the rule of thumb is that it's ok to use a name if it's not already taken by a competing company or service. This is also particular to a region. Finding a good name that works across the world is a headache.

There will be tons of overlap in open source software, always. No point in getting upset about it. Most of the time, the purpose of the software is completely different.

That being said, I think this is a good rule of thumb out of courtesy and good judgement, even if trademarks are not involved. It just leads to dilution of both brands/projects, if they are similar enough in what they do.

For this, I'm only aware of Mozilla's Project Mentat [1], but no problem there.

1: https://github.com/mozilla/mentat

Mentat was also a company in the early 90s, they made a portable STREAMS implementation that was used in MacOS Open Transport, among other OSes

https://en.m.wikipedia.org/wiki/Mentat_Portable_Streams

The name Mentat is derived from the Dune universe.

Quoting: "A Mentat is a fictional type of human, presented in Frank Herbert's science fiction Dune universe. In an interstellar society that fears a resurgence of artificial intelligence and thus prohibits computers, Mentats are specially trained to mimic the cognitive and analytical ability of electronic computers." [1]

[1] https://en.wikipedia.org/wiki/Mentat

Mozilla Firefox was originally called Mozilla Phoenix. Briefly after, its name was Mozilla Firebird, even though there was already an open source database called Firebird. So Mozilla eventually changed the name to Mozilla Firefox. I don't see how Mozilla Firebird and Firebird the open source database competed.

Not a lawyer but naming conflicts usually apply when things are in the same sector, not just when they are “competing”. Apple Computer and Apple Records are in completely different sectors, so that’s fine. You could not call a company “Apple” if you sold electronic parts, as that is too similar in the sector to Apple Computers, even if you’re not directly competing.

http://fallout.wikia.com/wiki/Mentats

http://dune.wikia.com/wiki/Mentat

Reply on news.ycombinator.com