Comment by marknadal | Hacker News Reader

Comment by marknadal | Hacker News Reader

Trying out the demo, got this warning:

> I understand that passwords cannot be reset or recovered - if I forget my password, then I will lose access to my account and all my data

Shame, cause P2P password resets are totally possible these days, see my tweets on this with Brendan Eich: https://twitter.com/marknadal/status/1131258225095991296

Also, I just got:

> Error: User already exists!

How is this decentralized then? Unless it is using a blockchain to register usernames, then there has to be a master server that "decides" whose username is taken.

Or worse: It is decentralized, but not offline-first (what happens if I register without internet access)? What is the point of being P2P/decentralized if I need to be connected to a peer?

> Creating filesystem

Is really slow! Is this IPFS?

Small actions, like "send friend request" takes ~5seconds. Have you guys tried using something faster? There is a P2P version of Reddit ( https://notabug.io/ ) and he's done a ton of optimizations to make things instant, probably require switching p2p protocols though.

Overall, it worked! That is saying a lot in the blockchain/decentralized world. So this should actually be viewed as a huge success. Congrats!

Hi Mark,

Thanks for your feedback.

We do hope to use shamir secret sharing among your friends to allow password recovery in the future, but that's strictly less secure (your friend's can collude against you) and would be optional.

There is a centralised pki to ensure unique usernames (eventually it could be made into a blockchain - it's already an append only merkle-tree in ipfs, but this is an alpha). This is a UX tradeoff. Peergos is designed to be used by people who can use facebook - they should never need to see a hash or manage their keys. Once you have signed up and claimed your username you only need to interact with your storage node (and those of your friends for social stuff) unless you need to lookup a new friend who's recently signed up.

Some things are slow yes, we have a lot of optimisation to do, but wanted to start getting feedback.

The idea of enforcing unique usernames kinda sucks, and so does trying to add people to a contact list by searching for and entering usernames.

This is, of course, how it’s always been done. But need it be?

If you’re bootstrapping off of your existing Twitter/Facebook/Whatever I would assume Oauth could get you the ability to discover friends on the network without ever having a “username” to enter.

If you’re making a new friend on the spot it’s a QR code or Bluetooth or Ultrasonic handshake between the devices?

If you’re making a new friend online I’d rather send them a peergos://<base56>/invite via SMS or Email or whatever other chat program we’re using. Tap and it should app switch right over to a screen showing their contact info with the “Friend” or “Add” button right there.

iOS will convert a webpage link into a preview of the page. I wonder if you could use that functionality to make sharing an invite link via SMS on iOS preview the actual contact page. I don’t know if iOS will let installed third party apps provide a preview bubble for link/protocols they’ve registered to handle.

OT: Shouldn’t the name just be PeerGo? Or really, Peer.

Or use Shamir's Secret Sharing to split your key/password up between friends at the outset: https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing

Great reference! Do you know of a WebCrypto based implementation of this? Or even libsodium? That has been my hold back.

Reply on news.ycombinator.com