Hacker News Reader

Comment by lambda_obrien | Hacker News Reader

I would pay/donate up to $20 once, or $1 a month or something, if you created a (very easy) containerized deployment I could deploy on my home server and limit to only the phones I choose to allow access, that way only my wife and I (and later my son) can hook into this and share locations with each other. I already have our phones setup to VPN home when off the home WiFi, so this would be great for privacy.

I would pay that much for the cloud offering if you had a contractual/legal obligation NEVER to sell my data EVER, or to sell the service to any company without wiping ALL of my data first.

View on HN

Thanks for the feedback lambda_obrien.

Zood Location only sends your location to users that you have explicitly added, and your location data is end-to-end encrypted before leaving your phone meaning that the data can only be decrypted by the person your sharing it with (i.e. your wife or your son.

As for your personal data, Zood doesn't get any of it because of the end-to-end encryption. All the server [1] does is accept blobs of effectively random bytes (encrypted) from users to deliver to other users.

Even if I wanted to sell user data, there wouldn't be anything to sell. Everything is encrypted before it leaves your phone. It's just like Signal in that regard.

[1] https://github.com/zood/oscar

I would like more information on what information exactly zood receives and stores.

Does zood know who is sharing with whom? Is the data usage to username logged?

Is the amount of data sent to zood increase as a function of 1. How many people you are sharing your location with 2. If you are traveling quickly 3. If you are on battery saver or not?

Hey fitblipper. Good questions. :)

> I would like more information on what information exactly zood receives and stores.

When you sign up, the Zood Location server receives

* the username you picked

* (optionally, if you provided it) your email address

The server also stores a backup of various pieces of data for you, but this data is encrypted on your phone before being backed up to the server. It's exactly like how a password manager backs up your passwords to the cloud so you can access them from any machine. THIS DATA IS ALL ENCRYPTED ON YOUR PHONE with a key DERIVED FROM YOUR PASSWORD before the blobs are sent to the server.

The encrypted data includes:

* your symmetric key

* your asymmetric key

* your password salt

* the algorithm used for your password derived key (currently, argon2id)

* your friends list and their public keys (for TOFU reasons)

Again, all that data is encrypted in the app on your phone before it ever leaves your device. This is no different than using a password manager.

> Does zood know who is sharing with whom?

The most information that the server can ever see is that some user sent some communication to a particular user. The contents of the message are unknown. Location sharing actually happens through "drop boxes" to make it more difficult for the server to see when and how often users send communications. When a friendship is established, the friends agree upon drop box addresses to use for each other, and they simply place encrypted data in the drop box for the other user to check whenever it wants.

In theory, I could perform metadata analysis to try to statistically determine friendships, but I still wouldn't know anybody's location. The server code is available, and not terribly complicated so it's easy to verify that no analysis is happening there [1].

> Is the data usage to username logged?

For debugging purposes, I can have the server log to stdout when a user makes a REST call to drop an encrypted blob on the server, or when a REST call is made to send an encrypted blob to another user, but that's off in production. It was there to help me build the thing.

In general, thwarting metadata analysis by the person running the service is tough. I look to what the Signal messenger folks are doing in this space to improve things.

> Is the amount of data sent to zood increase as a function of 1. How many people you are sharing your location with

If you have more friends, your phone will send more encrypted blobs to different drop boxes on the server. The reason is that though you only physically exist in one point of space at a time, because communication with each friend is end-to-end encrypted, your phone will encrypt the location info payload for each friend with their own public key. So if you have 5 friends, every time your location changes, your phone will encrypt the payload 5 different times and place it in five different drop boxes on the server.

> 2. If you are traveling quickly

That's based on your phone's operating system and version. Google and Apple are always tweaking how often location updates are reported to apps. But if a location update comes in, Zood will encrypt it and upload it.

> 3. If you are on battery saver or not?

I don't really use battery saver, but I think location services is disabled when your phone is in that state, so Zood wouldn't get any location updates at all. I could be wrong about that.

[1] https://github.com/zood/oscar

> Even if I wanted to sell user data, there wouldn't be anything to sell.

You might be surprised. You wouldn't need to sell user data, but there certainly is something of value from the cloud offering you (and your users!) should be aware of.

The logs of location sharing uploads and queries contain two pieces of information that together would allow for certain types of analytics:

    * Approximate location even from partially redacted IPs (via geoip lookup)
    * Timestamp of action

The value of that information is not in individual users or their data. It's in their aggregate behaviour in locations over time. Want to know where privacy-aware users are more likely to be found? Or how about where the trend of privacy awareness is increasing or decreasing?

The people who are actively aware of their privacy are more willing to pay for good services. That's a marketing cohort all by itself.

NOTE: I'm writing this with my DPO hat on, because even if the impact assessment for using this kind of service would be pretty simple, it would not be a no-op.

> The logs of location sharing uploads and queries contain two pieces of information that together would allow for certain types of analytics

Yes, metadata can always be analyzed and exploited. I just hope that by open sourcing the server and the client, that I can earn some trust from people to know that I'm not doing anything like that. This is not a problem unique to this server, it's a problem of all servers in the world. And if a user is particularly concerned about exposing their IP to the server, they can always access it via a VPN or proxy server.

Zood Location can't overcome every single threat out there, but it can significantly reduce the number of threats you have to deal with.

True enough, you can't eliminate metadata (or as it should be really called: "traffic analysis"). And don't get me wrong, I think you're improving things.

It's just that with something that advertises E2E encryption, the expectations are high. Unavoidably so. Doesn't help that various snake-oil salesmen have tried to hijack the term too, because of its implied strength. So being upfront about the threat model and in particular what your service can not protect against is important.

It just happens that in this particular case, the not-in-threat-model-scope is also a thing of interesting value. Perhaps even more so if your service gets adopted by civil rights or other organising movements.

It's a little bit of configuring, but it sounds like OwnTracks can do exactly that. You can deploy the recorder container wherever you like and then post / share locations to it from iOS/Android apps, as well as see the last location posted by others on the same instance. Enabling / disabling sharing on the app is a single button press.

(I help maintain the OT Android app)

Reply on news.ycombinator.com