Flock, Private Contact and Calendar Cloud Sync for Android | Hacker News Reader

Flock, Private Contact and Calendar Cloud Sync for Android

whispersystems.org

106 pointsKototama29 comments

I love that there are creative artistic people out there that care about privacy and owning your own data. There are tons of great apps out there that basically do this like CalDAV/CardDAV sync [1][2], but they aren't beautiful like this one.

I like beautiful design, especially on my phone but I like owning my data even more. This is truely a great product.

Edit: I see this is encrypted as well. I really need to dive into this! Cool beans!

[1]https://play.google.com/store/apps/details?id=org.dmfs.cardd... [2]https://play.google.com/store/apps/details?id=org.dmfs.calda...

Not sure if the Twitter acquisition has any part in this, but worth pointing out: https://whispersystems.org/blog/welcome/

EDIT: Having said that, MAN I love these folks. I wish they got along better with the F-Droid community[1], but hopefully that will eventually get sorted out :)

[1]: https://github.com/WhisperSystems/TextSecure/issues/281

Great stuff. This is important work to get everything end-to-end encrypted. Any updates on how the integrated messaging up is coming along, and whether we're still getting a desktop app/extension soon, too?

I'd love for nothing else than to give up using Hangouts, but I use it a lot to talk to people from my computer to their phones, and right now apps like Whatsapp or TextSecure are no go for that. Hopefully there will be a solution for it soon.

WhisperSystems are working on a web based TextSecure https://github.com/WhisperSystems/TextSecure-Browser

FYI, for those who absolutely do not trust the cloud, a similar tool based on sync with Thunderbird is Birdiesync (http://birdiesync.com).

Will Flock sync calendars and contacts from multiple accounts, e.g., my personal Google account (gmail.com) and my business account (privatedomainIown.tld)?

If yes, I will sign up right away.

Next question: What about sync with CRMs, e.g., SugarCRM or 1CRM (or others, that's cool too)? I need two-way contact and calendar sync between my CRM and my Android device, I would pay you more than $5/year for it.

I'm trying it out for 30 days. So far this is what I've found. I'm syncing out of google into flock. My plan is to at some point delete all my contacts and calendars out of google. But we'll see. Yes it does allow syncing multiple accounts. And multiple calendars from the same account as well. Groups are not supported (yet as of v0.51) but hopefully this will change in the future.

Not sure about the answer for your other question.

Somewhat off-topic but when can we expect a release of TextSecure for iOS?

They are working on it [1]. Behind schedule so they're anxious as well.

[1] https://twitter.com/jmathai/status/491294401579077634

I'm trying it out now. Took 5min+ to sync my 180 calendar events and is taking forever (it seems right now) to sync my 1000+ contacts. I will try out for 30 day free trial, but I will only be paying the $5 yearly subscription if they allow distribution on the F-Droid repository since I prefer to not have Google Play on my phone. Open Whisper Systems has been frustratingly adamant about not wanting to distribute TextSecure on F-Droid as it doesn't do auto updates because they want to fix all bugs quickly (although current versions do notify when updates to apps are ready). Until then will be sticking with ownCloud.

Update: killed flock, restarted flock, pressed sync now, and was still stuck at like 2%progress for syncing contacts. Then rebooted my phone and made coffee. Opened flock, pressed sync now, and almost immediately reported everythinng's good and last sync was a second ago.

The F-Droid thing will certainly will not happen.

Moxie, one of the core developers of the WhispherCore products, had a pretty argumentative debate on their forum and his own Github issues regarding their repackging of his software TextSecure. It was subsequently removed, due to his indirect request (he went so far as to say he did not approve, but did not directly instruct them to do so). Despite their workflow and licensing, he believed it to be a step backwards in security as he takes issue with phone rooting and other things (if I recall correctly).

Long story short, it is a safe guess you will not see any WhisperCore products on F-Droid anytime soon. Moxie et al. say compile and patch yourself, or use the Play Store (for the faint of heart).

One reference here:

https://github.com/WhisperSystems/TextSecure/issues/281#issu...

UPDATE: Maybe I missed something entirely as you mentioned your obvious knowledge of the F-Droid spat. Will leave it here for others though. Clumsy reading on my part, sorry.

Yup. I'm one of those that has to recompile text secure whenever there is an update. I'm hoping once F-Droid implements auto reinstall of updated apps, then moxie will permit builds on F-Droid.

Point of correctness: F-Droid does not require root privileges to install, just that user allows "untrusted" sources in android settings. Most F-Droid apps don't require root privileges. Google play on the other hand is full of malware.

I know that to be the case, I was cribbing something I read from Moxie on the F-Droid Forum where he presented his view of Cyanogen, which was pretty inaccurate.

Right now the initial sync does take an unreasonable amount of time, I definitely agree.

After first sync you will never have to experience a sync operation anywhere near the length of that but it is a bad first experience to have with the app. Very close to the top of my TODO list is "support bulk upload" which will cut the initial import time (and bandwidth) considerably.

Soon we should be able to upload entire address books and calendars in one POST request, working on it :)

I've had mixed success with CalDAV connectors for Android and a self-hosted server. The apps that I bought didn't support self-made certificates very well, or not at all (certificate pinning would be ideal).

The best way was to create a new CA certificate and use that to sign the server cert. But after installing the new CA cert on Android, I got a non-removable notification that my calls and data might be monitored. I did this on the train to a "hacker" congress, imagine how surprised I was about the warning...

Can anybody recommend a CalDAV/CardDAV server? What does the hosted Flock service use?

I have radicale installed on my server with a self-signed certificate. It stores data in standardized clear-text files and has good documentation on how to setup all sorts of clients.

I highly recommend it.

That warning is really irritating, and I get the security concern but the fact that there is no way to silence, minimize, or otherwise hide that notification in any way bothers me.

I don't understand why there is no way of telling it "yes, thank you, I put it there, shut up already, even for a short while!".

I read somewhere that it's a known bug that is being addressed. I'd like a fix too. My company wifi requires a cert installed and now the warning pops up on a regular basis.

1. Do I disable Google Sync services (gmail, cal, and contacts) and replace it with Flock? 2. Is my contact list and cal events empty until I enter a password to unlock them?

1. You can replace your Google sync account with Flock if you choose. You can import data from a Google account into your Flock account without destroying or altering the data in your Google account.

2. The Flock encryption is used for transmitting data to/from the server. On the device, we let the Android permission system take over from there, so you don't have to enter a password in order to see your contact or calendar items. Your workflow remains the same as before.

Thank you for the answers, going to install it and try it out!

I will definitely pay for this, if it works well. Contacts and calendar sync are very important to me, and nothing else does it as well as Google, right now (as far as I know).

Feature request: Please support contact checkpoints. Some app accidentally deleted all my contacts once, and the only thing that saved me was Google's "restore contacts as they were X time ago" feature.

Can someone explain me the difference between google sync services vs Flock? In either case, the data leaves the device.

With Google Sync, the servers have access to your plaintext data. This means that Google Inc, the engineers at Google with access to the servers, any attackers that compromise Google's sync servers, or any governments that compel Google to provide them access to the servers, all have access to everything (photos, contacts, calendar entries, documents, etc.) that you sync.

With Flock, the data is encrypted with a key that only the user knows before being transmitted to the server. This means that nobody with access to the Flock servers can see your data.

Can I host a Flock server and charge money for it myself? Many people may not like having to sync their data to servers in the USA, even if the data is encrypted.

The Android Flock client works with any standards compliant WebDAV/CardDAV/CalDAV server. There is nothing stopping anyone from running a server of their own, at which point you can do anything you want with the server including charge for its use.

Is there any way of getting this to work with Syncthing or BitTorrent Sync so I don't have to use a 3rd party server at all?

Anyone remember the social web browser, Flock? I wonder if there is a minimum time before these names can be re-used.

Reply on news.ycombinator.com