apayan

Hi hiq. I think WhatsApp's Live Location definitely satisfies many use cases. The biggest distinction I see between it and Zood Location is that Zood shares your location continuously, which is useful for families. The sharer doesn't have to re-enable the share every 8 hours. Zood also has an expiring share feature called Timed Sharing [1]. Zood will generate a link you can send to anybody (no Zood required) and the recipient(s) can view your real time location via any web browser, all end-to-end encrypted.

> There might be better vistas in B2B.

That may indeed be the case. It's something I need to investigate further.

[1] https://ara.sh/private/hn-zood-timed-share.png

Hey unixhero. If you have the time and interest, I'd love to have a call or video chat with your about your experience in this market [ arash at zood d0t xyz ].

> The logs of location sharing uploads and queries contain two pieces of information that together would allow for certain types of analytics

Yes, metadata can always be analyzed and exploited. I just hope that by open sourcing the server and the client, that I can earn some trust from people to know that I'm not doing anything like that. This is not a problem unique to this server, it's a problem of all servers in the world. And if a user is particularly concerned about exposing their IP to the server, they can always access it via a VPN or proxy server.

Zood Location can't overcome every single threat out there, but it can significantly reduce the number of threats you have to deal with.

Hi emilburzo. I'm happy to learn from your experience here. Yeah, selling "just" a location sharing app is indeed tough.

> how often do you update the location? I couldn't find any setting for that.

There's no user setting. On Android, I rely on the Job Scheduler service, so the most the app can be woken up is once every 15 minutes (less if the Android OS feels like it). However, there is also a BroadcastReceiver set up to receive locations when another app requests it. Lastly, a friend can request an update if it has been more than 3 minutes since the last update they've received. When they request the update, a Firebase message is sent to your phone and a service is started immediately to grab your location and send it back to your friend. The reason for all this fuzzy timing is to maximize battery energy. The alternative would be to keep a foreground service running all the time, but I've had complaints that people don't like seeing the service notification there and they don't want their battery drained.

In the (currently unreleased) iOS app, it's a similar set of of fuzzy conditions.

> PS: The email verification page is blank.

Thanks, I'll check that out.

Hi Chris. Thank you so much for chiming in! Lots of families that I know use Life360, and really love the peace of mind that it provides them. The success of Life360 in this space is what gave me the courage to actually follow through and implement as much of Zood Location as I have.

> What we have found is that the average customer doesn't really understand privacy. They would likely not understand the difference between this and any website that puts the "256 bit SSL encryption" blurbs on checkout.

I totally agree with you. I'm just focusing on building an easy to use service, and the cherry on top will be the privacy guarantees, and right now that guarantee is a big deal because I'm introducing it to folks on HN. :)

Hi atonse. Believe it or not, this was a use case that I was considering when developing the service. Speaking with folks at various conferences I've been at, there seem to be more than a few industries where it's necessary to quickly identify the physically closest employee that can be dispatched to resolve an issue. If you'd like to chat about it some more, send me an email [arash at zood dot xyz].

I think a private instance of the service might even be the most useful solution for you.

I replied to a similar concern earlier in the thread: https://news.ycombinator.com/item?id=25350301

However, with Zood Location, it's probably more likely that the map tiles will correlate to where your friends are. At least that's the way it ends up working out for me.

I have the desire for the same functionality. I really enjoyed the timeline history that Google Maps provided for me, but I ultimately disabled it out of privacy concerns. If there is a way to get revenue with this project, this will certainly be one of the app's future features. :-)

There's no whitepaper, but someone else in the thread already did an impressively speedy read through and breakdown of the crypto. https://news.ycombinator.com/item?id=25351388

In short, there's no custom cryptography in the service. The core crypto is all performed by libsodium.

> I think this is cool and ambitious

Glad you like it!

> I think you'd be hard-pressed to guarantee security against a nation state.

My intent with that statement was not to mean that one would be protected from a nation state that has turned all its attention to you. I think that's an impossible level of security to guarantee. Signal could not even guarantee such a thing. The intent in the statement is that "a government agency can't simply send Zood a National Security Letter or some other coercive legal document and expect Zood to turn over location data about users". And that's because Zood doesn't handle user location data; there simply isn't anything to be turned over.

The goal with Zood is to create software that allows regular people to conduct their digital lives without giving up all their privacy and dignity. To prevent further expansion of the surveillance economy. The goal is not to build software that defends wanted individuals (whether right or wrong) from nation state actors. That's not something that I think any single technology company can provide.

If there exists an investor that cares about building software and services that preserve human dignity, I'd be happy to meet them and find a way to work together.

> I'm an iOS user and so are most of my friends. It would be good if you added a little thing to your site to let me sign up to be emailed when it's available to try out.

If you want to send me an email [arash at zood dot xyz], I'll send you a reply as soon as the iOS app is available. Don't worry — I won't put you on any mailing lists. I don't even have the energy to create a mailing list. :-p

I'd like to, but I don't think Zood Location meets the policy requirements for inclusion in F-Droid. Blockers are:

* Usage of the Google Maps SDK - the service needs revenue to be able to support running and maintaining it's own tile server

* Usage of push messages via Firebase - the zood server has no problem with a socket remaining open all the time with the Android app, I'm simply not sure what the impact would be on the battery.

* Usage of the FusedLocationProvider API - a code path needs to be added that would simply use the platform provided GPS access. It wouldn't be too difficult, but it would hurt accuracy and battery life.

* Usage of locationiq.com API - similar to the need for a Zood tile server, I would need to stand up my own reverse geocoding API somewhere so F-Droid wouldn't need an API key for locationiq

That all said, I do think it's a worthwhile endeavor to make the app F-Droid compatible. I just can't provide any guarantees about when that would be.

> One thing I've actually not seen is E2E contacts & calendars. Everything seems to be based on CalDAV & CardDAV which I think forces you to sync them with a server in plaintext. Email is mostly a lost cause, the closest you could approach it is something like protonmail AFAIK.

Totally agree. I think the natural progression of things to replace would be contacts and then calendaring. For the life of me, I can't figure out what should/how to replace email. Or simply make it more secure for the masses.

I see. Thanks for the follow up.

Yeah, I'd happily pay for a privacy preserving mapping app as well. While building this, I felt the need for such a service, and as I pondered it, I felt overwhelmed by the effort to bring such a thing to market. It would also need a significant amount of notoriety to get people to contribute by updating business and city information. The other challenge is that Google Maps is just SO GOOD! I realize it's not great for privacy reasons, but it's simply so easy to use and useful. That's a high threshold of quality and functionality for a new entrant in the mapping space to achieve. That's not even taking into consideration that this new entrant would be charging for something that Google gives away for free, and has had years to perfect. We can see an example of this struggle with Apple Maps.

> send someone a link that gives them time-bounded access to a subset of location information (most commonly live information about current location).

You might be happy to know that that functionality is already present in the app. :-) Simply click the floating action button at the bottom right of the main screen of the app, and a timed sharing dialog will appear. Toggle the switch to turn it on, and your location will be broadcasted to a drop box that can only be accessed by the key encoded in a URL that you can copy or share to any app (Signal or otherwise). You can adjust the expiration time of the link based as well. It's particularly useful if you're running late to a meeting and you're stuck in traffic, and you want to let the person you're meeting know where you are in real time.

> if i could integrate it with my Matrix homeserver

Could you describe in more detail what kind of integration you're considering? Would you just want to be able to see your friend's location published in a channel as they move?

Signal allows you to explicitly open the app, get your current location, and send that snapshot of your location to someone immediately. That's definitely fine for some use cases.

Zood Location lets you share your location with other people without having to do anything on your part (besides accepting the initial friendship). Then your friend can simply open Zood Location on their phone and they'll be able to see where you are and you won't have to do anything. It's very useful for families trying to coordinate dinner plans after work, determining how soon your partner might be back home to help with the kids and other seemingly trivial things that usually require multiple disruptive calls and text messages.

It's a fair question. I want this to be sustainable, and you want the services you rely on to be sustainable.

In truth, I'm trying to determine a pricing model right now via this Show HN. I don't intend to "yank the free version" from anyone. Maybe I'll be able to find a freemium model, maybe I'll be able to acquire sponsorships, maybe there will be a way to simply charge for it... I don't know. But folks that start using it now will be grandfathered in, so you don't have to worry if you don't want to pay.

I don't (and won't) have any investors that I need to satisfy. So there's no VC breathing down my neck, pressuring me to squeeze users.

I hope that's a satisfactory answer to your question and that it allays your fears. :-)

Thanks for the feedback JoshTriplett. :)

Could you describe in more detail what you have in mind regarding "map integration and messaging/Signal integration"?

I totally get what you mean about triggerring events based on location (turning off lights, etc.).

> I'm unable to try out the android app, since I'm on iOS

I don't have a formal list set up for this, but if you would like to be notified of when the iOS app is ready just send me an email [arash at zood dot xyz], and I'll send you a reply when it's ready.

> one idea that would be cool is to set the accuracy of the shared location

Great idea. I hadn't considered that. Using geoIP mode would also be worth investigating. I've often found geoIP to be quite inaccurate when on cellular networks (e.g. reporting that I'm in San Jose when I'm actually in Los Angeles). Any thoughts about that?

> It's too bad you can't force location services to only use built in GPS vs pinging their internet servers.

My understanding is that on Android if you only use the platform location services instead of the Google Play Fused Location Provider, it will only access satellite positioning (GPS, GLONASS, etc.). It will also use up your battery faster, but I think that's tangential. So, at least on Android, I can code a path to only use location services.

> Apple also has an issue where they silently stop location tracking apps in the background, you might have to make a nag notification

That has been a real pain in my side on iOS and Android. So many deceptive apps have abused the location system for so many years, that Apple (especially) and Google are making legitimate use cases of background location very inconvenient. I can't say I blame them either.

I love the comment! Thank you some_furry. You're a quick code reader.

You're correct that it doesn't offer key rotation or forward secrecy. That's something I definitely want to add (assuming anybody actually finds this service useful).

> One thing I didn't see was message padding of location data prior to encryption, to prevent side-channel attacks via ciphertext length. [7] I don't know if I missed this, or if it was omitted.

You didn't miss it. It's not there. It's something I should add.

So would I. :-)

It's on my TODO list.

That's not my app. Zood Location has zero analytics or telemtry [1]. The app id in the link you provided is some banking app with an id of 'hr.erstebank.george'.

Zood Location's app id is 'xyz.zood.george'. The only thing they have in common is the word 'george' in their app identifier string.

Zood Location also has a privacy policy. [2]

[1] https://github.com/zood/george

[2] https://www.zood.xyz/privacy/mobile-apps

Hey fitblipper. Good questions. :)

> I would like more information on what information exactly zood receives and stores.

When you sign up, the Zood Location server receives

* the username you picked

* (optionally, if you provided it) your email address

The server also stores a backup of various pieces of data for you, but this data is encrypted on your phone before being backed up to the server. It's exactly like how a password manager backs up your passwords to the cloud so you can access them from any machine. THIS DATA IS ALL ENCRYPTED ON YOUR PHONE with a key DERIVED FROM YOUR PASSWORD before the blobs are sent to the server.

The encrypted data includes:

* your symmetric key

* your asymmetric key

* your password salt

* the algorithm used for your password derived key (currently, argon2id)

* your friends list and their public keys (for TOFU reasons)

Again, all that data is encrypted in the app on your phone before it ever leaves your device. This is no different than using a password manager.

> Does zood know who is sharing with whom?

The most information that the server can ever see is that some user sent some communication to a particular user. The contents of the message are unknown. Location sharing actually happens through "drop boxes" to make it more difficult for the server to see when and how often users send communications. When a friendship is established, the friends agree upon drop box addresses to use for each other, and they simply place encrypted data in the drop box for the other user to check whenever it wants.

In theory, I could perform metadata analysis to try to statistically determine friendships, but I still wouldn't know anybody's location. The server code is available, and not terribly complicated so it's easy to verify that no analysis is happening there [1].

> Is the data usage to username logged?

For debugging purposes, I can have the server log to stdout when a user makes a REST call to drop an encrypted blob on the server, or when a REST call is made to send an encrypted blob to another user, but that's off in production. It was there to help me build the thing.

In general, thwarting metadata analysis by the person running the service is tough. I look to what the Signal messenger folks are doing in this space to improve things.

> Is the amount of data sent to zood increase as a function of 1. How many people you are sharing your location with

If you have more friends, your phone will send more encrypted blobs to different drop boxes on the server. The reason is that though you only physically exist in one point of space at a time, because communication with each friend is end-to-end encrypted, your phone will encrypt the location info payload for each friend with their own public key. So if you have 5 friends, every time your location changes, your phone will encrypt the payload 5 different times and place it in five different drop boxes on the server.

> 2. If you are traveling quickly

That's based on your phone's operating system and version. Google and Apple are always tweaking how often location updates are reported to apps. But if a location update comes in, Zood will encrypt it and upload it.

> 3. If you are on battery saver or not?

I don't really use battery saver, but I think location services is disabled when your phone is in that state, so Zood wouldn't get any location updates at all. I could be wrong about that.

[1] https://github.com/zood/oscar

Hi huntenberg. Thanks for the thoughtful reply. :-)

> That said and if I read you correctly, the backend must be some sort of a dumb relay that just routes blobs of data between clients based on how they are grouped. Correct?

You're correct. It is just a dumb relay. That's the reason why it's so difficult (impossible?) to come up with a freemium monetization strategy. The server can't see the contents of your communications, so it can't restrict functionality.

> If so, then nothing restricts you from relaying any type of data, which is a fantastic foundation to have.

I suppose so. What did you have in mind?

> Do you have any details on how two clients would establish trust, exchange keys, if there's a replay protection, etc.? It would make for a good read.

I don't have anything written up about this (other than the code in the repositories), but if there's interest, I could compose a blog post about it. For the time being, users can verify the privacy of the communication with another friend by comparing the safety number of the friendship (tap the friend's avatar on the map, in the info panel that pops up click the triple dots at the top right, then select 'View safety number'). If you're safety numbers match, you know your share with that friend is secure. I got the idea from Signal messenger.

> PS. One thing I'd change is the name.

Yeah, I'm still reconsidering the name. I've already changed the company name once, but I may have to change it again. It's just hard to come up with an easy to remember+spell name that also has an available domain.

You hit the problem right on the head. The only way to really solve it is to host my own tile server (expensive) and add some sort of 3rd party proxy service between the app and the Zood tile server (so Zood could not surveil your tile loads).

I'd like to host my own tile server in the future, but it depends on revenue, which is just not there right now.

Also, and this is just my opinion, I don't think Google is trying to surveil people via tile loading patterns. I'm not saying it's impossible, but there are far easier ways to surveil users than examining tile loading patterns. So for the time being, I'm ok using the Google Maps SDK.

Privacy, like trust, is not binary, but a spectrum. My hope is that Zood Location can start increasing the amount of privacy people enjoy in their digital lives, and over time, the app can be improved to increase that level of privacy.

Thanks for the supportive words rasengan. :)

My current understanding is that location data is not leaked to Google or Apple by just enabling location services (I'm always happy to be proven wrong :-) ).

In the case of Google/Android, they make it very easy to unknowingly opt-in to sharing your data with them, but it's not too hard to double check that and disable+delete the data it if was on [1].

I know there has been much news about Google providing police with a list of devices near the time and location of a crime, and I believe that data is coming from the Location History feature of Google accounts. But that's something that can be turned off.

Apple more explicitly requests the data via app permissions on your iPhone, so it basically comes down to what Apple apps to which you've given location permission [3].

[1] https://support.google.com/accounts/answer/3467281 [2] https://support.google.com/accounts/answer/3118687 [3] https://support.apple.com/en-us/HT203033

Thanks for the feedback lambda_obrien.

Zood Location only sends your location to users that you have explicitly added, and your location data is end-to-end encrypted before leaving your phone meaning that the data can only be decrypted by the person your sharing it with (i.e. your wife or your son.

As for your personal data, Zood doesn't get any of it because of the end-to-end encryption. All the server [1] does is accept blobs of effectively random bytes (encrypted) from users to deliver to other users.

Even if I wanted to sell user data, there wouldn't be anything to sell. Everything is encrypted before it leaves your phone. It's just like Signal in that regard.

[1] https://github.com/zood/oscar

For Zood Location, I'd like to add a 'Find my phone' feature. It's already mostly done in the Android client (I don't think it's possible on iOS). I just need to implement a landing page on the web that folks can use to log in and make their phone start ringing.

Re: other services.

I'd like to implement something akin to Google Photos but where all your images are encrypted before going up to the cloud for storage. All the fun face recognition features and indexing would have to happen on your phone, but phones are plenty powerful enough these days to do that while you're sleeping and your phone is plugged in and charging.

I'd like to implement a simplified personal assistant like Google Now, that doesn't depend on sending your personal data into the cloud. Again, phones are so powerful and they already know so much about you based on local context, that I think there's a big opportunity for making a "good enough" assistant that doesn't compromise your privacy.

More mundane, but I think still very useful, is being able to store your contacts in the cloud, but making sure they're encrypted with a local key you control, so the storage provider (e.g. Zood) can't see your contact list.

An actually trusthworthy VPN provider. Mozilla entered this space a couple months ago, and I think it's great that there is at least one trusthworthy VPN brand now. It's a very confusing market for people to navigate, but I'd like to earn the trust of people so a Zood VPN product would become a viable service.

Along the theme of helping people extricate themselves from the advertising and surveillance economy, a service that helps people remove themselves from these junk snail mail lists. You can do it on your own right now, but it can be overwhelming.

I have lots of other little ideas, but they aren't quite ready for discussing. :-)

Correct. The servers never see anybody's location.