Sure Marky Mark still sees when you post, who you send messages to, etc. but it's a much better situation than what's going on now. Plus it would probably put a dent in their bottom line, and so send them the message that privacy matters to people.
Zuck can't add any encrypted content to your personal profile, which means he doesn't make any money off you. And Zuck can do pretty much whatever he wants in his castle, I'd say.
We could might be able to help. Even just with small things like design analisys and testing.
> the trick is to do it in a way that doesn't require a PhD in computers to operate the damn thing, as was the issue with previous attempts
This sounds similar to the story of PGP. Many attempts have been made to get people to use it, but it just didn't catch on (on a big scale). So I'm curious: how will it be different this time?
Unless ofc you're just building this for yourself and your friends, which is something I thought about doing myself but then realized that even my friends cba to install yet another chat app.
That's the same reason Facebook would never beat MySpace and MySpace would lose out to Friendster.
Metcalf's Law and initial traction are real challenges to achieving critical mass of users, but it has been done. I'm biased to hope for @ghughes success and that enough people care about privacy to give it or similar services a shot.
When you post, the content is sent as an encrypted message that can only be decrypted by people who should be able to see it (either all of your friends or just a subset of them). The client automatically takes care of key management and is responsible for keeping track of sent & received posts, comments, etc; it renders a news-feed-like UI on top of that data. The end result is a familiar UX on the surface, but the underlying mechanism for transmitting data between users is far more secure than the traditional approach of using a monolithic database that contains everyone's data in plaintext.
> If things are encrypted, how are you going to determine relevance, etc.
The client is solely responsible for that. For now the "news feed" is strictly chronological, but I plan to augment it later by prioritizing posts that might be particularly interesting to the user. There are plenty of ways to make those decisions locally.
can we get in touch somehow ? too bad hn doesn't allow private messages.
Look at how fast AdNauseam got the boot from google to get an idea.
It is simply necessary to have the plain-text in a publically known format, e.g. prepended with date or name or whatever. Then you post the cypher-text to your "timeline" (or whatever it's called) and try decrypting all your friends' posts to find which one is meant for you.
To get around Fb-imposed usage restrictions use a steganography or obfuscation tool. https://seecret.io is already linked to somewhere on this thread.
What channel would you use to share the keys on FB? The Facebook API simply will not let you do that anymore. Direct messages have a character limit and you can't just post to someone's wall anymore.
I tried working on something like this for seecret.io but was confounded by the Facebook API's limitations.
Twitter is much better for that. Probably other network too.
The main issue is that there is no reason for companies like Facebook to fully adopt it, since it doesn't benefit them and there is no outside pressure forcing them to do so.
It's interesting to contemplate WHY is there a difference between the two. Security and Private both nasciently have something to do with "info I'd like to keep to myself", but I'm not sure I can come up with a hard delineation between the two, at least when you try to go above "A/S/L" and below "user/pass".
A privacy breach allows... what? Where's a direct threat?
A privacy breach can be a first step to a security breach, though. Social engineering is all about it. Social networks can be, too.
A privacy breach could mean that your job application is rejected, that you pay higher interest on a loan or higher insurance premiums.
It could mean that your health insurance refuses cover for some treatment because some data points towards a pre-existing condition.
You could be rejected as a tenant based on the scoring done by a referencing agency or you could get searched every time you cross a border.
In a more unlikely event could even become the victim of a miscarriage of justice or get blackmailed by a corrupt government official.
Any means of authentication that relies on personal data. SSN, mother's maiden name, postal address, date of birth, etc.
Snoopy relatives of women I have dated a couple times, a couple times by PIs paid to track me down, and a stalker once.
So...yeah. It's a real problem and none of these people had a legitimate cause to do so. Even beyond FB, etc. I don't post my face online because of shit like that.
Other people have stopped posting pics of me as well, a couple people have been called based on my name being tagged to things on social media.
There has been no corresponding increase in the difficulty of invading privacy. 30 years ago, even though you probably “could” observe somebody for a long time and eventually connect some dots about them, it would not really have been worth your while (and you certainly wouldn’t have been able to do it for thousands or millions of people). Now, it is ridiculously easy for computers to dredge up information and instantly transmit it, slog through it and basically connect every imaginable dot. There needs to be a new standard for privacy: just like you want a 2048-bit key, you want the equivalent of a “make life a pain in the ass for Facebook” key on EVERY DETAIL of your life.