Re:Scuttlebutt, a Decentralized Alternative to Facebook
by ianopolous on Friday April 20, 2018 @04:17AM
(#16883042)
You very definitely don't need to expose the social graph to the api. We are doing exactly that in Peergos [1][2]. Your social graph is only stored in encrypted form in your own storage space (in IPFS). The source of a follow request can't be deduced by anyone except the recipient.
If you start integrating Tor/i2p hidden services, even global passive network adversaries will struggle to figure out the social graph from network monitoring.
Re:Scuttlebutt, a Decentralized Alternative to Facebook
by ensignavenger on Friday April 20, 2018 @10:15AM
(#16884917)
If the recipient can access it, then the recipient can grant access to a third party- which is what happened with Facebook/CA. People unwittingly shared the information their friends had shared with them with a third party.
Re:Scuttlebutt, a Decentralized Alternative to Facebook
by ianopolous on Friday April 20, 2018 @11:02AM
(#16885324)
That is clearly fundamentally true of any information. The question is what is shared by default. We don't even share your friend list by default, so the exposure is much less.
Re:Scuttlebutt, a Decentralized Alternative to Facebook
by smsm42 on Friday April 20, 2018 @05:42PM
(#16888664)
Default are powerful, but you are always one "Please click this to enable new exciting ways to play Candy Crush" away from any non-default setting. It may be true that FB users value their privacy, but reflecting these values in minute-to-minute behavior is a much more complex question. People are not always vigilant or realize what exactly is the consequence of their actions.
Re:Scuttlebutt, a Decentralized Alternative to Facebook
by smsm42 on Friday April 20, 2018 @05:39PM
(#16888647)
From what I understand, in Peergos the friend list is stored on certain node. Which means software running on that node can see your friend list - which is essentially what happened in CA case, except maybe Peergos does not allow to run third-party apps on private node, but even if they didn't currently, I see nothing preventing from this happening in the future. What happened in CA case, AFAIK, is that users allowed the software to access their social graph data, and that software compiled it into a database that was used for purposes the users didn't intend to. If we assume that the users can run third-party plugins on a Peergos node, why isn't that possible with Peergos?
Re:Scuttlebutt, a Decentralized Alternative to Facebook
by ianopolous on Sunday April 22, 2018 @01:50AM
(#16894888)
Nope. Nothing (apart from your username, which is public) is ever stored unencrypted anywhere. Even your own Peergos server can't see your friend list. It is decrypted by your client when you log in.
We don't currently allow third party apps in Peergos, and when we do they won't be able to access the social graph, nor will they be able to connect to the internet, nor anything else outside peergos. So that data can't be exfiltrated.
Encryption has nothing to do with it. The whole issue with CA was that they (just as many apps before them) were using Facebook social graph data that was available for them to access via the API. Encryption on any layer has nothing to do with it - if you have access to the API, you get the data. In distributed system, if you are a node in the system, you have to have access to social graph data - otherwise the whole concept of social network does not work. You can't "see what your friends are doing" if there's no information about who your "friends" are. And if the nodes on the network have information about who your friends are - or can get that information - then they have the same access as CA (and many other apps before them) had. Facebook can at least (if they wanted to) cut off the external API and not tell the social graph structure to anybody outside Facebook. I don't see how this is possible in a distributed network.