Show HN: So.ciety, an end-to-end encrypted social network

Re:Show HN: So.ciety, an end-to-end encrypted social network by rubbingalcohol on Wednesday December 03, 2014 @11:11AM (#8694458)

tptacek is right. In order to trust your crypto we have to trust that your server isn't compromising your crypto via malicious JavaScript, so when you claim that we don't have to trust the server, you're asking us to both trust and not trust the server.

You could do a Chrome extension with all the frontend code baked into the extension's static JavaScript. Firefox still has no sandboxing for add-ons, so you wouldn't have luck there.

Desktop / installed apps would be the way to go. See https://turtl.it for an example of this (shameless plug)

[ Parent | on HN ]

Re:Show HN: So.ciety, an end-to-end encrypted social network by nhayden on Wednesday December 03, 2014 @11:32AM (#8694618)

I wonder if it'd be possible to sign the JS a site serves you, so you know it's unchanged from when you originally got it?

[ Parent | on HN ]

Re:Show HN: So.ciety, an end-to-end encrypted social network by nunyabuizness on Wednesday December 03, 2014 @11:47AM (#8694732)

You can sign it, but then your clients would have to install an extension to verify it.

[ Parent | on HN ]

Re:Show HN: So.ciety, an end-to-end encrypted social network by handsomeransoms on Wednesday December 03, 2014 @03:09PM (#8696060)

I think it's theoretically possible to use Service Workers to do this, giving you a TOFU trust guarantee, although I think there are some issues due to the spec-mandated auto-updating of Service Workers every 24 hours.

[ Parent | on HN ]