morroccomole

Not too many Silicon Valley software companies on that list

Money != Currency. Gold and Silver are Money. Bitcoin and USD are currencies. Huge difference.

What are you going to DO about it?

Indeed, browser also implement things like CSP - and we need browser to also support additional security measures that enhance the API

For the record this is only the First Public Working Draft. A lot can and will change. We are looking for commentary to understand if we are on the right track

This position is the bullshit.

This argument is made by those that are completely satisfied with their design. A little engineering knowledge on their part could never make the design even better. no, never!

There is the Salmon protocol: http://www.salmon-protocol.org/ as well.

It is not impossible. It really needs to be done. Oh, and Twitter will be the next AOL once something like this working well

I'll toot my own horn and say that I saw the writing on the wall 4 years ago and moved to Ubuntu. Best decision ever. I lack for nothing. Apple is the new Sony - no thanks.

The encryption should really take place in a scope that content JS cannot access. I also think a system like this should be built completely parallel to email systems. Email is crap and needs to be re-invented as a web app with pseudo-anonymity and Public Key Encryption on by default. Users should not even know they are using encryption.

Working on this exact problem myself: https://droplettr.com - the encryption uses Firefox Sync crypto module in an extension, so the crypto is done by the browser outside the scope of content JS. The rest of the app is pure JS and HTML, with a Python/Django REST-style server.

The Diaspora crew came to my company and gave a talk. It was pretty boring actually. They ARE NOT interested in cryptography in the first place. The only crypto going on is SSL. Whoopy-doo-dah.

If they wanted to actually solve a problem they could have tried to make this system pseudonymous, with all social graphs, user data and messages encrypted. Oh well.

I assume the JS Touch APIs are for apple hardware only, or 4% of Firefox users.