Hacker News Reader

Comment by johnm | Hacker News Reader

What are the threat models that you care about (in some sort of rough rank order)?

The primary threat this protects against that other services don't is that the service hosting your data cannot mine it, their engineers cannot snicker at it, and they cannot accidentally release it.

It's not tremendously secure from a client-side perspective: if the client machine is compromised, so is your data. But that's not the goal. This is not a tool for spies, this is a tool for everyday people so they can have an unimpaired communication tool while having complete peace of mind that nobody is mining, selling or distributing their data.

The host can still mine data. It doesn't know the content of the data itself, but it knows who's looking at whose data, and what IPs they're coming from and what browser fingerprint they have. The only thing you're protecting against is the accidental release of customer data. You'd be better off programming the server in some theorem-proving language that proves sensitive data isn't leaked.

What you end up with is a slow, unintelligent website, with fewer features and untargeted advertising that can't recommend friends. It can't do anything useful that social networking butterflies are interested in, and it's one that people who use secure services because it's fun to be paranoid aren't interested in either, because it's not actually secure, and it's a site that's more expensive to run and more complicated.

Don't do it.

This was my thought given the browser trust model, the server would just have to deliver a payload to the client and let the client send the encrypted data back to it.

Reply on news.ycombinator.com