>> "With Blind, users are completely anonymous, but are required to submit a verified work email to join a company channel."
That sentence doesn't make sense. How can it be "completely anonymous" but you have to submit an e-mail address?
That sentence doesn't make sense. How can it be "completely anonymous" but you have to submit an e-mail address?
During the creation process, the user gets the option to set a non-work email for password-recovery etc.
The main risk of this scheme is that a single jdoe@acme.corp could easily create a thousand sock-puppets or "give" new accounts to people who don't work at the same company.
This can be minimized by only allowing a corporate e-mail address to be used once, but that does mean keeping lists of which users in a given company happen to have accounts, even if a direct email-to-account link doesn't exist. (It seems pointless to hash the "already used" emails for privacy, since the search space is so small.)
You should probably put in some extra work to make sure that people really are anonymous, e.g. you could make the Blind server a Tor hidden service, forcing people to connect to it using Tor and therefore not revealing their IP address. Basically making sure that Blind is not even accidentally exposed to any personally identifiable information.
If so, then you can't really use a ring-per-company, because you'd first need an authoritative list of all current employees (whether they have an account or not) and their public keys, and you can't easily add (or drop) employees without creating a new ring.
Maybe it'd be OK if they had a way to authenticate without retaining any record of the mapping. And could prove it, somehow. But otherwise it's bullshit.
I mean, the Tor Project is very careful not to claim that Tor is "completely anonymous".
In addition there are two other pretty big holes. The first is the LinkedIn versification (where anyone can claim to be part of any org) and the second involves ways of receiving mail sent from the domain that is sent to non-employees (e.g. via a helpdesk ticket - a common attack against slack and other services that use domain name as a security identifier).
They claimed they used to decide what company you worked for based on your "office network information". Anyway the quality of conversation was as bad as it gets even from a trolling and gossip forum standards. Now they have moved to collecting professional email address to verify and they still say it's "anonymous". The quality of conversation hasn't changed, definitely not for better. This kind of anonymity is one hack, or acquisition, or legal request away from going for a toss.