Hacker News Reader

Comment by david927 | Hacker News Reader

I think the most critical thing we could do is to make a small app that handles direct P2P communication. Let's take the internet where it was built to go.

For example: Each person stores encrypted their contacts routing information. You can direct-message (server-less) if the person is online, or if not, send it encrypted to others who are online, and when the person logs in, it's routed on to them. You could do micro-blogging like this, where messages pulse out to two or three degrees of separation, and only if they are validated (i.e. liked), do they push on further. This lets spam die soon (or sooner if it's marked as such) but important messages will make their way through the system.

View on HN

> I think the most critical thing we could do is to make a small app that handles direct P2P communication.

Agreed. In order to actually solve the problems we face though, this p2p app needs to always encrypt messages -- even for indirect messaging. It needs to solve the authentication problem. And it needs to be opensource for perpetuity.

Forward secrecy ("I threw away the key") and repudiability ("You can't prove I sent that") would also be nice. OTR has these and I highly recommend reading the OTR papers [1] [2].

All in all this is a tall order. Heck, authentication alone is a tall order. The OTR Pidgin plugin has you enter a shared secret in order to authenticate a new buddy. I'm not sure this is ideal. Normal users will agree on that shared secret through an insecure channel like phone or text, or just use a guessable one, opening the door to a MITM attack at the most critical stage.

I'd rather see a web of trust [3] solution to the authentication problem. Bootstrapping the trust network is of necessity harder because it requires more careful interactions, usually f2f, but it does enjoy a viral property: the more users in the trust network, the easier it is to fill out your authenticated contacts list, since you'll be getting many of their identities through WoT introduction.

Maybe the existing GPG web of trust could be used as the base -- ie, offer import of GPG keys and trust database, or just reuse the GPG code straight up.

[1] http://www.cypherpunks.ca/otr/otr-wpes.pdf

[2] http://www.cypherpunks.ca/~iang/pubs/impauth.pdf

[3] http://en.wikipedia.org/wiki/Web_of_Trust

I know it's hard but I also think it would be one of the most important things we could do.

If you or anyone else is interested in building this, email me.

I think the holy grail of P2P networks will be when we have something like Bluetooth that has a significantly better range. So we can really exempt ourselves from private infrastructure.

http://en.wikipedia.org/wiki/ZigBee ?

These things are made, and then they fail due to lack of interest.

The problem is that these things solve a theoretical problem, not an actual need.

Doesn't such a validation system place a model for censoring in the very architecture of the system?

Only in the way Page Rank is for web sites. It's reputation-based message propagation.

I would even argue that it's necessary. Without this, it would susceptible to attack by injecting noise to drown out the signal.

Retroshare?

Am thinking devoting our focus on such privacy-focused projects as :

Tent [ https://tent.io/ ] : the crypto-social network protocol

BitMessage [ https://github.com/Bitmessage ]: crypto-P2P message protocol

If more people can join these efforts (even as early adopters), it would do us all (the entire internet village) a great benefit in fighting back against the System.

Reply on news.ycombinator.com