-
Mastodon: https://infosec.exchange/@xoron
How it works: https://positive-intentions.com/docs/projects/chat
TLDR: im working on a p2p messaging webapp. webapps are generally not considered secure because of the nature of serving satics over the internet. this is correct, but not a limitation of this project. (selfhosting options: https://positive-intentions.com/blog/docker-ios-android-desktop).
as a webapp, i can provide the app with zero-installation and no-registration. the storage is local-only from your browser/device. so “the cloud”, but the cloud storage capacity is made up of your devices. this allows for things like p2p authentication: https://positive-intentions.com/blog/security-privacy-authentication.
Future: im aiming to create the most secure messaging app out there... (more than signal, simplex, etc). i know i have a have a long way to go to get there. the UI is fairly ugly for the average user, but i think the mechanics are working as expected. i think javascript is underrated in what you can do with it. i actively investigting improving the encryption approach further to align to how the signal protocol works (currently using the classic diffie-helman key-exchange).
Support: i would like to keep this project open source, but open-source funding is not working for me. i dont want your donations because it isnt sustainable for a long-term project. i have so far only experienced grant-funding rejections. i have no idea what im doing in trying to get funding for this project, so any support/advice is appriciated. in recognition of the project in its current state not able to get funding... (sorry) i will have to go close-source (which id like to avoid because it undemines several cybersecurity claims id like to make.)
Thanks for the tip. The future of the encryption is still under consideration. I'm not against the tox protocol... The signal protocol seems better regarded.
I remember when it was at the very beginning of development... Tor still seemed more confidential and not already infiltrated on a large scale, which made Tox sound even more attractive back then. Still, it's always something I mention.
Thanks. Can you tell me more about how a P2P system can get infiltrated. I'm fairly confident in my approach. I hope I'm not being too naive.
Users can always make mistakes/bad-choices and so I've tried to create some guidelines to follow.
https://github.com/positive-intentions/chat#security-and-privacy-recommendations
By infiltrating, I was referring to Tor and not to P2P solutions. Or I also wanted to imply that you would have to pay attention to this with tox, for example. So that's a plus point for your approach.