Projects: Brainstorming Thread

[elimisteve]

Which projects deserve our attention?

Projects that could (or already do) impact a large number of users, or projects that could (or do) affect many particularly vulnerable users (e.g., activists, journalists, Muslims, etc).

[elimisteve]

Signal

• Improvements to Signal would help millions of people. What do you all think is most critical to add/change?
  • In my experience, the iOS app could use some love; last I checked, timestamps weren't showing correctly and so the people I message didn't know when I sent them messages :-\

[elimisteve]

Tor

Tor is at least partially blocked in several parts of the world (e.g., China). I know that Pluggable Transports try to get around this. What other anti-censorship techniques are being used?

[elimisteve]

GPG

Usability is a gigantic hurdle to getting more people to use GPG, but I talked to a core team member and he pointed out that the UIs through which non-technical people use GPG are mail clients, and the core GPG people don't really work on mail clients.

EDIT: If we're interested in contributing to GPG directly, we can start off by checking out https://bugs.gnupg.org/ and https://lists.gnupg.org/pipermail/gnupg-devel/ .

Mailpile

Mailpile is an open source (Python + Tornado), crowd-funded mail client that integrates GPG encryption in from the start and aims to be very user-friendly.

Its core contributor recently asked for code review help here! https://www.mailpile.is/blog/2016-09-23_Rebooting_Mailpile_Development.html

Mailpile has tons of potential and is nearing a 1.0 release. I've reached out to the core dev to see how interested he is in our help!

EDIT: talked to the lead dev (Twitter convo) and he pointed me to these "Low Hanging Fruit" issues: https://github.com/mailpile/Mailpile/issues?q=is%3Aissue+is%3Aopen+label%3A%22Low+Hanging+Fruit%22

[christyleos]

Buoy

• A free and open source technology for connecting users with friends and allies in times of need. It exists to empower you and your communities with a decentralized, customized, alternative crisis response system that does not rely on intervention by the police, other government services, or corporations.
• Tech: PHP
• http://buoy.maymay.net/
• Code: https://github.com/betterangels/buoy
• Contributor Guidelines: https://github.com/betterangels/buoy/wiki/Contributor-guidelines

[elimisteve]

Briar/Bramble

• P2P chat
  • No centralized servers to block/seize/DDoS or otherwise target
• Anonymous thanks to Tor
• Tech: Java

[elimisteve]

IPFS

• Think HTTP + BitTorrent
• Can host files and websites today
• Tech: Go

[elimisteve]

Sandstorm

• Open source platform for running web apps
  • Install web app as easily as a mobile app on your phone
• For-profit company, though everything is open source
• Tech: C++, JavaScript (Meteor)

[elimisteve]

Secure Polling System

• Keep polling/voting data private
• Properties: each person can vote once, can verify their vote was counted, and can vote anonymously
• Creator: Jake from Sudo Room/Noisebridge
• Code: https://github.com/securepollingsystem
• Tech: Go, JavaScript

[elimisteve]

CrypTag

• Created by @elimisteve (organizer of Cypherpunks Write Code)
• Suite of apps + encryption framework for building e2ee apps
  • "Secure apps for activists, journalists, and you"
• Can write desktop apps in any language
  • Apps talk to cryptagd, a local JSON API that handles encryption/decryption/fetching/storing/etc
• App data can live anywhere: ownCloud, Dropbox, any file-syncing service, Sandstorm, your own server, etc
  • Users invite each other to shared private folders
  • Soon: IPFS, imgur(!)
  • Makes all CrypTag apps almost impossible to block or censor
    • No global network with known IPs/domains/endpoints to block
  • Non-technical users don't have to run a server
• Optionally runs over Tor
• Prototype apps built on Electron + React.js
  • CrypTask (task management app)
  • CPass UI (password manager)
  • Backchannel (chat + file sharing)
  • Very soon: CryptWiki (wiki document editing app)
• Generic cryptag CLI tool
  • go get github.com/cryptag/cryptag/cmd/cryptag
• Code: https://github.com/cryptag
• Tech: Go, JavaScript (React.js), Bootstrap

[elimisteve]

Ricochet

• Anonymous instant messaging over Tor
• Code: https://github.com/ricochet-im/ricochet
• Project website: https://ricochet.im/
• Tech: C++

[elimisteve]

Idea: off-device encrypted video recordings

• Problem: activists want to film police in order to check for abuses, but are at risk of recording their friends doing something that could be construed as illegal or that they could otherwise get punished for.
• Second problem: recording this video on smartphones using normal video recording software isn't good enough because their devices could easily be seized by police if a police abuse is recorded.
• Current trade-off: activists either have to record locally and risk having their devices seized, or they publicly stream the video and risk getting other activists in trouble.
• Solution we could build: a smartphone app that encrypts the video files and uploads them in real-time (perhaps to Dropbox or a server) such that those encrypted videos can only be decrypted by the person who performed the recording.

EDIT: at our first event (and afterward, but Lizzie at Noisebridge), someone mentioned the ACLU has has apps for recording the police, and they send the video footage to the ACLU. So if we added encryption to these apps, that might be the best/fastest way to solve this secure-video-recording problem for people!

[elimisteve]

Cryptpad

• End-to-end encrypted real-time document editing in the browser
  • Crypto key stored in URL hash; can link people directly to a document without the server getting the key
• Website: https://beta.cryptpad.fr/
• Code: https://github.com/xwiki-labs/cryptpad
• Tech: JavaScript

[elimisteve]

Journalist request: encrypted audio recording mobile app

• "A voice recorder app with asymmetric key encryption for mobile phones so when you record testimony, only the private key -- which is somewhere else -- can decrypt the recording"
• "Can be the simplest, shittiest app ever, but the crypto has to be sane and sound"

[ajvb]

SecureDrop

• Description: "A whistleblower submission system that media organizations can use to securely accept documents from and communicate with anonymous sources."
• Website: https://securedrop.org/
• Code: https://github.com/freedomofpress/securedrop
• Getting started: https://docs.securedrop.org/en/latest/development/getting_started.html
• Tech: Python web app, Ansible for operations.

[lazzarello]

Orbot

Tor for Android

https://guardianproject.info/apps/orweb/

EDIT: People semi-close to Orbot tell me that Orbot could use some help!