There's currently no good solution to the problem of metadata when you're handling persistent messaging. It remains an active field of research, and we hope we can contribute to the discussion.
> This is the wrong idea of what an encrypted and secure social network should be. Networks need to be moving away from this centralized model into a system of routed nodes for a secure, encrypted peer-to-peer system.
There are many people working on this problem from many different angles. The logical first step for us was to create a zero-knowledge public key infrastructure that decentralizes trust. This system doesn't preclude decentralization of data, which is another problem in itself, and it's something we're working on. The Cryptosphere project (https://github.com/cryptosphere/cryptosphere) has some really neat ideas that need to be discussed more widely.
We have to keep in mind, though, that decentralization of data is not always practical in terms of large-scale adoption and accessibility. It’s one of the reasons why Diaspora didn’t go as far as it could have, IMO.
> It's not open either, which is arguably even worse than having a central system in the first place.
We’re progressively releasing our code on Github and plan on being fully open in the near future. If you haven’t already, you can check out our white paper and some of our repositories at https://github.com/symeapp.
> while the content itself is encrypted, the "metadata" still isn't, which renders everything moot anyway. Timestamped messages are still too much information to be giving away to people
This is the same as what happens when you use PGP. You have a timestamped message and a clear link between sender and recipient. If you need to hide the fact that you are communicating with a person in particular, Syme (or PGP for that matter) may not be the right tools.
There are several very interesting solutions to the problem of metadata that are being discussed currently (https://leap.se/es/docs/tech/hard-problems#Meta-data.problem). We don't think an acceptable solution has been found yet, but auto-alias pairs seem like a promising avenue.
To decrypt messages, you need a private key, not a public key. On Syme, private keys are only available to you, and public keys are only available to your group members. We don't have access to either one of those.
If you're interested in learning more about how our crypto system works, you can check out our white paper on Github (https://github.com/symeapp/syme).
If you care about your privacy and are uncomfortable with the idea of someone reading your emails or social media activity, encryption is pretty much the only way to protect what you share, whether you're a target or not. I don't think that using an encryption app is enough to make you a serious, individual target.
I think the problem isn't only in surveillance -- it's in giving private companies access and control over heaps of data on our personal lives.
Love the interface. IMO the best selling point is encryption before syncing to Dropbox. That's really what's missing from apps like DayOne, Evernote, WriteRoom, etc. Any intention of bringing it to iOS/Android?
We're working on Syme (www.getsyme.com), an encrypted social network for groups.
We've leveraged the latest HTML5 APIs and combined them with crypto primitives like ECC 384 (for message confidentiality), ECDSA (for message authentication), AES 256 in CCM mode (for message integrity), PAK-DH and ECDH-HMAC (for secure key exchanges), and PBKDF2 and SRP (for user authentication and credential generation).
The technical challenge for Syme is to create a decentralized public-key infrastructure with no single point of trust, so that no central server or trusted third party is required to establish trust between users.