1y ago

A decentralized, blockchain-based messaging network for safer communications

techxplore.com A decentralized, blockchain-based messaging network for safer communications

Data and security breaches are becoming increasingly common, highlighting the vulnerabilities of existing messaging and communications platforms. Devising computational tools and systems that better protect sensitive data against malicious attacks is therefore of utmost importance.

Researchers from several institutes worldwide recently developed Quarks, a new, decentralized messaging network based on blockchain technology. Their proposed system could overcome the limitations of most commonly used messaging platforms, allowing users to retain control over their personal data and other information they share online.

Technology @kbin.social

0x815 @feddit.de

1y ago

A decentralized, blockchain-based messaging network for safer communications

techxplore.com /news/2023-08-decentralized-blockchain-based-messaging-network-safer.html

2 1

114 comments

I'm a simple man, I see blockchain, I downvote.
- I understand the impulse, but I think that’s a knee-jerk reaction. I am immediately suspicious of any technology that claims to use blockchains.
  
  Possibly. But it's a well-deserved knee-jerk reaction. I just really hate reading anything the sick mind of a cryptobro has come up with.
- It’s just something for a very specific usage.
  https://gist.github.com/joepie91/a90e21e3d06e1ad924a1bfdfe3c16902
  You shouldn’t be so intolerant. But I agree, here it does look like bullshit.

I don't see how blockchain (in this case) adds any value over a federation like Matrix.
- I doubt these bozos know of federation. Hell they forgot about the existence of p2p based comms like jami.
- It adds value by helping convince clueless investors to give you money. I'm entirely serious. There's a significant number of investors that think blockchain technology is a good thing. Doesn't matter that it's a terrible solution to practically every problem. The goal isn't to be a good solution. The goal is to make money. They only need to convince a few clueless people to give them that.
- This system is federated.
  The blockchain means that you can access your encrypted messages even if your server goes down.
  
  you and everyone can access those encrypted messages. You are the only one that can decrypt them, sure, but as others have already mentioned, the history of encrypted messages is almost as bad as the actual content.

Publishing everything on a blockchain means that everybody who's running a node has access to a copy. If confidentiality of communications is an issue, this may as well be a data breach with a few more steps. Also, how does giving everybody running a part of or monitoring the blockchain equate with "control over personal data?"
Centralized control: Only one entity can see it. Blockchain: Lots of third parties run a node, so every node can see it.
Each channel has a separate ledger: That makes surveillance of a particular communications channel much easier. Thanks. Also, each user has to have a keypair; great for pseudnonymity, lousy for repudiability.
Messages cannot be altered but they can be audited to prove their metadata. Did they learn nothing from the Obama administration? At this point in the paper I can't shake the feeling that this is a deliberate effort to invert all of the properties of privacy.
Smart contract: Yay, more deliberately memory unsafe programming. I guess they never played with Core Wars as kids, either.
An attacker would be unable to breach the network: An attacker would just have to stand up a node. If channels are side ledgers on a blockchain, and the network assumes that nodes can come and go (which they all do, as far back as bitcoind), any node can join, say "Hey, I'd like to join this channel," and get at the very least a pointer to the side ledger for that channel.
Long-term storage of communications is dangerous, mm'kay?
- Publishing everything on a blockchain means that everybody who’s running a node has access to a copy
  I'm not sure that's the case, although the article is rather vague. It says:
  [...] the user must register with a node of their choice using their public key. Once registered, users can create channels and invite others to join. Each channel has a separate ledger hosted by the nodes. [...] The data in the ledgers are encrypted, and the secret key is managed by the users of the channel.
  IIUC, nodes will not have access to private keys, neither those from users nor those from channels. Users could use their keys to exchange the channel's private key without the node getting to know it. I don't quite understand how user's would exchange their public keys without the node being able to play MITM, though...
  Edit: Removed an irrelevant sentence from the quote
  
  I believe their point was that even encrypted messages convey data. So if you have a record of all the encrypted messages, you can still tell who was talking, when they were talking, and approximately how much they said, even if you can't read the messages.
  If you wait until someone is gone and then loudly raid their house, you don't need to read their messages to guess the content of what they send to people as soon as they find out. Now you know who else you want to target, despite not being able to read a single message.
  This type of metadata analysis is able to reveal a lot about what's being communicated. It's why private communication should be ephemeral, so that only what's directly intercepted can be scrutinized.

No, this is already solved without scam shit tied in.
- Eh, I wouldn't go as far as calling distributed ledger tech a scam. Sure, 99% of the current ecosystem is at best digital tulip trading if not an outright scam, but that doesn't mean everything blockchain-related is a scam.
  There's valid use cases for what's essentially a distributed database with immutable history (or a "smart contract" system which is essentially a distributed singleton VM with immutable state history), but NFTs etc ain't it. Fintech will probably incorporate some of the stuff that came out of the blockchain craze, but I figure that at best it'll be like Linux; most people who use the internet interact with Linux systems pretty much all the time, and of course Android is a Linux-based phone OS, but very few actually run Linux or even care about the whole concept. It's just part of the infrastructure, which in my assumption some kinds of blockchain-ish technologies might be. Probably just not the public networks people associate with it now, but private / internal ones with limited validator sets etc
  
  People keep saying there’s a valid use case for this but what is it? Basically any distributed ledger would actually perform better, be more secure, and be easier to use as a centralized database.
  
  Blockchain is a tool for scammers used for scamming, and has almost exclusively been used for such.

People are still looking for problems to which blockchain is the solution.
So far we’ve found none.
- How about the problem of stupid people having to much money?
  
  Best suggestion so far.
- You're right. A blockchain doesn't solve the double-spending problem, so don't create decentralized payment networks. Let's use something like Paypal instead, you know, the one that will sooner or later merge with this single-letter company.
  You can also use Google Pay or Apple Pay, and developers can use their stores to monetize their apps. Just 30% or so commission and the apps 'adjusted' to the stores' rules (to be fair, there are not really soooo many trackers, right?).
  Proof of provenance isn't a use case either. Use Amazon servers. Microsoft Azure. They store all the data, and it's safe.
  We don't need companies like drife.io or particl.io. We have Uber and Amazon. Centralized services are much better. They are so good for humanity that their companies don't even have to pay taxes.
  
  You’re pointing out plenty of good problems that wasting CPU cycles and lack of authority doesn’t solve.
  Maybe if we actually looked harder for a solution instead of throwing one that doesn’t work on the problem and hyping it up to be everything that it will never be - we could actually get somewhere.
  I mean it all sounds fine when people spin it, but take a step back and look at the problems inherit to the “solution”.
  Just based on your phrasing and tone I’ll probably never convince you, but don’t trust me. There’s plenty of people out there who’s described the problem way better than I ever will.
  And there are solutions to the problems you point out, they just don’t involve useless computing and executing arbitrary code.
  But if you really want to get into fixing these problems you need to get involved with policy (ie. politics).
  We need to fix politicians being elected thanks to corporate capital, both direct and indirect.
  We need to fix tax regulation globally. We need to stop the race to the bottom where companies incorporate where they can funnel money back to the mothership without paying tax.
  We need to fix education, so people get a clue and don’t elect corporate puppets or flat out fascists.
  We need to fix healthcare.
  We need to fix environmental policy, and thanks to the environmental policies for the last 200 years, the environment as well.
  Heck, we even need to fix the Internet.
  And all the idealism in the world - the idealist blockchain crowd becomes useful idiots because they’re busy with something that won’t work out (instead of pushing the world in a better direction).
  I do however highly recommend a few talks with Larry Lessig:
  https://youtu.be/mw2z9lV3W1g
  https://youtu.be/PJy8vTu66tE
  And on DMCA (you may want to start with this):
  https://youtu.be/7Q25-S7jzgs?si=RJniq02TSd7vTOPw
- I would beg to differ. It seems to be pretty useful for Software development. After all git repos are Blockchains. That being said: use a solution that fits your problem, don't try to adapt a problen to your solution. Thats something a lot of the crypto- or AI-bros are apparently misunderstanding
  
  After all git repos are Blockchains
  No, git repos are merkle trees. Blockchains happen to build on merkle trees. Git is not blockchain.
- I have to wonder if it's a solution looking for a problem or a matter of people trying to just throw stuff at a wall and see what sticks.
  I think it also probably has to do with the sheer number of people trying to create something that every one of them has to learn that just because something exists, doesn't mean you have to use it. They end up just building it hoping that people will come to use it, but sometimes you gotta learn the hard way that it isn't always the case.
  
  Pretty sure the first guy trying to pitch money faced an uphill battle. But at least it was tangible.

Fuck no. What is better is p2p, or federated. No Blockchain is needed, and this is one of those examples where Blockchain is jammed into something where it really doesn't need to be, nor should it be. The last thing we want is for our encrypted messages be permanently stored. Element is federated, and they're working on getting it to be p2p. Some nerd will probably mention XMPP too.
- I disagree here. with p2p/federated you have to worry about if your microprovider goes out. I think blockchain would be a useful way to keep a users preferences and to keep usernames distinct.
  
  I disagree here. with p2p/federated you have to worry about if your microprovider goes out.
  This Quarks protocol still seems to require reliance on "nodes," which is the same thing as a federated service, with extra steps. It's more overhead without any of the portability you want.
  
  p2p has no middle man. There's nothing to go out. Blockchain is a literal plague, especially in this scenario when a simple database can handle this. MXIDs already provide distinct usernames. Preferences are often stores client side.
  You do not need to burn a tree, push a Ponzi scheme, and make this data permanently public to solve this. That is a terrible idea, and any solution you come up with will be always better without a Blockchain.
  
  Same thing with centralised services only that you have no options to choose from

retain control
Notably, in Quarks, every user operation and information exchange that takes part on a channel is carried out via the ledger's so-called smart contract. In practice, this means that no-one outside of a channel should be able to send or read messages on it. In addition, all messages on the channels cannot be altered or edited, yet they can be audited, meaning that users should be able to derive information about when they were created, sent, delivered, and so on.
Ah, yes. I definitely want anyone in the world to figure out who I'm communicating with by checking the timestamps of when various messages were delivered. Much like how the "anonymous" Bitcoin could be pretty easily de-anonymized just by checking where various bitcoins go and inferring who those wallets likely belonged to.
- Unlike Bitcoin this ledger is not open to the public, it only exists on the nodes containing group members.
  And everything in the ledger is encrypted except the timestamp. So without a decryption key, you could tell when messages were sent but not who sent them.
  
  Ah, gotcha, I may not have read carefully enough. I do see how an auditable decentralized trail of messages and any edits made might be useful for certain very sensitive communications then.

What the fuck do encrypted messages need a ledger for?
- So your thoughts can be monitored by authoritarians.
- Because Postgres is too difficult? :)
- To get governments interested in it... for tracking it's own netizens... because just about everyone is dealing with CSAM!
- Just... read the article, I guess. The third paragraph is your answer.

How is this better than a normal messaging protocol like Matrix? What does blockchain add to the solution?

I'm not entirely convinced this needs a blockchain. I guess Hyperledger (Fabric, I'm assuming) is a handy way of guaranteeing a total order for a channel's messages / events and making sure history is immutable, but it seems a bit unwieldy for a distributed messaging app despite being somewhat modular.
Most of their goals aren't specifically dependent on anything blockchain-like, and the ones that are seem like they could be implemented in a much "cleaner" way than having to bring in Hyperledger and all that it involves

Entirely overengineered. Redundant with better solutions. This is being pushed for hidden reasons.

There are lots of knee-jerk reactions because people saw the word "blockchain" in the title. It's as intellectually lazy as the shills who refuse to criticize the crypto industry for its shady parts
This just sounds like a decentralized Slack, with a blockchain to ensure all nodes have the same data. The details are sparse, but this sounds like a proof of authority system to achieve consensus between authorized nodes in the network. No cryptocurrency involved. It's just using blockchain as a consensus algorithm between decentralized nodes(which is what it was designed for).
It doesn't say, but since their target demo seems to be enterprises, my guess is that the idea would be companies run their own node in the network, which would allow a high degree of security and be interoperable with other enterprises.
"But you could use a federated system..."
I'm all for the growth of the fediverse, but it still has many problems. If you're running a large enterprise that needs a guarantee that all your messages are synced, in the right order, and nothing has been removed later, a proof-of-authority blockchain is a better system than something federated
- This just sounds like a decentralized Slack, with a blockchain to ensure all nodes have the same data.
  We've had this since the late 1980's. It's called IRC.

Yea, you lost me at "blockchain".

Just what I want, a permanent record replicated everywhere for every flippent thing I say. Hard pass.
Blockchain is a solution in search of a problem. And it hasn't found one to solve yet.

So, if I understand that correctly, the user is now the target instead. Is that better?
- user endpoints are always going to the point of failure. Blockchain or not. I think even the matrix foundation peeps mentioned something like that.
  
  Valid point. I feel uncomfortable with the shift of focus this should bring. I'll just put it that way.

You don't need a blockchain

I'd much rather have a full peer-to-peer solution like Veilid
- The cult of the dead cow has recently announced promising projects. I'm also looking forward to them.

114 comments