Encryption in Diaspora

One thing which has always been in the background in Diaspora but rarely seems to make it to the foreground. (Of course, there might be much discussion and development around encryption in the background, but I'm not aware of it.)

In a decentralised network, the existence of many pods run by many different people is one potential source of weakness from the point of view of data security. So far a lot of this seems to be taken on trust that no podmin is going to abuse the trust placed in them. (I raised two years ago the possibility of criminal gangs setting up rogue pods in order to harvest user data, and was told it was fine because all the podmins were really groovey people. That's fine in a tiny start-up, but as the network grows in size, it will become a more attractive target.)

I imagine encryption will include:

• encryption of data stored on a pod
• encryption of communications between pods
• encryption of notifications (emails and others)
• encryption of any chat/VoIP services built in
• encryption of data exported/imported as part of account migration
• and possibly others.

(The chat and migration ones are, I think, being dealt with on the discussions for those issues.)

As encryption is likely to become a more pressing issue as the network grows, and an attack of some sort becomes slowly more likely, I thought it would be a good time to start discussing the issue: whether it is really necessary (I think it is, but I may be wrong); what sorts of encryption are needed, and in what areas; what would be the best approach to use in Diaspora, and how to go about implementing it.

I suspect this is going to be one of those topics which require a lot of thought and a lot of work, so I propose setting up a working group dedicate to looking into this issue and reporting back, in the way L3MNcakes has proposed on this discussion on federation, if it is considered an issue that needs looking into at this time.

Of course, it's easy for me to say, as I don't have the technical expertise to actually be involved in working for this! But I'll do what I can to help. With this big and important issues, such as encryption, federation and so on, I suggest we use the DHQ account and other means open to us to advertise for people to take part in these crucial and large projects.