xoron :verified:<p>An <a href="https://infosec.exchange/tags/E2EE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>E2EE</span></a> messaging app unaffected by <a href="https://infosec.exchange/tags/ChatControl" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ChatControl</span></a></p><p>* App: <a href="https://chat.positive-intentions.com/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">chat.positive-intentions.com/</span><span class="invisible"></span></a><br>* Code: <a href="https://github.com/positive-intentions/chat" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/positive-intentions</span><span class="invisible">/chat</span></a><br>* Reddit: <a href="https://www.reddit.com/r/positive_intentions" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">reddit.com/r/positive_intentio</span><span class="invisible">ns</span></a></p><p>How it works: <a href="https://positive-intentions.com/docs/projects/chat" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">positive-intentions.com/docs/p</span><span class="invisible">rojects/chat</span></a></p><p>TLDR: I'm working on a <a href="https://infosec.exchange/tags/P2P" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>P2P</span></a> messaging <a href="https://infosec.exchange/tags/webapp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>webapp</span></a>. Webapps are generally not considered secure because of the nature of serving statics over the internet. This is correct, but not a limitation of this project. (<a href="https://infosec.exchange/tags/selfhosting" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>selfhosting</span></a> options: <a href="https://positive-intentions.com/blog/docker-ios-android-desktop" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">positive-intentions.com/blog/d</span><span class="invisible">ocker-ios-android-desktop</span></a>).</p><p>As a webapp, I can provide the app with zero-installation and no-registration. The app is only using (local-only) browser storage (specifically <a href="https://infosec.exchange/tags/indexedDB" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>indexedDB</span></a>). So in a P2P interaction, the traditional concept of "the cloud" is just the physical devices connected over <a href="https://infosec.exchange/tags/WebRTC" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WebRTC</span></a>. This allows for things like P2P authentication: <a href="https://positive-intentions.com/blog/security-privacy-authentication" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">positive-intentions.com/blog/s</span><span class="invisible">ecurity-privacy-authentication</span></a>.</p><p>Future:<br>I'm aiming to create the most secure messaging app out there... (more than <a href="https://infosec.exchange/tags/Signal" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Signal</span></a>, <a href="https://infosec.exchange/tags/Simplex" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Simplex</span></a>, <a href="https://infosec.exchange/tags/threema" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threema</span></a>, <a href="https://infosec.exchange/tags/session" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>session</span></a>, <a href="https://infosec.exchange/tags/deltachat" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>deltachat</span></a>, <a href="https://infosec.exchange/tags/bitchat" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>bitchat</span></a>, etc). I know I have a long way to go to get there. The UI is fairly ugly for the average user, but I think the mechanics are working as expected. I think <a href="https://infosec.exchange/tags/JavaScript" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>JavaScript</span></a> is underrated in what you can do with it. I'm actively investigating improving the <a href="https://infosec.exchange/tags/encryption" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>encryption</span></a> approach further to align to how the Signal protocol works (currently using a <a href="https://infosec.exchange/tags/DiffieHellman" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DiffieHellman</span></a> key-exchange).</p><p>Support:<br>In the age of <a href="https://infosec.exchange/tags/ChatControl" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ChatControl</span></a>, I would like to keep this project <a href="https://infosec.exchange/tags/opensource" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>opensource</span></a>, but open-source funding is not working for me. I don't want your donations (but don't let that stop you) because it isn't sustainable for a long-term project. I have so far only experienced grant-funding rejections. I have no idea what I'm doing in trying to get funding for this project, so any support/advice is appreciated. In recognition of the project in its current state not being able to get funding... (sorry) I will have to go <a href="https://infosec.exchange/tags/closedsource" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>closedsource</span></a> (which I'd like to avoid because it undermines several <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> claims I'd like to make). I don't accept collaboration on the project because this would make tough decisions like going closed-source also immoral.</p><p><a href="https://infosec.exchange/tags/privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>privacy</span></a> <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>security</span></a> <a href="https://infosec.exchange/tags/messaging" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>messaging</span></a> <a href="https://infosec.exchange/tags/decentralized" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>decentralized</span></a> <a href="https://infosec.exchange/tags/peer2peer" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>peer2peer</span></a> <a href="https://infosec.exchange/tags/webdev" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>webdev</span></a> <a href="https://infosec.exchange/tags/cryptography" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cryptography</span></a> <a href="https://infosec.exchange/tags/selfhosted" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>selfhosted</span></a> <a href="https://infosec.exchange/tags/FOSS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FOSS</span></a> <a href="https://infosec.exchange/tags/tech" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>tech</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/developer" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>developer</span></a> <a href="https://infosec.exchange/tags/funding" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>funding</span></a> <a href="https://infosec.exchange/tags/startup" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>startup</span></a></p>