nmgsd

So, you want to avoid mass surveillance and don't trust big tech companies either? But you're tied to your existing network of contacts like everyone else? Well now you can send encrypted messages to your contacts over the Twitter direct messaging channel.

It's a serverless SPA called Seecret, a Twitter client hosted at https://www.seecret.io

Seecret is open source and freely distributable. You can host it anywhere even from your own localhost server. The app is just plain html and javascript, with no server-side processing at all, no tracking, no logging.

Steps: 1-Grant Seecret.io permission to connect to Twitter. (Just like Facebook connect). Twitter uses Oauth 1.0a (srsly?) which doesn't support serverless auth so we integrated Oauth.io to handle it. Read about it at https://oauth.io but they are a trusted Oauth 1 proxy service.

2-Seecret then gens an RSA key with a long passphrase saved locally. You can change the passphrase and even delete it (and the key) from local storage. If you delete these you'll need to reimport them each time you use the app. To read more about concerns and approaches re: local browser storage of keys etc read our FAQ at https://www.seecret.net/faq.html

3-Send encrypted msgs over Twitter to your existing contacts!

The code for Seecret is fully auditable and the app uses Subresource Integrity Checks for all dependencies. Unfamiliar with SRI? Read more about it at https://www.w3.org/TR/SRI/. In short, it lets you verify for certain you are using the uncompromised code with no CDN intercepts.

Want to host your own instance? It's easy! Read more at https://www.seecret.net/mirror.html

Read more about our approach, explanation of the technology choices, and why we made it open source and freely distributable at https://www.seecret.net/faq.html

We built a simple Twitter client that can post and read steganographic tweets at www.seecret.io using the plaintext steganography library from https://github.com/simpledynamics/seecret

One big issue is that Tweets must be 140 characters but the steganography technique expands the message considerably (by a factor of 4 to 5). Our first thought was to just limit the tweets to very short messages. But that's hardly useful. (This whole thing is not really useful but whatever).

We decided to chain the message across multiple tweets, and re-stitch them back together when viewing the timeline via the Seecret app.

W‍‍‌‌​​​‌‍‌​‌‌​​‌‍‌‌​‌‌‌‌‍‌‌‌​‌​‌‍‌​​​​​‍‌‌​​‌‌‌‍‌‌​‌‌‌‌‍‌‌‌​‌​​‍‌​​​​​‍‌‌​‌​​‌‍‌‌‌​‌​​‍‌​​​​‌‍‍‍e then considered just making an app for chaining regular tweets this way but really the core of the Twitter appeal is the microblogging aspect. We played with it and found that Really Long Tweets just don't work. Kudos to Twitter for holding that line on that. They get a lot of criticism over that but it's really a core part of their value. (On the other hand, they recently expanded direct messages to be 10,000 characters which was a great move on their part. There's just no reason to limit the direct messages to 140 characters.)

The main thing to note here is that this is NOT encrypted. We get a lot of first reactions from lay-persons where they assume that it could be used for nefarious activity. Anyone can view the hidden messages via the Seecret client app. The messages are hidden in other clients (phone and web views of your tweets) but still extractible if you know they are there.

Tell us what you think!