Avoiding the next Skiff

[dngray (Daniel Gray)]

@Satoshi

Never trust Silicon Valley tech bro startup companies. They’re not companies that are created to make a long-lasting product and solve real problems. Those startups are intended to and will make an exit or they fail. There is not really much of an in-between with those type of companies. Startups are the primary way larger corporations can outsource the development of new features and new products, while not taking on any of the liability nor any of the risk.

I think it entirely depends on the product as a dozen of examples could be made where that isn’t true.

@Satoshi

Additionally, it’s all about branding, marketing, and sales rather than solving a problem using a technical solution. Same story as the crypto bros and all of their crappy apps of which a lot of them are scams and most of them die.

And we don’t recommend any of those, because that usually is pretty obvious. There are a heap of them in the decentralized routing network category that simply have no real usage.

@Satoshi

I never used Skiff, because I saw it as another hyped up service that doesn’t solve any real world problems.

They were extremely aggressive in their marketing, and sometimes to the point of including false information about PGP, the number of users etc. When I asked questions about that I never got any answers. There was a lot of focus on getting this item “mentioned” in as many places as possible, no doubt because an exit like this was planned long before we knew.

Perhaps we should not list things, which follow this aggressive marketing strategy, because it certainly felt like a pump and dump scheme at the time. Especially when I inquired about how they were going to sustainably give every user 100GB and basically all the features of the paid plans.

@Satoshi

You can self-host email or use proton/tutanota or you can use a number of quick email solutions like cock.li, cyberfear.com, pissmail.com, or onionmail.org. So what unique problem was Skiff solving? Did Skiff actually care about privacy? What about advocacy? The answer is a clear and resounding no.

The problem is a lot of those options are either not providing zero knowledge encryption, or they are simply regular or anonymous providers. Meaning you really don’t know who is running them. When it comes down to it, there really isn’t too much reason to use those over an aliasing service.

@Satoshi

PrivacyGuides should be primarily focused on FOSS software and not proprietary garbage, especially from startup companies.

While we do prefer open source solutions, in some cases closed sourced counterparts are particularly good (eg 1Password) or have no viable open source option.

@Satoshi

It’s too similar to privacytools.io listing services like ExpressVPN and Incogni.

We don’t list any of those things.

@Satoshi

More rigorous background checks should be conducted especially around the reputation of the developers. It should be a red flag, if they aren’t actually participating in the privacy community and aren’t advocating for rights and a better understanding of privacy & security.

The thing is that’s really just marketing. They could very well be playing the lip service and not actually doing anything or planning on sticking around long term.

@Satoshi

Additionally, I really don’t understand why Skiff was listed, but why none of the ones I mentioned above are.

We don’t list anonymous providers or ones which don’t provide zero knowledge encryption once you go down that road, they could be run by anyone. I’m personally hoping there will be more providers maybe integrating options like https://lacre.io

@Satoshi

Sure, cock.li shouldn’t be trusted and is used by sketchy people, but all of the above fulfill an important use case. You can create an email address with any of them without having to fill out a captcha, without having to verify your identity, and without providing any other information, like an existing email or phone number.

and you can use an aliasing service for that too, without having a dozen mailboxes that don’t change anyway. The issue is this has many human failure, and we recommend against extremely complicated sets of rules about when and where to use one of the 10 accounts you might have.

@Satoshi

They also allow Tor use and host a .onion version of the site. So what’s the use case? Compartmentalizing of identities. You can create an email via Tor and use that email for just one service/site. Nothing is tied back to you unlike if you used proton or tutanota or used simplelogin.

Generally people don’t simply need a dozen identities with separate inboxes. Unless you’re doing something which would get you a subpoena and legal action then something like addy.io or simplelogin is fine.

@Satoshi

That’s the whole point of using those email providers. You can create one, two, three, a dozen, or even a hundred email addresses quickly and use each one for only one service via Tor and remain anonymous.

And so do spammers, which makes them often banned.

@Satoshi

I understand that PrivacyGuides focuses more so on white hat privacy rather than darknet opsec, but some of the practices and methods overlap as does the one I just mentioned.

The problem is a lot of people who think they need “darknet opsec” are just larpers in reality who have not realized that it takes a lot of work to maintain completely anonymous identities, and these really should only be short lived anyway.

@Satoshi

What I would like to know is what the primary focus of PrivacyGuides really is and what the threat models are which determine the choice of products and services. If it’s just a gateway to get normies into privacy tools, then it certainly accomplishes that. If it’s supposed to do more than just that, then I believe it fails at its mission. I’m not criticizing, it’s just something I don’t fully understand.

The threat model is not something we choose for you but something you do for yourself. The reason is it can vary from person to person and can include factors such as, technical background, geographical location, general usage and interests/activity etc.