if you're in a relationship at some point you should be able to trust the other to some degree or you won't be able to relax and enjoy it. there's no watertight way to completely assess the others reliability though, so you're always dealing with a certain amount of uncertainty.
sex tapes can be fun but are something very private, potentially damaging and a liability in case the relationship ends on bad terms (which can happen under the best circumstances).
so without (even flawed) protection like this you've got two options:
a) don't do sex tapes, which is not a good option in case you want to make sex tapes.
b) try not to let a leak affect you, which is not a good option because you're only human and part of a larger society where sex tapes aren't universally accepted (maybe with the exception of porn actors).
using this you have at least another level control/protection that might defer all but the most technologically versed (or at least prevent super high-quality leaks).
Ummm, so shoot a video of the playing video. Or hack into the display circuitry. With that, you could stream a copy somewhere, even if both parties were present.
Some security problems are theoretically solvable, some are not. This one is not solvable, you can't get closer to solved as there is no "solved" state.
For example, sending a message between party A and party B so no party C can read it is possible, given that party A and party B have some way to pre-share key. Sending a message from party A to party B in a way that party B knows it is from party A but is unable to prove it to any third-party is, again, possible under some reasonable conditions, see OTR/Axolotl. Sending a message from party A to party B in a way party B can read the message but can't resend it is impossible under any conditions.
In most cases DRM-like functionality is a bullshit. Secret sharing is known to protect against outsiders only. You can use it to split backups so they are harder to steal [1]. The scheme will never work for cases when malicious party has the whole secret at some point in time.
OP here, this is addressed in the FAQ, I'll paste it here :)
> How do I know my partner won't abuse my trust?
> You can't. However with Rumuki you have the discretion to only grant playbacks when you can keep an eye on them. You also have the option to revoke all playback grants and delete the recording if trust is ever lost.
While you literally did address the question (and I applaud you for responding), you didn't actually answer it.
There is, of course, no technological way to prevent someone from capturing a video through the analogue hole (i.e., pointing a camera to the video as it is played), even if we assume that is possible that a consumer device can be controlled to such an extent that its owner can't find a way to capture the video output digitally.
To the OP's credit, this is explicitly called out in the whitepaper introduction. I think the point is that this app makes casual, "in the heat of the moment" backstabbing pretty difficult.
In my opinion this is fair, because the vast majority of bitter/petty ex's are not going to know how to, or bother with, reverse engineering an app to spite their significant other. They'd also have to do it when they're granted access to the app, which implies a certain forethought.
I you are physically present when you grant access you can ensure they do not record with something else via the analog hole. If you're at work and they're at home and would like to view it then sure, there's a plausible covert copy being made if you agree to let them view it.
In principle, what stops one party from simply reverse engineering the client app and permanently retrieving the file? Once the video file is decrypted on the client, even briefly, you've lost control.
Your answer demonstrates that you've thought about this problem, not that you've solved it. I like the idea of this app, but I would argue that the core promise of your app is technically infeasible.
EDIT: I clicked through to read your whitepaper and see that you've explicitly called this concern out and admitted the DRM scheme cannot be foolproof. That's admirable, and I'm glad you did address it. I would gently suggest you place that disclaimer somewhere in your FAQ as well.
Most people who leak sex tapes involving an ex probably don't think of doing so while they are still in a relationship with said ex. By the time they think of revenge, the victim-to-be should already have revoked access.
If your ex is making secret copies of sex tapes while you are still in a relationship with him, I think you have bigger things to worry about than revenge porn.
I somewhat agree. But relationship status can be very vague and ambiguous. Let's say that you discover that your partner is unfaithful. You're pissed off, but you hide it until you've had a chance to clone those sextapes. Then you talk it out, and see how things go.
It was never just about you, it's about you and others. If your only contribution is along the lines of "doesn't look like something I have a use for", perhaps it's best to leave the discussion to people that would use it and/or try to learn a bit behind why those preferences exist.
Very few people have excellent recall. Possibly nobody does about something so non-binary as an extended sexual encounter. Memory is a story we tell ourselves about the past.
However, I bet you do remember it better than it was. So keep your memories. They're much better for this than a video record.
I think it should be put more clear that it is possible to keep the "red key" (see https://rumuki.com/#how-it-works), but it is not kept by the app if it is not modified to prevent accidental leaks only.
The app does not protect from malicious partners, it just makes sure videos are still secure if one of the phones is stolen or lost. I even think there should be a feature to backup your key to your computer or your other phone.
Sure. But I would imagine that most videos start off with sincere mutual interest and only later due to bad breakups or stolen phone etc become a problem.
And yet, this solution still provides a dramatic increase in security for its users. Normally, files "exist by default", and will continue to do so forever. You have to take deliberate action to delete them. But here, files are effectively "destroyed by default", and can only be accessed via:
1. Consent of both parties.
2. One of the parties going out of their way to make a deliberate copy within a 7-day window, when (you hope) they're still well-disposed towards the other person.
A security solution does not need to be perfect.
Similar issues arise with systems like Hashicorp's Vault, which generates time-limited, revokable credentials for programs. Obviously, a compromised server could abuse a time-limited AWS credential. But that's still a much better situation than handling out AWS credentials with unlimited lifetimes, because they'll inevitably wind up in all sorts of strange places.
Expiration is not a solution to all your security problems. But it's much better than no expiration.
more importantly: they can't do that after the consent ended. so if the malicious partner starts to do this while the relationship is still intact, you're partially fucked.
if you decide to break up they can't record the video afterwards for revenge or blackmailing purposes.
I guess you are right, but I think if this solution became mainstream people would do a backup as soon as they have access. This solution will give some false security and some extra security by luck and antagonist incompetence. It won't make that much of a difference.
The point is that the other person only turns into an antagonist after some point (hence the "revenge" in revenge porn). It takes a more twisted mind to do a backup just in case you end up splitting and hating your ex.
TL;DR: Very long and pretty offensive post that boils down to "because the courts aren't stupid and can probably tell the difference and by the way there are some specific legal requirement that when making porn you need to cross-reference IDs and you're probably not doing it".
Couldn't agree more. I clicked on the link being skeptical, but the landing page is so well done that I came way impressed. Congratulations on shipping this product, and wish you all the very best.
This app would have saved my career a couple years ago. Now, when I visit the old office to say hi to my ex-colleagues, I still can't get past the nickname they gave me because of what happened.
I expected my colleagues to respect the things I do in private and realize I'm just human. And at the very least, if they were going to publicly respond, I'd have expected them to compliment me instead.
When you let it be recorded and the recording be possessed by someone else, it's practically public, as you can't control what'll happen in future and there will always be mean people that'll try to bully you for that sort of thing. I'm sad that it's caused you harm, but I guess in such situations showing confidence might work.
Well, first of all I did not mean to offend the person I responded to. Sorry if that came off that way. About your comment, well, frankly, if you're sharing sensitive things like bank accounts and intimate recordings, prudence is key. One has to make sure what they give access to. And I said that the suffering side in this kind of situations should be assertive about the fact that they are innocent. IDK what is wrong about that.
Hell, why even bother criminalizing murder or theft when murder and theft have happened in every culture in the history of time? It's only human nature, after all.
You expect people to behave a certain way when you know they won't. Then you let them get to you because you don't stand to whatever you did.
You expected them to compliment you. It means you are proud of what you did. But if you really are proud of what you did you wouldn't care about their opinion in the first place.
So either you are somewhat ashamed of what you did and regret that it became public or wanted to brag with it but are now angry that you colleges made fun of you instead.
I don't think the intent in the above comment re. auto-eject was malicious. It's about equilibrium, phrased in more common-speak they're better off without them, as they're clearly gossipy/close-minded people.
What happens when one person dies? Is the other cut off, or is the system smart enough to have a dead man's switch option that lets you allow access if no response is given in X hours / days?
Presumably, this is tied to access to the phone. If the deceased person has left their phone password behind, whoever has the password can grant access to the video.
I didn't notice this issue addressed anywhere: what if the blue adversary/sex partner simply steals the red phone for a few minutes in order to grant access to the blue phone? Will red be informed of this? Is there some sort of passphrase that only red knows, to prevent this?
I can't imagine two horny teens like:
M: Show me something hot baby
F: Sure! But please install that app to take all the nececary security precautions before we proceed with our sexting...
This will gain traction among camgirls and other people that produce private porn (I just invented that term because I don't know how one would call porn distributed on an individual basis).
So thats like, pervware?
I think you are understanding the app-foo of our youngest adult generation. Installing and using this app would be low resistance. I see 20 year olds jump through much bigger hoops just to score a date or play a game.
This would lower resistance to making a video in the first place due to the stronger security. Surely some people would not use it because they aren't security minded or they're inebriated or something, but I think it does have value.
> would lower resistance to making a video in the first place due to the stronger security
You make it sound like it is a good thing. In fact, security is lower than when there is no app and no video is made. And the video is not secure because it can still be copied.
Where's the legal contract part? If my video is leaked by the other party, I'd like to at least have a clear contract so I can issue takedown notices, sue for copyright damages, etc.
Where's the legal contract part? If my video is leaked by the other party, I'd like to at least have a clear contract so I can issue takedown notices, sue for copyright damages, etc.
(Edit: Not a new idea, certainly, but well executed so far.)
That would probably be a matter between you and the other party (the video never touches the app's servers). There's nothing stopping you from drawing up a contract yourself, but I don't see any reason for this app to provide something like that.
I'm pretty sure leaking a sex video without consent is already illegal in most countries. And you can sue the other party for a lot more severe crimes than copyright damages.
You might be surprised how much the law lags at criminalizing morally reprehensible acts enabled by technology, like revenge porn.
I can't speak to other countries specifics, but in the US the most effective avenue currently appears to be copyright claims. That's a civil proceeding, so the jilted ex is only on the hook for financial penalties.
Unless I'm reading wrong, the videos aren't gone after 7 days; the key grant is valid for 7 days before it expires (or if it is revoked). Deleting the key, or deleting the video, seem to be the permanent actions that removes the videos; otherwise they are available indefinitely. I'm sure @nathankot can clarify here.
Thanks! The question about long distance sharing is a tricky one, since data on the leaky internets etc. I suppose you could do something via a hop through Dropbox (or equiv) since the actual content is already encrypted. That assumes the encryption never gets broken, but when quantum computers take over the world, a naughty video is probably going to be the last of our problems :).
Hmmm thinking better still would be some kind of cooperative playback whereby it's not possible to play or record the video without direct cooperation from the other device. One device could store a one time pad for the video and the other could store the XOR with the one time pad. Both have to cooperate to play back. Could be extended to N devices devices using Samir's algo
I'm incredibly impressed by the design work on this. As someone who has studied design the past few years, the landing page alone is filled with little details and choices that taken together just succinctly and beautifully communicate what this app does. Definitely inspiring to know Nathan just hacked on this on his own -- I hope it is a terrific success!
Yeah I am laughing out loud at the landing page, I think it's pretty brilliant and I somehow missed the condom over the camera until I started sending it to other folks. The color scheme matches the intended use . . . I mean if I pulled this up on my phone in a dark room I don't think it would spoil the mood with too many bright blue-whites.
I think the idea is that during the relationship both parties are at peace so neither party will have any desire to do something underhanded like recording the video from another phone. This app addresses the problem that occurs when the relationship ends on a bad note and one party has to the urge to harm the other through whatever means necessary.
Most encryption systems are vulnerable to rubber-hose cryptanalysis, yet we still use them because they still vastly reduce the chance that your message will be leaked.
Similarly, this app reduces the chances that one of the parties will be victimized by their ex. That's still useful, even though imperfect.
This is pretty naive though. Everyone so far who's ever sent me, er, "home videos" has later decided to stop sending me such content and would probably revoke my access to it if they could. Maybe I'm just a sneaky jerk, but backing up content that I would like to see again seems like something I'd try regardless of how the relationship was at the time. I don't mean anyone harm and I'd not distribute someone's videos without their consent. I'd just want to keep the ability to look at them.
So let's say you go through the hoops to use this app. Then you'd immediately break that trust, while still in the relationship, by recording the videos?
Yes. For me it would depend on the nature of the relationship (and "maybe I'm a sneaky jerk"). But often people send each other "home videos", or create them together, outside of what I'd consider a Relationship (love & trust & all that jazz).
Isn't that exactly what Rumuki is trying to solve? If there's enough trust in the relationship in question, the people involved should just solve this with the conversation: "hey, did you delete that video after watching it like we agreed?" / "yep, you?" / "yep".
I do, but see my further clarification below. In any case, it doesn't matter whether I personally would do this. It's clear to me that a bunch of people would.
And I KNOW complaining about downvotes is like the HN kiss of death, but whoever hit that down arrow because they disapprove of my (hypothetical) conduct should really rethink their use of HN votes.
> neither party will have any desire to do something underhanded like recording the video from another phone.
Well... The viewer needs to request permission from the partner, and may want to bypass that. Furthermore, a given video may have more than two partecipants, and the app seems to be limited to pairs of people. In such situations the video will need to be shared with those people too.
The most secure option is to have one encrypted copy of the file and only that, and decrypt only when viewing it, and only temporarily. Even then it's possible to make recordings of the content as tiny hideable cameras are sold everywhere. I'm not dismissing the work done, but if someone is as careful about security to use such an app, they can also do the best thing and not record at all.
> You can't. However with Rumuki you have the discretion to only grant playbacks when you can keep an eye on them. You also have the option to revoke all playback grants and delete the recording if trust is ever lost.
I expressed an upfront concern about reverse engineering in another comment directly to the OP (no DRM is foolproof, etc). After skimming through the whitepaper I'd like ask you a few implementation questions about the feasibility of client trust:
• Can you tell me how the device token/keys are stored locally and accessed by the application? I understand the crypto itself (e.g. libsodium), but I'd like to know how you're protecting data on the client insofar as you can.
• Can you tell me what your methodology is for determining if an application has been manipulated or altered?
• How are you specifically obfuscating sensitive data or otherwise making the DRM bypass difficult (e.g. obfuscating data in .so files, etc).
I'm not trying to grief you here, I just want to talk about technical protection mechanisms in place. To your credit, you explicitly admitted that DRM is fundamentally not a foolproof guarantee (though that's different from saying it's not effective...). I think your app would mitigate most scenarios where an ex would try and expose the other party.
It's a neat project. Others have fleshed out most details. It could even get uptake if spread on social media. Let me focus instead on the more devious possibilities.
"They are encrypted and saved on your devices. Recordings are never sent across the internet and never touch our servers. "
" it is impossible for third party attackers to gain access to your videos without local access to the network your devices are on (that includes us!)"
This claim is made by every developer of security/privacy apps when content stays on the device. It's actually false. They could embed a backdoor in the current or a future release that shares the files. Already requires networking permission when managing videos. Actually, a service like this getting extremely popular could lead to one of the largest leaks of nude pics in history. One person hacking the box containing the source/credentials, getting on the development team, or being the original author w/ trolling intent could subvert it into a giant store of pics/video. Get it to send the data back when on WiFi to avoid high, data bills. Thumbnails of videos sent first to filter out uninteresting parties.
I'm not accusing the author of this at all. I'm just assessing security risk from side I'm good at: subversion. The subversion risk here is spectacularly above average as a network effects developing around this app lead to many eggs in one basket that's probably easy to grab. Or was until the author read my comment and beefed up security in a panic. ;)
I find it odd how people are hating on the idea here, while this could obviously be a lot better than the alternative... you know unencrypted video files that someone can access whenever they want.
The concerns I'd have with this myself would be that I'd have to trust the website. As it is I trust my spouse a lot more than some cloud service and I don't expect that to change.
206 comments
[ 2.9 ms ] story [ 275 ms ] threadI think you mean that this is too obvious an idea to NOT have been patented.
sex tapes can be fun but are something very private, potentially damaging and a liability in case the relationship ends on bad terms (which can happen under the best circumstances).
so without (even flawed) protection like this you've got two options:
a) don't do sex tapes, which is not a good option in case you want to make sex tapes.
b) try not to let a leak affect you, which is not a good option because you're only human and part of a larger society where sex tapes aren't universally accepted (maybe with the exception of porn actors).
using this you have at least another level control/protection that might defer all but the most technologically versed (or at least prevent super high-quality leaks).
And again, it is a client app, assume it would be modified by a malicious party.
Just admit the problem is not possible to solve.
For example, sending a message between party A and party B so no party C can read it is possible, given that party A and party B have some way to pre-share key. Sending a message from party A to party B in a way that party B knows it is from party A but is unable to prove it to any third-party is, again, possible under some reasonable conditions, see OTR/Axolotl. Sending a message from party A to party B in a way party B can read the message but can't resend it is impossible under any conditions.
In most cases DRM-like functionality is a bullshit. Secret sharing is known to protect against outsiders only. You can use it to split backups so they are harder to steal [1]. The scheme will never work for cases when malicious party has the whole secret at some point in time.
[1] https://www.schneier.com/blog/archives/2010/07/dnssec_root_k...
> How do I know my partner won't abuse my trust?
> You can't. However with Rumuki you have the discretion to only grant playbacks when you can keep an eye on them. You also have the option to revoke all playback grants and delete the recording if trust is ever lost.
There is, of course, no technological way to prevent someone from capturing a video through the analogue hole (i.e., pointing a camera to the video as it is played), even if we assume that is possible that a consumer device can be controlled to such an extent that its owner can't find a way to capture the video output digitally.
In my opinion this is fair, because the vast majority of bitter/petty ex's are not going to know how to, or bother with, reverse engineering an app to spite their significant other. They'd also have to do it when they're granted access to the app, which implies a certain forethought.
Your answer demonstrates that you've thought about this problem, not that you've solved it. I like the idea of this app, but I would argue that the core promise of your app is technically infeasible.
EDIT: I clicked through to read your whitepaper and see that you've explicitly called this concern out and admitted the DRM scheme cannot be foolproof. That's admirable, and I'm glad you did address it. I would gently suggest you place that disclaimer somewhere in your FAQ as well.
If your ex is making secret copies of sex tapes while you are still in a relationship with him, I think you have bigger things to worry about than revenge porn.
Best bet is avoiding sextapes.
If you don't understand someone's sexual preference, the correct response is no response. You're not obligated to comment on everything.
However, I bet you do remember it better than it was. So keep your memories. They're much better for this than a video record.
The app does not protect from malicious partners, it just makes sure videos are still secure if one of the phones is stolen or lost. I even think there should be a feature to backup your key to your computer or your other phone.
And yet, this solution still provides a dramatic increase in security for its users. Normally, files "exist by default", and will continue to do so forever. You have to take deliberate action to delete them. But here, files are effectively "destroyed by default", and can only be accessed via:
1. Consent of both parties.
2. One of the parties going out of their way to make a deliberate copy within a 7-day window, when (you hope) they're still well-disposed towards the other person.
A security solution does not need to be perfect.
Similar issues arise with systems like Hashicorp's Vault, which generates time-limited, revokable credentials for programs. Obviously, a compromised server could abuse a time-limited AWS credential. But that's still a much better situation than handling out AWS credentials with unlimited lifetimes, because they'll inevitably wind up in all sorts of strange places.
Expiration is not a solution to all your security problems. But it's much better than no expiration.
more importantly: they can't do that after the consent ended. so if the malicious partner starts to do this while the relationship is still intact, you're partially fucked.
if you decide to break up they can't record the video afterwards for revenge or blackmailing purposes.
https://www.popehat.com/2016/11/06/private-porn-shoots-brill...
Hope you found a better job and colleagues after that.
When you let it be recorded and the recording be possessed by someone else, it's practically public, as you can't control what'll happen in future and there will always be mean people that'll try to bully you for that sort of thing. I'm sad that it's caused you harm, but I guess in such situations showing confidence might work.
So basically, you bet that people would overcome millions of years of human psychology?
While I agree with you it would be nice if that happened (really nice!), i wouldn't expect that to happen for a long long time.
You expected them to compliment you. It means you are proud of what you did. But if you really are proud of what you did you wouldn't care about their opinion in the first place.
So either you are somewhat ashamed of what you did and regret that it became public or wanted to brag with it but are now angry that you colleges made fun of you instead.
https://github.com/rumuki/rumuki-server/tree/master/app
By default, a message could disappear shortly after playback ended a la Snapchat.
But you could store the encrypted version and bring if back anytime with consent of both parties.
I can't imagine two horny teens like: M: Show me something hot baby F: Sure! But please install that app to take all the nececary security precautions before we proceed with our sexting...
This will gain traction among camgirls and other people that produce private porn (I just invented that term because I don't know how one would call porn distributed on an individual basis). So thats like, pervware?
You make it sound like it is a good thing. In fact, security is lower than when there is no app and no video is made. And the video is not secure because it can still be copied.
(Edit: Not a new idea, certainly, but well executed so far.)
I can't speak to other countries specifics, but in the US the most effective avenue currently appears to be copyright claims. That's a civil proceeding, so the jilted ex is only on the hook for financial penalties.
http://www.criminaldefenselawyer.com/resources/revenge-porn-...
in my opinion this is one way to do it but prevents me from having a kind of "library" with videos to share with my partner.
how about a shared library that is watchable until access is revoked by one party?
there's also the question about sharing videos with a person that's not present (i.e. long distance relationship).
Similarly, this app reduces the chances that one of the parties will be victimized by their ex. That's still useful, even though imperfect.
Isn't that exactly what Rumuki is trying to solve? If there's enough trust in the relationship in question, the people involved should just solve this with the conversation: "hey, did you delete that video after watching it like we agreed?" / "yep, you?" / "yep".
And I KNOW complaining about downvotes is like the HN kiss of death, but whoever hit that down arrow because they disapprove of my (hypothetical) conduct should really rethink their use of HN votes.
Well... The viewer needs to request permission from the partner, and may want to bypass that. Furthermore, a given video may have more than two partecipants, and the app seems to be limited to pairs of people. In such situations the video will need to be shared with those people too.
The most secure option is to have one encrypted copy of the file and only that, and decrypt only when viewing it, and only temporarily. Even then it's possible to make recordings of the content as tiny hideable cameras are sold everywhere. I'm not dismissing the work done, but if someone is as careful about security to use such an app, they can also do the best thing and not record at all.
> How do I know my partner won't abuse my trust?
> You can't. However with Rumuki you have the discretion to only grant playbacks when you can keep an eye on them. You also have the option to revoke all playback grants and delete the recording if trust is ever lost.
I expressed an upfront concern about reverse engineering in another comment directly to the OP (no DRM is foolproof, etc). After skimming through the whitepaper I'd like ask you a few implementation questions about the feasibility of client trust:
• Can you tell me how the device token/keys are stored locally and accessed by the application? I understand the crypto itself (e.g. libsodium), but I'd like to know how you're protecting data on the client insofar as you can.
• Can you tell me what your methodology is for determining if an application has been manipulated or altered?
• How are you specifically obfuscating sensitive data or otherwise making the DRM bypass difficult (e.g. obfuscating data in .so files, etc).
I'm not trying to grief you here, I just want to talk about technical protection mechanisms in place. To your credit, you explicitly admitted that DRM is fundamentally not a foolproof guarantee (though that's different from saying it's not effective...). I think your app would mitigate most scenarios where an ex would try and expose the other party.
1. Uses Realm for storage, encrypted with their encryption api using a random key generated on first boot stored in iOS keychain.
2 & 3. It has some rudimentary jailbreak detection but obfuscation is still in the pipeline.
(Getting late here in Tokyo so may be until tomorrow before I answer follow up questions)
"They are encrypted and saved on your devices. Recordings are never sent across the internet and never touch our servers. "
" it is impossible for third party attackers to gain access to your videos without local access to the network your devices are on (that includes us!)"
This claim is made by every developer of security/privacy apps when content stays on the device. It's actually false. They could embed a backdoor in the current or a future release that shares the files. Already requires networking permission when managing videos. Actually, a service like this getting extremely popular could lead to one of the largest leaks of nude pics in history. One person hacking the box containing the source/credentials, getting on the development team, or being the original author w/ trolling intent could subvert it into a giant store of pics/video. Get it to send the data back when on WiFi to avoid high, data bills. Thumbnails of videos sent first to filter out uninteresting parties.
I'm not accusing the author of this at all. I'm just assessing security risk from side I'm good at: subversion. The subversion risk here is spectacularly above average as a network effects developing around this app lead to many eggs in one basket that's probably easy to grab. Or was until the author read my comment and beefed up security in a panic. ;)
The concerns I'd have with this myself would be that I'd have to trust the website. As it is I trust my spouse a lot more than some cloud service and I don't expect that to change.
With this app, you don't might assume you're less vulnerable than you really are.