Iceland-based
nobs.is has launched a beta of their supposedly privacy-centered, bitcoin-supporting social networking Website. Sounds great, until you dig in deeper.
The Global Village is a Social Network similar to Facebook or Google+, but with the user’s privacy in mind. The user holds all of his or her content, pictures and posts. Once the user feels like deleting them, they are deleted for good. No restoring and no backups.
The Global Village will also feature a military-grade encryption of text, pictures, audio and video messages. In the future you will be able to re-share these encrypted messages to Twitter and Facebook. Only members who have the encryption key will be able to read your shared messages and the system will be built without a master key.
The users will be able to share their posts or pictures while the system provides the right mix of encryption methods like AES256, RSA, ECDH521 to secure them. A truly secure experience which comes not only on this website but also as APPs on iOS and Android.
You will of course be able to post publicly to make new friends.
Actually you can already use these features. In short, we don’t want to have an open system where Governments and big companies can check on your posts.
Now let's look at their SSL certificate:
CN = RapidSSL CA
O = "GeoTrust, Inc."
C = US
So, they went right to a US-based company, guranteed to comply with any and all requests of the Mass Surveilance Agency. What is the point of all the "military grade encryption" when users of the site can be MITMed at any time, and the SSL-encrypted payload (likely containing lots more than user-encrypted content) read en route?
Furthermore, they use a static donation addresses:
Like NoBs? Buy us a drink!
Bitcoin: 1K3Fstx2SZ52i348jCjCRrULsYKiboJ2Tj
Litecoin: La4p3KxNRAxZ2KLiQRMoHYmH9kZDHpor3x
Feathercoin: 6zVekmuMmdMYg84gbgWX5TbfkLVzwjKsQT
This makes it trivial for anyone interested to collect at least some information about the donors. Surely OK for some kinds of entities, but certainly disappointing for a privacy-oriented entity.
We are off to a bad start here. I hope they'll dispell the concerns somehow, though it's hard to take their claims seriously with all the bombastic, catchy stories they serve but don't live by them.
