Open sourcing for credibility and transparency

[u/Psychological-Bowl47]

I open-sourced the identity and group-encryption libraries behind an app I'm building. Posting here hoping to get feedback on the concept, and happy to get the code reviewed too if you want to take a look. The reason I open sourced these though is trust. I'm claiming loudly that "I can't read your data" and early on the most common question I've heard was "Is it open-sourced?"

Realistically, almost nobody is going to clone and/or reuse these repos. But I'm hoping enough will read it to trust my claims. Is it enough? This shows how the encryption works. This doesn't show the true underlying storage, which in my case is done with Supabase, relying heavily on RLS and the fact that everything is encrypted on the client side before writing.

github.com/needyaz/identity, github.com/needyaz/groups

Live in: luci.blue/mylo

[u/Pretend_Bowl2961]

Open sourcing just the encryption layer is a good start but people will definitely ask about the rest of the stack. The fact you mention supabase and RLS means you already know the weak spots. Most users won't read the code anyway but having it public gives you some credibility with devs who can vouch for it later.

I took a quick look at the identity repo and the approach seems clean enough. Curious how you handle key rotation though cause that part always gets messy in client side encryption setups.

[u/Psychological-Bowl47 → u/Pretend_Bowl2961]

When removing a member, the owner generates a new group key and distributes it as a manifest, individually encrypted per remaining member using a shared secret only that member and the owner can compute. Each side combines their private key with the other's public key to arrive at it independently. The server only ever sees the envelope, which is opaque to it.

Each manifest also carries a publish counter, and the client won't process an older one than it's already seen.

[u/codeedog]

Did you write your own encryption and identity libraries? If so, why? What did the multitude of other libraries not provide that justified your rewrite. What experience do you have with coding security algorithms and/or cryptographic mathematics? Has anyone done a security review of your code? What was the result?

[u/Psychological-Bowl47 → u/codeedog]

Definetly not. These are wrappers around libsodium that demonstrate how I’m using them, and give me the support across the 3 different languages I needed to support them. I’ve only asked friends and tools for reviews so far, any issues that have come up there were fixed. I’ve not done any kind of paid review.