Show HN: Ekko – post-quantum E2EE layer for Instagram, WhatsApp, Telegram Web

[kvasilev]

Hi everyone,

I am a big privacy activist and the amount of privacy concerns in the internet with the discussions around European Chat Control, Meta removing e2ee in Instagram and corporations harvesting personal data for AI training is on the rise. The closed source social media companies keep managing and storing our private keys, allowing them to effectively access all of our personal communications..

Many open source alternatives exist, but the problem I kept running into was not a lack of good private messengers. Signal, SimpleX, and other projects already do important work

The problem was getting the people to move.

A messenger is only useful when the person you need to reach is there. Asking friends, family, coworkers, or customers to abandon their existing chats is a very high barrier.

Ekko takes a different approach. It runs as a browser extension on top of existing messengers. Both people still need Ekko, but they do not need to move their conversation. You can continue using the Instagram, WhatsApp, Telegram, or Messenger chat they already share.

Actively building this and trying to achieve a seamless automatic encryption in the UI across all popular messengers and adding support across all browsers, IOS, android and social media..

Under the hood, Ekko uses hybrid X25519 + ML-KEM-768 and XChaCha20-Poly1305. Private keys are generated and kept on your device.

You can claim an Ekko handle to make exchanging public keys easier, exchange invitations directly without an account, or self-host the public-key directory.

Currently:

- A Chromium browser extension, Experimental Firefox and Safari builds

- Instagram, WhatsApp Web, Telegram Web, and Messenger integrations

- A self-hostable key directory

- Open-source client, protocol, and server code

Early version Chrome Web Store: https://chromewebstore.google.com/detail/ekko/oaihgpmbkeafbp...

Source code:

https://github.com/useekko/ekko-core

Website and demo:

https://useekko.app

I would genuinely appreciate direct feedback especially from people familiar with applied cryptography, browser security, key verification, messenger integrations, potential solutions for iOS UI integration (faster than using browser w/ Safari extension)

If you try it, please tell me what breaks or what feels confusing. Actively trying to make this better as a side project! If you discover a security issue, email [e-mail] rather than posting it publicly.

Looking for feedback! :)

[Oxodao]

This reminds me of the good old days before signal, back when it was still called SmsSecure / TextSecure / Silence. This was pretty much the same concept but on top of SMS. I loved it

[kvasilev]

Thanks :) Have not witnessed those good old days myself but have to check out! I assume the encryption flow has to be flawless UX/UI to win the consumers for such a tool

[Oxodao]

It was pretty much a simple "toggle encryption" button, when you pressed it and your friend also had Silence it would ask them if they want to start encryption, you pressed yes and you were encrypted. The only thing was that when you changed phone / reinstalled you would receive the encrypted message and you had to tell your friend to stop and restart the encryption

[morganrivers]

cool app. i think a lot of people may think you're talking about quantum computers, think it's above their paygrade, and then not even open the link. I am interested in using, but it's a barrier to find someone else to use as well. Curious how much AI was used to build the app if you're comfortable sharing?

[morganrivers]

I do recommend getting rid of all the mdashes and AI generated phrases in the readme, otherwise people will correctly infer it was an AI generated readme and pass the app by. I think AI slop tells may be offputting especially for a security focused app where people are trusting you did the cryptography correctly

[kvasilev]

Thanks, AI was heavily used in the development since I am not a frontend developer and needed the UI for extension + Ios swift. I know cryptography so backend and underlying infra was built by me + backend, have good understanding there.

Thanks for the comments, I think its useful to create bot accounts across all social media so the users can immediately try out the encryption without having to bring their acquitances at this early stages.. + It can act as a verifier to verify your ownership of the actual accounts whenever you are adding them to your profile!

Appreciate the feedback

[rolymath]

To be honest, I don't get how I would use it. I understand the text I send will be encrypted, but what does using it actually look like.

[kvasilev]

Thanks, perhaps while its hard to get the public recognition behind such tool when starting out, I should make more real demos of how it works with messengers and create Demo bot + verifier account across messengers where the user can try it out immediately after downloading :)

[morganrivers]

Yes, or you can record gifs and feature them prominently on the front page of your GitHub, for example?

[kvasilev]

Would love to hear any thoughts