Come riporta l’edizione de La Gazzetta dello Sport la trattativa per riportare all’Inter l’attaccante esterno Jonathan Biabiany non si concretizzer prima della met di giugno. Per allora infatti dovrebbe arrivare l’ultimo responso sulle condizioni di salute del francese, che ha sofferto di problemi cardiaci, e si sapr se potr tornare in campo e all’agonismo. Fino ad allora tutto bloccato.
Lo sfogo di gioved notte contro i tifosi della Fiorentina ha segnato una spaccatura tra l’ambiente e Vincenzo Montella. L’edizione odierna del quotidiano Tuttosport sottolinea che il tecnico al momento s’ allontanato molto dai viola ed tornato nel mirino del Milan. I rossoneri sognano Ancelotti o Emery, ma Montella seguito ormai da anni anche se a bloccare l’arrivo c’ sempre stato la clausola di rescissione di circa 5mln di euro. Anche quest’estate il Milan non busser alla porta dei Della Valle, ma non da escludere che il tecnico possa liberarsi dopo una rottura con la societ.
Brutte notizie per il Parma da parte di alcuni ex che ancora vantano crediti dalla societ ducale. Nicola Sansone e Cristian Molinaro infatti hanno dato risposta negativa alla richiesta dei curatori di rinunciare ai crediti e aiutare in questo modo la societ ad abbassare il monte debitorio. Lo riporta la Gazzetta di Parma spiegando che sono attese le risposte di altri big ormai lontani da Parma: da Cassano fino ad Amauri passando per Felipe, Marchionni e altri ancora. Una loro adesione all’accordo sarebbe vitale per il futuro del Parma.
Silvio Berlusconi ha deciso: il nuovo socio che entrer nel Milan in futuro avr solo il 35% delle azioni del club rossonero, con la promessa di poter salire a quote maggiori con il passare degli anni. E’ quanto scrive la Gazzetta dello Sport spiegando che il governo cinese ha gi fatto sapere di essere disponibile a questa entrata soft, mentre l’altro imprenditore interessato – l’indonesiano Bee Taechaubol – punterebbe ancora al 60% delle azioni. Berlusconi ha posto inoltre altri due paletti ai futuri investitori: subito 200-250 milioni di euro per rinforzare pesantemente la squadre e tornare a lottare per il vertice fin da subito e la conferma di due dirigenti di fiducia come la figlia Barbara Berlusconi e Adriano Galliani che dovranno mantenere i ruoli di amministratori delegati del club.
Il Manchester United non si ferma sul mercato dopo l’accordo con Depay. Secondo quanto riporta l’edizione odierna del Mirror i red devils hanno inviato nell’ultimo periodo degli osservatori a Roma per Felipe Anderson. Il brasiliano ha recentemente rinnovato con il club biancoceleste, ma – si legge – l’ad Woodward ha confermato che c’ grande disponibilit economica per l’estate ed il club alla ricerca di nuovi talenti per una programmazione a lungo termine.
Sean Sogliano, futuro lontano da Verona, dove sar sostituito da Riccardo Bigon attualmente al Napoli. E il Napoli? Piace molto proprio il profilo di Sogliano, che aveva gi avuto dei contatti indiretti nei mesi scorsi. Sogliano verso Napoli, Bigon al Verona. La strada sembra tracciata. Apprezzato dagli azzurri anche il ds del Palermo, Dario Baccin che piace pure al Chievo Verona.
Instagram today announced the debut of a new application called Layout, the company’s next standalone creation tool outside of its flagship photo-sharing application. With Layout, Instagram users will be able to quickly build collages using their mobile photos, which they can then choose to share to Instagram, Facebook, or elsewhere.
Collage-making is already a popular activity on Instagram, the company tells us. One in five monthly active users on Instagram use a collage app at least once, we’re told. Today, the app stores are filled with utilities that offer this sort of capability – including apps like Pic Stitch, Pic Collage, InstaCollage, PhotoGrid, and many others. The apps are all similar in nature – they offer a variety of blank photo grids which users can customize with their own photos, and sometimes optional text or stickers.
To Instagram’s credit, it didn’t just knock off the existing collage-making apps already on the market, but instead tried to come up with an app that would improve the experience for mobile users.
In Layout, Instagram offers a new take on how collages are built by changing the order of the steps involved in the process.
“The first thing you see is a view of the Camera Roll,” explains Joshua Dickens, Product Designer at Instagram. “Most apps give you a bunch of empty grids. But more important is choosing the photos you want to share, before you lay them out,” he says.
As you tap to select the photos you want to use, Layout then presents previews of custom layouts you can scroll through at the top of its screen. You can select up to nine photos using Layout, and each time to tap to add another, your photo grid options update automatically to reflect the new additions. When you’re finished adding images, you can then flick through the presented options to choose the grid you like the best.
Another interesting feature in the collage-building process is the ability to tap onto a “Faces” button at the bottom of the screen to filter your Camera Roll to show only those photos with pictures of people. 90% of photos used in collages have faces in them, Instagram found, so this option will be useful to those who are filling their grids with photos of friends and family, instead of just cityscapes, objects, or other scenery.
There’s also a “Photo Booth” button that lets you use Layout to capture more spontaneous moments. When you tap this button, the app starts a countdown timer and then captures a series of photos that you’ll see appear instantly in a layout.
Having used a number of the photo collage apps in the past, I found that the way Layout flipped the first few steps involved with making a collage – that is, first selecting the photos, then choosing the grid – significantly sped up the previously time-consuming process of collage building. For example, I was able to quickly create a few photo collages in a matter of seconds over the weekend – in the middle of a six-year old’s chaotic birthday party, of all places. In the past, the same activity using an app like Pic Stitch would have required a lot more time and trial and error to find the right grid and the best photos to use. With Layout, however, the process wasn’t just fast – but the learning curve to figuring out how all the features worked, too, was greatly reduced.
Like other collage builders, Layout also allows you to pan the photos as well as pinch and zoom to better situate them. Plus you can grab the handles of a photo to resize it in the grid you’ve chosen, making it larger or smaller in relation to the others. A “replace” button lets you quickly pull up your Camera Roll again in order to swap out photos, which can be done with just a tap.
Swapping out photos all takes place on the same screen, too. Some apps I’ve used in the past would pop up the Camera Roll view in its own window, which made it difficult to think about which photo would look right in your current grid option. I preferred the way Layout does this instead.
Layout also offers a few differentiated tools, including the ability to tap buttons that flip images upside down or make photos mirror each other. This allows for more artistic creations, like turning landscape shots into ones with a cool water effect – where the land and sky seems to be reflected into a glassy pool, for example. It also offers a way to do more fun, “pop art” style shots, which could serve to spice up selfies or the popular “outfit of the day” shots many Instagram users post regularly.
When you’re finished with your collage, you can save the photo locally, share to Instagram, Facebook, or to other services whose apps you may have installed on your iPhone through iOS’s included sharing options.
Instagram had been researching the possibilities for an app like Layout since last fall, and the app itself has been in development over the past few months. Like its video app Hyperlapse, the company built Layout not to generate additional revenue for the company – there are no in-app purchases for things like more photo grids or effects, nor will it monetize through ads – but rather to encourage more photo-sharing to Instagram by fixing the problems with today’s current collage apps.
With the debut of Layout, it appears that the Facebook-owned company, which now sports over 300 million active users monthly, is working to find ways that allow it to keep its main app simple for its core audience, while also meeting the needs of more advanced users who are in search of better tools for working with their photos and videos. This fits in with the trend where Instagram has been looking at what other apps people are using as companions, and then trying to build the functionality itself, sometimes in Instagram’s core product, and other times as standalone apps, as with Hyperlapse.
“A key part of the Instagram vision is about inspiring creativity,” notes John Barnett, Product Manager at Instagram. “Creation should be simple, intuitive and fun,” he adds.
Layout is currently an iOS application, but an Android version will be released in the months ahead.
Twitter is bringing the ability to tag specific locations to Tweets via official apps and the web, through a partnership with Foursquare. The company tweeted about the upcoming feature today, showing a video of how it’ll work in iOS.
Coming soon! We’re working with @foursquare so you can tag specific locations in Tweets: https://t.co/MwlLz5Pfvqpic.twitter.com/jATzXvbuV6
— Twitter (@twitter) March 23, 2015
Previously, location services in Twitter worked by detecting your coordinates based on your device sensors and assigning a spot based on those parameters. Now, users will be able to tap the location button to get a list of nearby suggested places so that they can ID a very specific spot, like the poutinerie in the example above (which, coincidentally, is why I’m the very best person to report this news).
Twitter was rumored to be in talks with Foursquare regarding a partnership to do exactly this late last year, when Business Insider reported the geolocation services would arrive sometime as early as the first quarter of 2015.
Location based tweets could do a lot to help Twitter extend its monetization and advertising options, as well as help onboard new users by providing them with location-relevant Tweets before they build their own timeline. The company describes the features in detail over at its Support website.
Slack, the communication platform that has taken the workplace world by storm, is on a roll of another sort. After announcing a fundraise of $120 million at a $1 billion-plus valuation less than six months ago, TechCrunch has heard that the company is talking to investors for yet another round, this time at a valuation of around $2.5-2.6 billion.
Investors that we have heard involved in this round, which is not closed, include Coatue Management, a backer of Box, Snapchat and Lyft; and Horizons Ventures, the prolific investment firm of Li Ka-Shing.
On top of this we have also heard that the company is making some early moves to look at potentially replacing co-founder Stewart Butterfield as CEO, for a “more operational” leader to take the company to its next level of growth.
A spokesperson for Slack declined to comment on the fundraise, and denied the CEO report outright.
Prior to Tiny Speck, Butterfield was one of the co-founders of photo-sharing site Flickr, and he joined Yahoo after the site was acquired by the search company. He left to start Tiny Speck in 2009. Other Slack co-founders are Eric Costello, Cal Henderson and Serguei Mourachov.
Slack — a platform for sending messages and sharing files with people you work with — competes against the likes of Yammer, Hipchat and others in the general space of enterprise social networking. It also positions itself as an email “killer” — or at least something that is a more active and used complement to your often overstuffed and ignored inbox.
Slack celebrated its one-year anniversary in February, and reported 500,000 daily users across more than 60,000 teams at the time, with users spending “over 100 million hours connected to Slack, sending 300 million messages.” Basic use of the service is free, with a set of increasing prices per user/per month based on added functionality such as more storage, unlimited third-party app integrations and so on.
That fast growth and faithful use from current Slackers has been a large part of why investors have taken such interest.
“They’ve cracked the code in a very short period of time,” John Doerr, general partner at Kleiner Perkins, said in an interview with the WSJ around the time of the last funding round. “Slack is growing more rapidly, with no marketing, than anyone else transforming enterprise communications.”
Previous investors in the company in addition to KPCB include Accel, Andreessen Horowitz, Google Ventures, Social+Capital Partnership, SV Angel and various angels, who have collectively invested $180 million over six rounds — Series A-D and two Seed rounds — covering both Slack and Tiny Speck’s previous incarnation as a games company.
Bloomberg earlier reported also that Slack was raising at a $2-billion-plus valuation.
While Facebook is reportedly talking to publishers to host their content as a way of boosting the number of people who read it, one more startup is entering the fray to help publishers improve readership and traffic on their own sites, specifically around paid content and content marketing.
Keywee — a content marketing startup founded in Israel and operating in NYC that uses natural language processing, machine learning and social graphs to match stories with users — is today opening its doors for business with $9.1 million in funding from a notable group of strategic and financial investors. Led by Google chairman Eric Schmidt’s Innovation Endeavors and Israel’s Marker LLC, The New York Times Company and the accelerator UpWest Labs are also chipping in.
The $9.1 million includes seed as well as Series A rounds for Keywee (no relation to the fruit).
The NYT is among 60 brands and publishers already using the service, co-founder and CEO Yaniv Makover said, with altogether six of the top 10 U.S. publishers among its customers, including Kiplingers and PureWow. (Others prefer not to be named, and “due to the sensitive nature of customer data, we can not provide pictures of any live implementations,” he said. Hence, the generic illustration up above describing how it works.) Currently the customer base is roughly split between publishers and brands.
There are a number of businesses already that offer different takes on content recommendations and content discovery, including the likes of Outbrain, Taboola, Contently, Newscred and more. Makover claims that what Keywee does is different, however, because it positions itself somewhere between content discovery and ad tech.
“To date, marketers have been flying blind when it comes to content,” he said in an interview. “We are offering an entirely new approach to solve content marketing challenges.”
That approach involves NLP and machine learning algorithms — with Keywee’s team honing their skills during stints as part of the Israeli Defense Forces — that not only analyse the content of stories but matches that up to user profiles to provide better matches between the two, posting paid content stories that it thinks you will want to read, on the places where you are already reading such as Facebook, Reddit and Yahoo. Makover says that Facebook is currently its biggest traffic driver.
“We are delivering the missing data layer to help content marketers find the best performing audiences for their content. We make content marketing measurable and more successful,” he said.
This seems to be what is attracting customers, too. “We’ve tested a variety of content marketing solutions and found Keywee successful at helping us quickly grow our audience by targeting the right channels and audiences for each individual piece of content,” said Anna Lee, Senior Director of Marketing for PureWow, in a statement. “Keywee found the audiences that engage with and share the dynamic women’s lifestyle content we are producing.”
There is also another important trend that Keywee highlights, of course, which is the rising tide for paid content. As advertising shifts to programmatic models and prices continue to drop for inventory, and readers simply get turned off from the cascade of noise on a page, many sites have been pushing into the idea of paid or sponsored content as a complement to other kinds of revenue models. Sponsored by brands, these articles are likely to be some of the key targets for content marketing campaigns, which eMarketer estimates will see spend of $4.3 billion this year, rising to $8.8 billion by 2018.
The sponsored content focus, and seeding those story links as ads on platforms like Facebook and Reddit, is part of the reason why Makover does not see the Outbrains of the world as rivals.
“We don’t consider ourselves a content recommendation engine,” he said. “Keywee is foremost a data platform for content marketing. Our innovation comes in our ability to find audiences for content. The audiences are specific to the platform we are distributing our content on Facebook, Twitter, etc.. Each platform has millions of targetable audiences.”
However, Facebook — with its increasing interest in working with publishers to boost engagement of those publishers’ content — could be another story, which could prove tricky, given that Facebook is also one of Keywee’s key outlets at the moment.
The company currently offers its products based around a managed service model, although part of the investment will be used to develop more self-service components that it plans to offer on a subscription basis, as well as hire more staff particularly in New York.
Ever since he was a teenager, Frederick Hutson has had a knack for business. When he was 19, he built a window-tinting business that he then turned around and sold for $50,000.
At 21, he saw his friends struggling with an illegal marijuana business and figured out how to efficiently traffic the drug across borders. They used shipping containers and vacuum-sealed everything.
He was perhaps too ambitious. Hutson ended up being federally indicted for moving two tons of marijuana.
“I feel like I was ahead of my time,” he said, referring to the marijuana legalization wave sweeping across the U.S. and the resulting startups and ‘potrepreneurs.’ “I went to jail for this. For me, it’s a little ironic.”
He would end up spending four years in prison. For most people, that criminal record ends up permanently destroying their employability or damaging their connections with their community and family, increasing the risk of recidivism.
But Hutson actually spent that time writing business plans. Whenever a copy of Inc, The Wall Street Journal or Wired magazine would make its way into the prison, he’d consume the whole thing even if there were pages missing or parts torn out.
“I was in jail for most of my 20s. I wasn’t a part of a lot of things that others get to be. But I’ve always been a highly, highly focused person,” Hutson said.
One of these ideas was a way to make prison calls cheaper. There are only a couple of companies that handle the vast majority of communications in and out of prisons because messages and letters need to be carefully screened. Because of this market concentration among players like Securus and JPay, it means that prisoners — who are already vulnerable and often lower-income — get gouged.
Three hundred minutes can cost $70.
“While I was there, my eyes really started opening up. I started noticing how grossly inefficient everything was,” he said. “I thought, I know I can solve this problem. This is a real market.”
Pigeon.ly uses VOIP, which underpins bigger products like Skype, to create a local number that a prisoner can use to reach their family or friends. It’s substantially cheaper than dialing a phone number that’s out of the area code. Hutson says he can drop the cost of those same 300 minutes to less than $20. It’s still expensive, but three-fourths cheaper than existing competitors.
On top of that, they’ve built a photo-sharing service. Normally, family members have to print and mail physical photos to their loved ones in prison. Given how ubiquitous smartphones are, it’s pretty tedious to figure out how to get these photos off a phone onto a USB stick or CD, then go to a local drug store, print them out, pick them up and then mail them. Pigeon.ly will handle all of this automatically for the family, in a Shutterfly-like service.
Today, the company is supporting about 2 million minutes a month on the phone calls, and sending a quarter-million photos every month, too.
It’s a big distance from where he started. Hutson started working on the idea while he was living in a halfway house after getting out of prison.
“This desire came from freedom, and the ability to work on whatever you choose to,” he said. He would go on to participate in the NewMe Accelerator, which focuses on entrepreneurs who are from underrepresented minorities. Then he ended up raising a seed round in 2013 from Erik Moore at Base Ventures and Kapor Capital.
Not long after that, he relocated the company to Las Vegas where he works closely with the family of startups supported by Zappos CEO Tony Hsieh.
Hutson says that 1 percent of the U.S. population has a loved one who is in prison, given the scale of the U.S. mass incarceration system. He estimates it’s a $2 billion market. If you look at competitors, Securus sold to a private equity firm in 2013 for about a half-billion dollars while JPay told CNBC it had $50 million in revenues last year.
While Pigeon.ly is definitely farther along in terms of product and growth than some of its peers in the YC program, Hutson said it was valuable to join the program anyway. YC partner Michael Seibel, who co-founded SocialCam and Justin.tv, heavily recruited Hutson and has been a big advocate for diversifying each batch of companies.
“Being a minority founder building a company, Y Combinator can help. You need to have the right affiliations. You need to be in the right circles. We looked at this as an opportunity to get access to investors and talent.”
Facebook’s experimented with ways to surface old Memories since 2010. But after seeing Timehop hit 6 million daily users on mobile, Facebook is officially launching a competing nostalgia feature called “On This Day.” It shows users their Facebook posts from the current date in past years, like photos from exactly one year ago, or status updates from four years ago.
Rolling out globally over the next few days, On This Day will be accessible from https://www.facebook.com/onthisday, Facebook’s bookmarks menu, search, News Feed stories, or opt-in notifications on iOS, Android, mobile web and desktop.
While Timehop can dredge up memories from Facebook, Twitter, Instagram, Foursquare, Flickr, Dropbox, iPhoto or your camera roll, On This Day just sifts through Facebook. The social giant’s product manager on the feature, Jonathan Gheller, refused to cite Timehop by name, claiming the feature was inspired because “we see behaviors from our community and we try to build on top of them.”
But on my third attempt, when asked if he thought On This Day and Timehop’s features were similar, he said “Yeah, we look at what people do at Facebook. I don’t spend too much time looking at what other people are doing or not doing. I think that you just focus on doing things people want, and doing them as best you can.”
Timehop
Facebook tells me it has no plans to monetize the feature directly. Still, getting people to tune in to On This Day and reshare posts they find drives engagement and lock-in with Facebook’s News Feed, where people see ads. The company likely hopes that many of its 890 million daily users have never tried or even heard of Timehop, but will enjoy revisiting their old Facebook memories.
Timehop CEO Jonathan Wegener didn’t seem too worried. After hearing about On This Day, he told me “My general feeling is that this is awesome validation that we’re doing something worth doing. One of our investors put it really nicely that if Facebook isn’t playing in your space, you’re probably not doing something worth doing.” He says the move confirms “Timehop is important and old [stuff] is important.”
However, Wegener says “Our mission is broader than just ‘replay your Facebook content.’ It’s to collect your digital history from everywhere.” He concluded “I’m not particularly scared of this feature. I think it’s a really nice nod to what we’re doing.”
Starting today and rolling out to everyone worldwide over the next week or so will be a bookmark in the Facebook web sidebar and the mobile site and apps’ navigation menu. Clicking it, the direct link, or Facebook searching “On This Day” will open a feed of status updates, photos and posts you’ve been tagged in from exactly one, two or several years ago. Only you will be able to see these resurfaced posts unless you choose to reshare them with friends.
From your On This Day page, you’ll also be able to subscribe to a (typically) daily notification reminding you to check out that date’s nostalgia feed.
Gheller gives the example of On This Day showing him photos of his 1.5-year-old child when she was just an infant a year ago, and status updates tagged with him by his pregnant wife two years ago. He says Facebook has “been playing with this idea for a couple of years,” referring back to Memories. It refined this incarnation of the product recently with lots of internal dogfooding and some external testing internationally.
After seeing the backlash people had to its Year In Review feature that sometimes surfaced painful memories of ex-lovers and deceased friends, Facebook built special rules into the On This Day algorithm to protect people’s feelings. If it knows you listed someone as your romantic partner, then removed them, it won’t show you posts including them in your News Feed. It will also avoid displaying memories of friends who’ve passed away.
[Clarification: Facebook may still show posts about ex-lovers and deceased friends if volunteer to open the On This Day page, but it won’t forcibly push this sensitive content to the News Feed.]
Even as I insisted the product looks and acts just like Timehop, Gheller explained why it’s important. “What we realized is that consuming memories from the past and resharing them rewires our relationships…it really reconnects me in a profound and beautiful way.”
P
ssst. Can I tell you something? Something private? In complete confidence?
This is Zendo, my new favorite messaging app.
Now you might well ask who needs (yet) another way to ping, poke, prod or otherwise pester their friends? The answer is simple: anyone who cares about privacy.
If you don’t think privacy is important, ask yourself whether you’d be happy to share your online banking password with strangers. Or your social security number. Or your medical history. Or your physical address. Or, ehem, some of those personal/intimate photos you have on your phone…
There are lots of types of data that most people care about safeguarding. And even the other stuff you might not think is so sensitive — where you go, what you like, who you talk to, what you buy, and so on — is being systematically collated and data-mined by mainstream social media services to build an increasingly detailed profile of you and your life to sell to advertisers.
Being stalked around the Internet by adverts for mortgages or baby products or hair loss cream is pretty tedious — as well as a visible privacy invasion. But pervasive, passive surveillance is the price of free services, isn’t it?
For sure, it’s one business model. And a dominant business model if you’re using communications products like Gmail and Facebook whose makers’ businesses are all about profiling users to sell intel to advertisers. Messaging products with an alternative philosophy do exist (e.g. Wickr, Threema, TextSecure, Silent Circle’s Silent Message app).
And now Zendo joins that list, just launched on iOS and Android — to offer another route to circumvent the intrusive data-mining of personal communications for corporate profit.
So how does a new secure messaging app stand out in such a crowded space? By making something that’s super easy to use, given that security can still be synonymous with tedious complexity. And also by using a type of encryption that technically cannot be cracked.
Something that’s impervious to man-in-the-middle attacks. Yet which has been overlooked by cryptographers for decades.
“This is the first consumer implementation of One-time pads which is the only unbreakable form of encryption,” says Zendo co-founder Jack DeNeut, who it should be noted is something of an old friend of TC, having helped organize our PragueCrunch meet ups in recent years. You’ll also find some of his old posts on TC (like this one). Formerly an investment banker, DeNeut quit Wall Street to chase the original Internet boom back in the 90s, taking the plunge with ecommerce startups. Followed by travel guide site Nelso.com (his Nelso apps have racked up some 4 million downloads).
His Zendo co-founder and long-time friend plus business partner across various other startups, Tom Newbold, is also an American based in Prague who hails from a banking background. The pair came up with the concept for Zendo at the start of last year, while they were kicking around ideas to ride the messaging app boom — and Newbold, who was reading Neal Stephenson’s Cryptonomicon, joked about using One-time pads to secure a messaging app.
They both laughed.
One-time pads, for those not up on their cryptographic history, are the stuff of old school spy sagas. Burner books of random numbers (or letters) used to encode messages, with each page (pad) used only once before being destroyed. By burning it. Or eating it, for spooks in a matchless bind. So long as the pads are kept away from prying eyes and used only once their randomness ensures an uncrackable code. Only the person with the corresponding pad pair can decode the message. This is known as ‘perfect forward secrecy’ in the trade.
The problem with One-time pads is they’re not very practical. You have to get together with your fellow spook periodically to share pads to encode future missives, and agree on which pad will be used for each specific message. Plus pads run out, given you’re destroying them after usage. All of which explains why other types of encryption — that involve managing the remote exchange of secret keys in various ways — have become the standard for online security. (That and a whole crypto industry growing up to service this need.) And why One-time pads are mostly a historical footnote.
One-time pads are the unicorns of cryptography. Everyone knows they’re unbreakable, they’re perfectly secure, but historically they’ve been so hard to use that only spies and diplomats ever used them…
But after initially laughing at the notion of implementing One-time pads in a consumer app, DeNeut gave it more thought, and decided modern smartphones were the perfect vehicle for removing the barriers to bringing this type of encryption to the average consumer — given on-board processing power, ample storage, secure transfer technologies, built in camera, and so on. All that ubiquitous tech could suddenly make One-time pad transfer and management practical.
“One-time pads are the unicorns of cryptography. Everyone knows they’re unbreakable, they’re perfectly secure, but historically they’ve been so hard to use that only spies and diplomats ever used them. And so it became common knowledge that it was so impractical that a consumer could never use it,” DeNeut tells TechCrunch.
“The last time that anyone looked at this was the 1990s. When laptops barely existed. So the idea was you’d bring your PC over to my house, we’d connect them and we’d exchange key pad material and then you’d take your computer home and then we could securely message each other. But of course now everyone has powerful computers in their pocket, which have huge amounts of memory, secure storage, can generate large amounts of random data.”
Why hasn’t someone thought of combining One-time pads and smartphone before? “A lot of things in technology are like that,” he responds. “Simply somebody just thinks about it and goes ‘no wait; that old constrain doesn’t actually exist anymore. There’s no reason why we can’t do this’.”
The only requirement for using Zendo’s One-time pad encryption is users meet in person to exchange pads. And while that’s certainly a limitation it can also be seen as a benefit in some ways. A USP. This is an app for communicating in ‘perfect secrecy’ with people you are close enough to have actually spent time with at some point. Such as your close friends and your significant other. It’s also a welcome contrast from the communication overload that increasingly defines online social spaces these days, where an apparently limitless supply of strangers (who may or may not be human) hurl contextless missives in each others’ general direction while others stand on the sidelines commenting and taking notes. Zendo is the opposite. It’s necessarily selective, and thus the app can becomes a filter for substance; for conversational importance; for the people and topics that require your special attention.
You also can’t be spammed via Zendo (as you can by iMessage) — unless you are close friends with spammers. And if you’re a parent worried about who your kids are communicating with online, the app could be a way to ringfence messaging to school friends and family members. The co-location pad exchange requirement is also an excuse (not that you should need one) for people to meet up with their friends, catch up and top up their pads. While celebrities tired of having to change their phone numbers and messaging IDs every few weeks to stay ahead of contact information leaks might well appreciate the benefit of a physical pad exchange. So Zendo’s sales pitch can be about fostering intimacy, as well as protecting privacy.
There’s also an obvious appeal for businesses wrestling with the ongoing challenge posed to corporate security by the BYOD trend. And while Zendo is initially being positioned as a consumer app, and is free to download and use, Newbold suggests one avenue for future monetization could come by licensing the software to businesses who want to use it and also run their own server, rather than relying on Zendo’s servers (thus affording enterprises even greater control).
In-app purchasing for premium features could be another monetization route. But they’re in no hurry. They have plenty of runway for the startup thanks to a seven-digit investment from a Prague-based angel investor so are fully focused on acquiring users first, before nailing down a business model.
After you download the app and get together with whoever it is you want to message, either one of you selects the in-app option to display a QR code and the other person scans it within Zendo. That initiates the one-time pad exchange — which takes place over Multipeer (if you’re using iOS) or Wi-Fi Direct on Android. You need to do this exchange with every person you want to message via Zendo’s One-time pad encryption so there’s certainly an on-boarding barrier as people will need to gradually add their friends as they meet up with them IRL.
“The first step is always optical, and that is an exchange of an AES 256bit key, plus an authentication key, and so those are the keys to encrypt the One-time pad as it’s being transferred wirelessly via Multipeer [or Wi-Fi Direct]… with a symmetrical AES key that was exchanged optically. So even if somebody was listening to every single packet, even trying to sniff on Wi-Fi Direct or Multipeer, the data that they would get would be meaningless because it would be encrypted with the optically exchanged keys,” says Newbold.
“The first step is always that optical scan, which doesn’t involve any packets going over any radio waves. So you can’t packet sniff it. If somebody wanted to get in the middle of that they would literally have to be looking over your shoulder with the camera to capture that code,” he adds.
The process takes a few seconds for 0.5MB of pad to be exchanged — which is enough for “thousands” of messages between the two users. More than 3,000 based on a conservative estimate of average text message length, according to Newbold. You can also exchange multiple pads to stockpile more megabytes for even more future missives. (To be clear, if users run out of pad, the app defaults to AES encryption so messages are never sent unencrypted — it just steps down to industry standard levels of security.)
Pictures can also be sent via Zendo, and those are encrypted with a single use AES 256bit key and an HMAC key (for authentication), which are then sent using One-time pad encryption, so the photos are secured via OTP without needing to use up too much of the pad to send them. The same method will be used to encrypt and send videos, audio and documents/attachments — file transfer features which will be coming in future updates to the app.
Another thing to note is that usage of Zendo is entirely anonymous. They are taking no sign up data (no email, no phone numbers etc). Users are merely assigned random identifiers. “What we see is unbreakably encrypted stuff attached to some random name” is how DeNeut sums up their view of the data flowing through their servers.
They do see IP addresses but he notes they don’t log or store these. “We’re throwing away all the logs… so we don’t have to not turn them over. We don’t have them to turn over,” he continues. “We think it’s very possible we’ll get requests from law enforcement. But that they’ll learn their lesson pretty quickly.”
“We are assuming it’ll be banned in China almost instantly,” he adds. “I’ll be psyched if it lasts a couple of days without getting blocked by the Great Firewall.”
One neat feature allows users of the app to send an encrypted Zendo message via another messaging app. So after composing the message in Zendo there’s an option that allows the user to select a different messaging app to carry the message — say iMessage (such as in the below example) — and then the encrypted message appears as a Zendo link in that other app. When the recipient clicks on it they are automatically transferred to the Zendo app where they can now view the unencrypted message.
This feature could be useful, says Newbold, if Zendo’s own servers are subject to attack — as a workaround for users getting messages out. Point being: once you have exchanged pad, the encrypted messages can be conveyed in a variety of ways — they could even be posted to Twitter or published in the classified section of a newspaper if you want to get really old school spooky — and all the recipient has to do is copy/paste the encrypted text into Zendo to convert the cypher back to plain text.
Zendo is not currently open source, so they are asking users to trust their claims as it stands, given there’s no option for community code review. But they have opened the source code to an independent security reviewer for audit (Geoffroy Couprie) — who they describe as being generally happy with it, making only a few suggestions for changes.
“I did not find many [problematic] things in there because the design of the app — the protocol — is quite straightforward,” says Couprie when I contact him for comment. “Basically a lot of messaging apps… suffer from the remote trust problem. Which is that at some point if you want to communicate securely with someone you have to establish a safe channel and it cannot be done to an extent. And what Zendo provided is that you meet in person, you do the exchange, and then you have a safe channel so there’s much less risk than another [messaging] app.”
“One-time pad is simple, and the key exchange is simple, that’s what makes it easy to audit and easy to use,” he adds.
“It’s trivial for anyone to packet sniff their device while they use it and see that we don’t have key servers, we don’t have registration servers that have your email address or anything like this, so it’s trivial to do a key exchange and just sniff the packets while you use the app and see that the keys don’t get sent,” adds DeNeut.
“What the app does internally is one thing but the biggest problem with all the other systems that have men in the middle is that they have to exchange the keys over the network. And any researcher can just do packet sniffing and see what the devices send to each other.”
What about the fact that creating truly random numbers is nigh on impossible? Does that weaken the robustness associated with One-time pads? That’s really a theoretical constraint, argues DeNeut. “If there is some flaw in the randomness you would need to collect billions of messages on our system to even maybe take a crack at determining some flaw in our random number generator,” he says.
Newbold also makes the point that the general brevity of most mobile messaging likely adds to the challenge of identifying exploitable patterns in the randomness — given there isn’t going to be a whole lot of source material for would be crackers to get their teeth into, at least not initially.
You could also raise concerns about the security of QR codes — given the potential to inject malicious code into the barcode and that then be an avenue for compromising the security of the app at the point of optical exchange. However you’re still scanning a QR code from a person you know well enough to meet in person and want to swap pads with, so presumably you trust them. Ergo that human trust layer helps shrink the associated risk.
The bigger question is whether the online chattering classes can be convinced to add another messaging app to their phone’s homescreen — especially one with such an esoteric twist. Take away the OTP feature and Zendo is a minimalist messaging app which is either uncluttered or feature-lite, depending on your preference. Buzzy broadcasting app du jour, Meerkat, this is not.
And while One-time pads are cool if you’re into espionage genre fiction, the mainstream are likely to be nonplussed as to the cryptographic advantages (although the team has made a cutesy video to get their message across in as plain a way as possible).
“Who are our competitors? Basically everybody. I don’t imagine for a second that the One-time pad thing is so unusual that it means that we have no competitors. Wickr, Threema, TextSecure, iMessage to a certain extent, Silent Circle,” says DeNeut, listing multiple pro-privacy rivals, before once again pointing to Zendo’s OTP USP. “None of those that we know of have an in person key exchange process.”
Albeit Threema, which uses asymmetric cryptography so requires public keys and has a public key directory, does actually offer a QR code scanning option for an in-person exchange, although this does not involve the exchange of actual encryption keys (rather it’s a public key confirmation step for validation). Plus, given it’s not One-time pad encryption Threema can’t lay claims to any ‘cryptographic unicorns’.
“They all suffer from this man-in-the-middle risk,” adds Newbolt. “For us one thing is the optical component, the QR code, for us that’s a really important part of the process but a lot of users think that’s the whole thing. They think ‘oh you’ve exchanged the keys now’… But the really cool thing is the One-time pad stuff that happens invisibly in the background to negotiate between the two devices where we’re really exchanging the encryption keys in person.”
One more thing: Zendo is not claiming it’s created an ‘NSA proof’ messaging app. They are not even officially claiming perfect forward secrecy. Insecurity risks undoubtedly remain. “I don’t know what renegade software you’ve installed on your iPhone,” says DeNeut, pointing out one threat vector, and adding that “no sober person” should claim to have made a digital service that’s ‘NSA proof’.
User-added malware is not the only issue either. There’s also the cellular hardware itself. Baseband chipsets remain an unknown in the (in)security equation, given they run proprietary software meaning it’s not possible to lift the lid and peer inside to do a sweep for built-in backdoors.
But where security is concerned, there are ever caveats. I ask a privacy expert for his opinion on One-time pads and he responds with: “pretty NSA unhackable, for friends/family & politics”, adding that OTP running on a mobile handset might also be a “good idea” if implemented very cautiously — e.g. “on a hackerspace manufactured air-gap primitive Blackberry device with keyboard & LCD, and NO CPU (discrete logic gates)”. However his concise verdict on OTP on mainstream smartphone hardware is not positive. “Bugatti into skateboard is wrong,” he says — pointing to baseband backdoor risks, and also the potential of generated randomness not being random enough.
So One-time pad’s perfect, paper-based secrecy is one thing. But it does not necessarily translate into perfect security in a technology context. It comes down to how you implement it. And mainstream smartphones are certainly convenient but they are not perfectly secure. So Zendo entails (yet) another security vs convenience balancing act.
Even so, the app remains compelling as an easy to use tool for selectively shrinking passive surveillance — whether that’s web companies doing ad profiling, or casual hackers trying to get access to your passwords, or even dragnet digital state surveillance that’s indiscriminately tapping the Internet’s backbone to harvest haystacks of data — given that an offline key exchange for One-time pads does offer a more robust security guarantee for protecting messages in transit. (“When you reduce the attack surface and you make it near to you, you’ve seen it’s constrained and you can do less stuff, but it’s [better for] security,” is how Couprie puts it.)
“If you are the active target of an investigation then it gets harder for me to guarantee your security,” adds DeNeut.
We think the app’s for everybody. Because you don’t need to use a single messaging app in your life.
So people on the NSA’s watchlist won’t find much in Zendo to reassure them. Nor should they. That’s not the aim. This is a messaging app for average web users who are tired of all their digital movements being ceaselessly snooped on for others’ financial gain and want a channel that’s harder for dragnets to trawl. And maybe also for those who feel social noise on mainstream digital services is diluting the signals they do really want to hear. Who are looking for a way to have a more intimate conversation, that doesn’t necessitate shouting to be heard over the branded hubbub.
“We think the app’s for everybody. Because you don’t need to use a single messaging app in your life,” says DeNeut. “It’s very easy to have two or three or four, you get a notification, you tap on the notification, you go to that, it opens that app and you respond or whatever. So it’s trivially easy to use multiple apps.”
“Everybody probably has someone they want to communicate with privately,” he adds. “Significant others, business partners, people that you want to send passwords to occasionally, or you want to send them the door code for the apartment building or whatever. And then close friends and things. Since you meet them in person anyway it’s no trouble to exchange keys. So if you want to send them something that’s not going to be added to your profile at Facebook or whatever.”
“Millennials are super sensitive about their entire lives having been documented in social media from the moment that they were born,” adds Newbold. “And they are more and more aware of alternatives to the GooglePlex services where you’re giving up all of your data for services. Snapchat is ephemeral messaging but it’s definitely people who don’t want to have all of their private moments become part of their permanent record.”
Digital communications are already fragmented across scores of messaging apps and services. And that’s no accident. It’s absolutely about user preference. The digital medium is the message. So with that in mind, Zendo’s pro-privacy, pro-intimacy message feels novel enough to find an appreciative audience. I for one welcome this cryptographic unicorn.
