
Flock, Private Contact and Calendar Cloud Sync for Android - Kototama
https://whispersystems.org/blog/flock/
======
gadders
Anyone remember the social web browser, Flock? I wonder if there is a minimum
time before these names can be re-used.

------
synchronise
Is there any way of getting this to work with Syncthing or BitTorrent Sync so
I don't have to use a 3rd party server at all?

------
alain94040
FYI, for those who absolutely do not trust the cloud, a similar tool based on
sync with Thunderbird is Birdiesync
([http://birdiesync.com](http://birdiesync.com)).

------
higherpurpose
Great stuff. This is important work to get everything end-to-end encrypted.
Any updates on how the integrated messaging up is coming along, and whether
we're still getting a desktop app/extension soon, too?

I'd love for nothing else than to give up using Hangouts, but I use it a lot
to talk to people from my computer to their phones, and right now apps like
Whatsapp or TextSecure are no go for that. Hopefully there will be a solution
for it soon.

~~~
halon
WhisperSystems are working on a web based TextSecure
[https://github.com/WhisperSystems/TextSecure-
Browser](https://github.com/WhisperSystems/TextSecure-Browser)

------
PeterWhittaker
Will Flock sync calendars and contacts from multiple accounts, e.g., my
personal Google account (gmail.com) and my business account
(privatedomainIown.tld)?

If yes, I will sign up right away.

Next question: What about sync with CRMs, e.g., SugarCRM or 1CRM (or others,
that's cool too)? I need two-way contact and calendar sync between my CRM and
my Android device, I would pay you more than $5/year for it.

~~~
r76c65b6
I'm trying it out for 30 days. So far this is what I've found. I'm syncing out
of google into flock. My plan is to at some point delete all my contacts and
calendars out of google. But we'll see. Yes it does allow syncing multiple
accounts. And multiple calendars from the same account as well. Groups are not
supported (yet as of v0.51) but hopefully this will change in the future.

Not sure about the answer for your other question.

------
felixmar
Somewhat off-topic but when can we expect a release of TextSecure for iOS?

~~~
jmathai
They are working on it [1]. Behind schedule so they're anxious as well.

[1]
[https://twitter.com/jmathai/status/491294401579077634](https://twitter.com/jmathai/status/491294401579077634)

------
jkscm
Can I host a Flock server and charge money for it myself? Many people may not
like having to sync their data to servers in the USA, even if the data is
encrypted.

~~~
not_rhodey
The Android Flock client works with any standards compliant
WebDAV/CardDAV/CalDAV server. There is nothing stopping anyone from running a
server of their own, at which point you can do anything you want with the
server including charge for its use.

------
garyfirestorm
Can someone explain me the difference between google sync services vs Flock?
In either case, the data leaves the device.

~~~
moxie
With Google Sync, the servers have access to your plaintext data. This means
that Google Inc, the engineers at Google with access to the servers, any
attackers that compromise Google's sync servers, or any governments that
compel Google to provide them access to the servers, all have access to
everything (photos, contacts, calendar entries, documents, etc.) that you
sync.

With Flock, the data is encrypted with a key that only the user knows before
being transmitted to the server. This means that nobody with access to the
Flock servers can see your data.

------
mercnet
1\. Do I disable Google Sync services (gmail, cal, and contacts) and replace
it with Flock? 2\. Is my contact list and cal events empty until I enter a
password to unlock them?

~~~
moxie
1\. You can replace your Google sync account with Flock if you choose. You can
import data from a Google account into your Flock account without destroying
or altering the data in your Google account.

2\. The Flock encryption is used for transmitting data to/from the server. On
the device, we let the Android permission system take over from there, so you
don't have to enter a password in order to see your contact or calendar items.
Your workflow remains the same as before.

~~~
StavrosK
I will definitely pay for this, if it works well. Contacts and calendar sync
are very important to me, and nothing else does it as well as Google, right
now (as far as I know).

Feature request: Please support contact checkpoints. Some app accidentally
deleted all my contacts once, and the only thing that saved me was Google's
"restore contacts as they were X time ago" feature.

------
vincentkriek
I love that there are creative artistic people out there that care about
privacy and owning your own data. There are tons of great apps out there that
basically do this like CalDAV/CardDAV sync [1][2], but they aren't beautiful
like this one.

I like beautiful design, especially on my phone but I like owning my data even
more. This is truely a great product.

Edit: I see this is encrypted as well. I really need to dive into this! Cool
beans!

[1][https://play.google.com/store/apps/details?id=org.dmfs.cardd...](https://play.google.com/store/apps/details?id=org.dmfs.carddav.sync)
[2][https://play.google.com/store/apps/details?id=org.dmfs.calda...](https://play.google.com/store/apps/details?id=org.dmfs.caldav.lib)

~~~
patcon
Not sure if the Twitter acquisition has any part in this, but worth pointing
out:
[https://whispersystems.org/blog/welcome/](https://whispersystems.org/blog/welcome/)

EDIT: Having said that, MAN I love these folks. I wish they got along better
with the F-Droid community[1], but hopefully that will eventually get sorted
out :)

[1]:
[https://github.com/WhisperSystems/TextSecure/issues/281](https://github.com/WhisperSystems/TextSecure/issues/281)

------
andor
I've had mixed success with CalDAV connectors for Android and a self-hosted
server. The apps that I bought didn't support self-made certificates very
well, or not at all (certificate pinning would be ideal).

The best way was to create a new CA certificate and use that to sign the
server cert. But after installing the new CA cert on Android, I got a non-
removable notification that my calls and data might be monitored. I did this
on the train to a "hacker" congress, imagine how surprised I was about the
warning...

Can anybody recommend a CalDAV/CardDAV server? What does the hosted Flock
service use?

~~~
click170
That warning is really irritating, and I get the security concern but the fact
that there is no way to silence, minimize, or otherwise hide that notification
_in any way_ bothers me.

I don't understand why there is no way of telling it "yes, thank you, _I_ put
it there, shut up already, even for a short while!".

~~~
kitd
I read somewhere that it's a known bug that is being addressed. I'd like a fix
too. My company wifi requires a cert installed and now the warning pops up on
a regular basis.

------
em3rgent0rdr
I'm trying it out now. Took 5min+ to sync my 180 calendar events and is taking
forever (it seems right now) to sync my 1000+ contacts. I will try out for 30
day free trial, but I will only be paying the $5 yearly subscription if they
allow distribution on the F-Droid repository since I prefer to not have Google
Play on my phone. Open Whisper Systems has been frustratingly adamant about
not wanting to distribute TextSecure on F-Droid as it doesn't do auto updates
because they want to fix all bugs quickly (although current versions do notify
when updates to apps are ready). Until then will be sticking with ownCloud.

~~~
616c
The F-Droid thing will certainly will not happen.

Moxie, one of the core developers of the WhispherCore products, had a pretty
argumentative debate on their forum and his own Github issues regarding their
repackging of his software TextSecure. It was subsequently removed, due to his
indirect request (he went so far as to say he did not approve, but did not
directly instruct them to do so). Despite their workflow and licensing, he
believed it to be a step backwards in security as he takes issue with phone
rooting and other things (if I recall correctly).

Long story short, it is a safe guess you will not see any WhisperCore products
on F-Droid anytime soon. Moxie et al. say compile and patch yourself, or use
the Play Store (for the faint of heart).

One reference here:

[https://github.com/WhisperSystems/TextSecure/issues/281#issu...](https://github.com/WhisperSystems/TextSecure/issues/281#issuecomment-21762482)

UPDATE: Maybe I missed something entirely as you mentioned your obvious
knowledge of the F-Droid spat. Will leave it here for others though. Clumsy
reading on my part, sorry.

~~~
em3rgent0rdr
Yup. I'm one of those that has to recompile text secure whenever there is an
update. I'm hoping once F-Droid implements auto reinstall of updated apps,
then moxie will permit builds on F-Droid.

Point of correctness: F-Droid does not require root privileges to install,
just that user allows "untrusted" sources in android settings. Most F-Droid
apps don't require root privileges. Google play on the other hand is full of
malware.

~~~
616c
I know that to be the case, I was cribbing something I read from Moxie on the
F-Droid Forum where he presented his view of Cyanogen, which was pretty
inaccurate.

