But I already have end to end encryption - that's literally any sensible TLS configuration, and what iOS requires for apps unless they explicitly opt in to allowing weak connections.<p>Responding to the nonsense introduction:<p>> By design, traditional web applications enable server administrators to monitor all user activities.<p>That's a choice. What is the compelling reason for a company that wants to monitor the use of their apps to use a system that ostensibly says you can't?<p>> Although these web apps offer “privacy settings” to users, they fail to provide any real privacy protection.<p>Yes, because the options are either the data is inherently insecure, or the data is fully encrypted. Governments and users both have difficulty with this concept: you cannot have data security and also backdoors, you can't have data security and also "I have lost every component of my account identity: devices, passwords, and passcodes, but want you to recover my data".<p>This is ignoring companies for whom "privacy settings" are an intentional lie (Facebook, Google, ...), and again, why would such a company adopt a platform that ostensibly forces lack of spying?<p>> Shelter Protocol introduces new ways to handle logins and data storage on the server while preserving the conventional username/password experience that users are familiar with.<p>The username/password system people are familiar with is widely understood, and clearly demonstrated, as being bad for security.<p>> Instead of storing data in a database in clear text on the server, data can now be end-to-end encrypted and synced across multiple devices, and even across servers operated by different individuals.<p>Already completely doable, and the companies that don't do so have chosen not to, for a variety of reasons - some good, some bad, but those reasons are not because encrypting content securely is hard.<p>> The Shelter Protocol (SP) defines operations for a high-level, lightweight, federated, end-to-end encrypted virtual machine.<p>Or you can use JS, which is already available, runs on every machine that exists at this point (is this good?), is already federated: any device can run any JS you send it.<p>> [remainder of front page]<p>Largely nonsense.<p>* Key concepts *<p>> Since every action in SP is signed using a user’s private key, which in turn is derived from their password<p>So it's bad crypto. Huzzah!<p>After this I got bored reading this nonsense.<p>There's no actual justification for why this magical VM is necessary or good, nor any explanation of how they're going to make it "federated" (because despite advertising federation, it does not appear to be), what they consider federation to be, or why that is good.<p>Their one example app does nothing that requires any of their advertised features - literally every part of this could be done with existing web tech, and largely be done better.