IdeaWell

Project ideas from Hacker News discussions.

(Post-Quantum) Cryptographic Right Answers

Original Article

Hacker News Discussion

📝 Discussion Summary (Click to expand)

1. Skepticism toward post‑quantum cryptography (PQ)
Many commenters see PQ as a misallocation of effort.

“Meh don't care about the actual PQ parts. I'm with Peter Gutmann [0] in that PQ is just a waste of time and draining resources that could be put to better use.” – commandersaki

2. Debate over what rclone actually is and how it should be used
Opinions differ on whether rclone serves as a backup solution or merely a file‑transfer utility, and some question its suitability for cryptographic tasks.

“Why can't I use rclone?” – paulnpace
“rclone isn't a backup tool, it's a file transfer tool” – doomrobo
“Never heard of rclone but probably not a Cryptographic right answer because encryption isn't always on.” – commandersaki

3. Resistance to passkeys in favor of traditional password‑hashing approaches
Users express a strong dislike for passkeys and argue for sticking with Argon2id or scrypt.

“I hate passkeys and if your service doesn't offer an alternative then I'm not using your service.” – zarzavat

🚀 Project Ideas

Generating project ideas…

Rclone Backup Suite

Summary

  • A desktop/web wrapper around rclone that adds scheduling, incremental snapshots, integrity verification, and a simple UI to turn rclone into a true backup solution.
  • Core value: eliminates the need to learn complex cron scripts while giving users reliable, automated backups using their existing rclone remotes.

Details

Key Value
Target Audience Power users, sysadmins, and enthusiasts who already use rclone for sync but want backup features
Core Feature Scheduled, versioned snapshots with checksum verification and one‑click restore
Tech Stack Electron (or Tauri) for UI, Go backend calling rclone, SQLite for job metadata
Difficulty Medium
Monetization Revenue-ready: "Tiered SaaS (free personal, $5/mo pro for advanced scheduling & cloud storage)"

Notes

  • Addresses the complaint: “rclone isn't a backup tool, it's a file transfer tool” – doomrobo.
  • Gives users a reason to finally adopt rclone: “Why can't I use rclone?” – paulnpace.
  • Provides a straightforward UI that removes the friction of scripting, making backup workflows accessible.

FlexAuth – Passkey‑Optional Auth Service

Summary

  • An authentication API/SDK that lets developers offer traditional password (Argon2id/scrypt) + TOTP and passkeys, with a simple toggle to disable passkeys for users who prefer alternatives.
  • Core value: respects user choice, preventing lock‑out for those who dislike passkeys while still supporting modern WebAuthn where desired.

Details

Key Value
Target Audience SaaS products, developers building login systems who want to give users a passkey opt‑out
Core Feature Unified login endpoint supporting password, TOTP, and optional passkeys; admin dashboard to enable/disable passkey flow
Tech Stack Node.js/Express, PostgreSQL, WebAuthn library, Argon2/npm scrypt, Docker
Difficulty Medium
Monetization Revenue-ready: "Freemium: free up to 1k MAU, $0.01 per MAU thereafter"

Notes

  • Directly satisfies: “I hate passkeys and if your service doesn't offer an alternative then I'm not using your service.” – zarzavat.
  • Also references the password‑handling discussion: “Password handling: Argon2id or scrypt. But have you considered passkeys instead?” – zarzavat.
  • Enables developers to comply with security best practices while respecting user preferences highlighted in the thread.

CryptoConfigurator Library

Summary

  • A lightweight cryptographic library that lets developers enable/disable post‑quantum algorithms and choose specific curves (e.g., skip P‑384) via a simple config flag, defaulting to classical, well‑studied primitives like Argon2id/scrypt and Curve25519.
  • Core value: reduces unnecessary complexity and perceived waste from PQ crypto for teams that don’t need it, while still offering the option when required.

Details

Key Value
Target Audience Cryptography‑aware developers, security engineers building TLS, SSH, or custom protocols who want fine‑grained control over algorithm selection
Core Feature Configurable algorithm suite: toggle PQ, select curves, enforce Argon2id/scrypt for KDF
Tech Stack Rust (core) with C FFI bindings, optional WASM build
Difficulty High
Monetization Hobby (open‑source, optional donations/sponsorships)

Notes

  • Echoes the sentiment: “Meh don't care about the actual PQ parts. I'm with Peter Gutmann … PQ is just a waste of time…” – commandersaki.
  • Responds to curve discussion: “Okay - so... they're saying... don't use p384? :3” – pluto_modadic.
  • Gives teams a way to strip out unwanted PQ complexity while still maintaining strong security via Argon2id/scrypt, matching the password‑handling preferences seen in the thread.

Read Later