I've been a private beta tester for an iOS client for Tox called 'Antidote', and I can speak for its quality. I will not pretend to be an encryption or security specialist of any form however.
TOX – A New Kind of Instant Messaging
31–40 of 110 posts
Re: TOX – A New Kind of Instant Messaging
#32Right now I'm not really bothered about end-to-end encryption. If a government wants to track me, they will find a way. I'm more concerned about Facebook/Google/Microsoft/Apple tracking me, reading my private conversations, and selling my data to the highest bidder. I'd like an open source, decentralised messaging platform, that has good mobile apps. Are suggestions?
> If a government wants to track me, they will find a way
Things like OTR: https://en.wikipedia.org/wiki/Off-the-Record_Messaging Actually stops these people though, and is even labelled in some of the Snowden Files as being "Catastrophic" to their efforts. But you are right, if they can't get chat on you they can just target you inside the Internet and send a malware payload disguised as an update to your browser.
Re: TOX – A New Kind of Instant Messaging
#33Earlier quoted context omitted.
Moxie doesn’t consider that kind of privacy important. Governments listening to you is irrelevant, and third party clients are something he actively tries to prohibit. His position is that it’s better if everyone gets a little safety, than if a few people get full safety.
"that kind of privacy". So which 'kind' of privacy does it try to improve on? I've been thinking of switching to a different application for messaging and Signal came by a few times but I don't know a lot about it. Would you care to elaborate?
Moxie tries to provide privacy that protects everyone against the normal police, or hackers, or other adversaries – but it does and can not provide any protection against the NSA, or the FBI, and is not intended to do so.
Re: TOX – A New Kind of Instant Messaging
#34FYI: https://en.wikipedia.org/wiki/Tox_(protocol)
It seems robust, but I do worry about the client. Has the client been audited properly? I hope the track record's not like Pidgin's https://pidgin.im/news/security/
Re: TOX – A New Kind of Instant Messaging
#35Right now I'm not really bothered about end-to-end encryption. If a government wants to track me, they will find a way. I'm more concerned about Facebook/Google/Microsoft/Apple tracking me, reading my private conversations, and selling my data to the highest bidder. I'd like an open source, decentralised messaging platform, that has good mobile apps. Are suggestions?
riot.im [1] (which is based on matrix.org) seems a good, decentralized, open messaging app. They have relatively nice mobile apps and they promise to soon release end-to-end encryption based on the OLM [2] ratchet which is similar to the Signal encryption. In contrast to Tox, Matrix relies on federated servers. Tox is pure P2P which, in my experience, never works very well on mobile devices.
[1] https://riot.im/ [2] https://matrix.org/docs/spec/olm.html
Re: TOX – A New Kind of Instant Messaging
#36Earlier quoted context omitted.
But you realize that's like saying "Well, I tried IRC but there are dozens of competing clients that all do the same thing." The Tox protocol is really the core tool. As long as the protocol is well-defined and maintained, I think developers should be free to make whichever clients that they want. I used tox ages ago, and I used the Blight client or whatever it was called, and I liked it pretty well. I think a bigger…
In this case, it's not like saying anything about IRC chat clients or Hipchat or whatever your team uses or develops. The clients really did look and behave the same. There was so much overlap between them. Not exaggerating this point.
I had a similar experience and it seemed like they were both being developed by the same core group(s) dividing their time between both (again, my perception) which was confusing as they were very similar.
Re: TOX – A New Kind of Instant Messaging
#37from the FAQ: "How do I add someone to my contacts list? Look in the profile or settings panel of your client to get your Tox ID which should look something like: 56A1ADE4B65B86BCD51CC73E2CD4E542179F47959FE3E0E21B4B0ACDADE51855D34D34D37CB5" Yuk! I see this flaw so many products like this, just about anything p2p, blockchain addresses, commit ids, etc. I think there is zero chance of getting anyone who is not technolo…
> Why aren't Identicons or QR codes used more? Nothing stops you from turning that hash into a QR code (afaik Antox does) - but then how do you copy & paste it?
a common usage, if you're able to do in person meetings, is to produce and scan them with your smartphone. much better than spelling the whole fingerprint. this makes, for instance, gpg key exchange a nice thing finally.
Re: TOX – A New Kind of Instant Messaging
#38What makes this better than Signal for texting?
Signal requires you to use your phone number.
Re: TOX – A New Kind of Instant Messaging
#39Previously - https://news.ycombinator.com/item?id=6121225
Re: TOX – A New Kind of Instant Messaging
#40Be warned, Tox claims to protect users from "governments", which is a huge claim. Yet, it's written in C, it hasn't had a security audit, it does not publish a list of security risks and mitigations, and, regarding its roots in 4chan, see for yourself: https://github.com/irungentoo/toxcore/issues/1186
We're in the process of writing a specification (https://github.com/TokTok/spec) and new implementation in Haskell (https://github.com/TokTok/hs-toxcore). There is also a Rust implementation in the works (https://github.com/zetok/tox).
As for security risks and mitigations, I'd like to do that when we have a web presence with space for it. Right now, the web presence is fairly poor (http://toktok.github.io/). The specification contains some security risks and mitigations.