Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sunsetting Tor Messenger

blog.torproject.org

Post reply on HN
Print view View original

21–30 of 71 posts

Re: Sunsetting Tor Messenger

#21

Post by BuildTheRobots »

datamoshr wrote: post #20

I think the world of secure messaging is in an odd-way at the moment. It feels a bit like competing standards at this point[1]. I'm personally still using signal as the metadata shared by Wire is way too much imho. Even more interestingly the EFF has stopped trying to recommend the best one and instead is encouraging the users to do their own reasearch (even redirects old urls[2]) 1. https://xkcd.com/927/ 2. https://…

Signal is great; except there's also tonnes of metadata.

If I'm trying to talk to someone anonymously, having to give them my phone number somewhat defeats that anonymity. Even having it installed is potentially dangerous; it scans your phone book and suggests other signal users (thereby outing you as a user in the first place).

Re: Sunsetting Tor Messenger

#22

Post by sandworm101 »

jerheinze wrote: post #18
sandworm101 wrote: post #12

Would like to read, but it looks like my work is blocking access to torproject.org. I had not realized that this sort of blocking was in place. Gauntlet thrown. My project for today is now to gain access to Torproject on my work machine. Bonus points for installing and running Tor without elevated privileges.

Here are some links you may try, https://via.hypothes.is/https://blog.torproject.org/sunsetti... https://web.archive.org/web/https://blog.torproject.org/suns... https://archive.fo/U8jHR https://archive.is/U8jHR https://archive.today/U8jHR > Bonus points for installing and running Tor without elevated privileges. Try https://github.com/TheTorProject/GetTorBrowser then use meek-amazon as a pluggable transport to get it…

Reading the material on other pages is cheating. I'm trying to bypass the blockade altogether, disproving its utility. Similarly, the issue isn't slipping the tor traffic through the firewall but actually installing the software on a machine theoretically configured to prevent installation of software.

Re: Sunsetting Tor Messenger

#23

Post by reitanqild »

BuildTheRobots wrote: post #21
datamoshr wrote: post #20

I think the world of secure messaging is in an odd-way at the moment. It feels a bit like competing standards at this point[1]. I'm personally still using signal as the metadata shared by Wire is way too much imho. Even more interestingly the EFF has stopped trying to recommend the best one and instead is encouraging the users to do their own reasearch (even redirects old urls[2]) 1. https://xkcd.com/927/ 2. https://…

Signal is great; except there's also tonnes of metadata. If I'm trying to talk to someone anonymously, having to give them my phone number somewhat defeats that anonymity. Even having it installed is potentially dangerous; it scans your phone book and suggests other signal users (thereby outing you as a user in the first place).

I'll defend Signal here. This is all about your threat model:

My threat model includes:

- kids in my house

- Facebook selling my data to insurance companies

- future employers googling me

- etc

It does not include:

- NSA

- local police (in 2018)

I'll still try to give away as little as possible as while I trust local authorities now I've no reason to be sure I can trust them in 5, 10 or 20 years (see Turkey).

In my case Signal seems reasonable for some things and for now.

Personally I'm also annoying all crypto experts here by using Telegram for some communication and I might even use postcards for other communication (and there might even be communication channels I use but never talk about).

Re: Sunsetting Tor Messenger

#24

Post by Boulth »

tribby wrote: post #6

ricochet[1] is my preferred option for situations that would require something like tor messenger (which is very few situations, but I digress). I like that the UX has a built-in threat model (e.g. "do you really want to click on this?") TAILS users can't use it because tor-over-tor is weird (ricochet uses its own tor process). but it looks like it's getting close.[2] 1. https://ricochet.im/ 2. https://labs.riseup.ne…

I wish the page had screenshots. That's usually a good measure of how the software is maintained. Currently the page mentions that it's "experimental".

As far as I can see currently the only widely used, secure protocols are Matrix and XMPP with OMEMO.

Re: Sunsetting Tor Messenger

#25

Post by upofadown »

nukeop wrote: post #7

Matrix.org/Riot.im has all the encryption you could wish for, a modern, useful interface, and a federated model in which everyone can run their own server and talk to everyone else, just like email.

What metadata mitigations does matrix have (the point of Tor Messenger)? We already have a federated protocol called XMPP. Sometimes you are interested in not revealing who you are talking to.

Re: Sunsetting Tor Messenger

#26

Post by jerheinze »

Boulth wrote: post #24
tribby wrote: post #6

ricochet[1] is my preferred option for situations that would require something like tor messenger (which is very few situations, but I digress). I like that the UX has a built-in threat model (e.g. "do you really want to click on this?") TAILS users can't use it because tor-over-tor is weird (ricochet uses its own tor process). but it looks like it's getting close.[2] 1. https://ricochet.im/ 2. https://labs.riseup.ne…

I wish the page had screenshots. That's usually a good measure of how the software is maintained. Currently the page mentions that it's "experimental". As far as I can see currently the only widely used, secure protocols are Matrix and XMPP with OMEMO.

> I wish the page had screenshots.

The Github page has one: https://github.com/ricochet-im/ricochet/

> As far as I can see currently the only widely used, secure protocols are Matrix and XMPP with OMEMO.

secure != metadata free

Re: Sunsetting Tor Messenger

#27

Post by practice4u »

http://www.drrichdentistry.com/

General Dentist Newport Beach, Oral Conscious Sedation Costa Mesa, Irvine Orange County

Contact Dr Rich General Dentist in Newport Beach for general dentistry treatment, Oral Conscious Sedation and for several other diseases. Get treated for general dental problems in Costa Mesa, Huntington Beach, and Irvine Orange County.

Re: Sunsetting Tor Messenger

#28

Post by jerheinze »

sandworm101 wrote: post #22
jerheinze wrote: post #18

Earlier quoted context omitted.

Here are some links you may try, https://via.hypothes.is/https://blog.torproject.org/sunsetti... https://web.archive.org/web/https://blog.torproject.org/suns... https://archive.fo/U8jHR https://archive.is/U8jHR https://archive.today/U8jHR > Bonus points for installing and running Tor without elevated privileges. Try https://github.com/TheTorProject/GetTorBrowser then use meek-amazon as a pluggable transport to get it…

Reading the material on other pages is cheating. I'm trying to bypass the blockade altogether, disproving its utility. Similarly, the issue isn't slipping the tor traffic through the firewall but actually installing the software on a machine theoretically configured to prevent installation of software.

Which OS are you using? FWIW Tor Browser doesn't require root and it's portable.

Re: Sunsetting Tor Messenger

#29

Post by anc84 »

buovjaga wrote: post #5

Retroshare now provides a Tor version: https://retroshareteam.wordpress.com/2018/03/13/release-note... > Running Retroshare over Tor has a number of definite advantages: it does not require firewall management (Tor does it for you); you do not need a DHT to find your friends (Tor does it for you), and whatever code is tied to ensuring security of your IP information is not needed anymore.

Retroshare is fantastic. I wish it would do less though, or at least make its UI more suited to newcomers. As it is, it is overwhelming and confusing.

Re: Sunsetting Tor Messenger

#30

Post by floatboth »

edhelas wrote: post #11
nukeop wrote: post #7

Matrix.org/Riot.im has all the encryption you could wish for, a modern, useful interface, and a federated model in which everyone can run their own server and talk to everyone else, just like email.

As far as I remember you needed quite big servers if you wanted to "federate" with others, like join big chatroom because Matrix will try to replicate the history and keep it in sync. Is it still the case?

If you set caching settings to the absolute minimum and use Postgres, it's not bad.

Though occasionally everything slows down and you have to run a query to cleanup (https://github.com/matrix-org/synapse/issues/1760#issuecomme...)

Post reply on HN