Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

uTox – Free, Secure Instant Messaging

utox.org

Post reply on HN
Print view View original

41–50 of 65 posts

Re: uTox – Free, Secure Instant Messaging

#41

Post by nickpsecurity »

astonex wrote: post #23

I would use Tox and any of its clients with caution. At one point in time, your friends would be able to execute arbitrary shell commands on your PC if you were running utox and accepted a file download. Even with large security concerns like this, the lead developer believes Tox and uTox is secure because he reads the code he wrote himself (none the less git history is filled with bug fixes he clearly missed in his…

That last part is enough to ditch them unless you were fighting with them in IRC. Were you?

Your claims ring true for vast majority of new, COMSEC schemes. Far as Tox, this is what I found on their GitHub page: "Current build status: build failing." I'll add that NSA and malware authors have 0-days on the platforms the tool will likely run on. It will be bypassed like all others on such platforms.

Re: uTox – Free, Secure Instant Messaging

#43

Post by nickpsecurity »

bluesmoon wrote: post #28

Back in 2001, the ayttm project supported free, secure instant messaging by using gpg to encrypt all messages and by allowing you to split a conversation across multiple networks (Yahoo, MSN, AOL, XMPP).

Appreciate the tip. The Snowden leaks appear to support that GPG is so robust that even NSA analysts use it. So, a project using IM over it is playing it extra smart (albeit clunky). Turns out it's still active:

http://ayttm.sourceforge.net/features.php

Re: uTox – Free, Secure Instant Messaging

#44

Post by nickpsecurity »

adwf wrote: post #19
chrismartin wrote: post #13

Why would I use this instead of XMPP and OTR?

The main thing for me is the lack of a central account server. Even with XMPP, you still need to have an account and login somewhere to authenticate. With this, you have to authenticate each friend manually, but only the once. After that, there is no account but the profile stored on your hard drive.

That's certainly a selling point. The problem: newer and hand-rolled stuff always has serious problems. Many continue to have serious problems over time. I'd be interested in seeing software that solved those problems while leveraging proven protocols, clients, etc. Might just be a plugin to several popular IM clients.

Re: uTox – Free, Secure Instant Messaging

#45

Post by astonex »

nickpsecurity wrote: post #41
astonex wrote: post #23

I would use Tox and any of its clients with caution. At one point in time, your friends would be able to execute arbitrary shell commands on your PC if you were running utox and accepted a file download. Even with large security concerns like this, the lead developer believes Tox and uTox is secure because he reads the code he wrote himself (none the less git history is filled with bug fixes he clearly missed in his…

That last part is enough to ditch them unless you were fighting with them in IRC. Were you? Your claims ring true for vast majority of new, COMSEC schemes. Far as Tox, this is what I found on their GitHub page: "Current build status: build failing." I'll add that NSA and malware authors have 0-days on the platforms the tool will likely run on. It will be bypassed like all others on such platforms.

I was just idling on their channel when irungentoo got me banned for my post here.

Re: uTox – Free, Secure Instant Messaging

#46

Post by nickpsecurity »

astonex wrote: post #45
nickpsecurity wrote: post #41

Earlier quoted context omitted.

That last part is enough to ditch them unless you were fighting with them in IRC. Were you? Your claims ring true for vast majority of new, COMSEC schemes. Far as Tox, this is what I found on their GitHub page: "Current build status: build failing." I'll add that NSA and malware authors have 0-days on the platforms the tool will likely run on. It will be bypassed like all others on such platforms.

I was just idling on their channel when irungentoo got me banned for my post here.

Yeah, that's quite questionable. They need to be able to handle and defend criticism better if they want to make it in INFOSEC. Especially if they ever get press like Cryptocat or Diaspora did.

Re: uTox – Free, Secure Instant Messaging

#48

Post by lawl »

astonex wrote: post #23

I would use Tox and any of its clients with caution. At one point in time, your friends would be able to execute arbitrary shell commands on your PC if you were running utox and accepted a file download. Even with large security concerns like this, the lead developer believes Tox and uTox is secure because he reads the code he wrote himself (none the less git history is filled with bug fixes he clearly missed in his…

Not saying your lying or anything. But if you make accusations like that you should probably back them up with a chat log.

Re: uTox – Free, Secure Instant Messaging

#49

Post by astonex »

lawl wrote: post #48
astonex wrote: post #23

I would use Tox and any of its clients with caution. At one point in time, your friends would be able to execute arbitrary shell commands on your PC if you were running utox and accepted a file download. Even with large security concerns like this, the lead developer believes Tox and uTox is secure because he reads the code he wrote himself (none the less git history is filled with bug fixes he clearly missed in his…

Not saying your lying or anything. But if you make accusations like that you should probably back them up with a chat log.

Chat logs of which bit are you after?

Re: uTox – Free, Secure Instant Messaging

#50

Post by listic »

Wow, Skype must have really cemented its place in public conscience as an instant messaging service.

I would think a new service should support video chat before comparing itself to Skype, but no. (I am actually seeking an open-source alternative to Skype that supports video conferencing: I know of audio clients/services, but not about video)

Post reply on HN