Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tox: A simple, distributed, free, secure Skype replacement. Now alpha with A/V

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 147 posts

Re: Tox: A simple, distributed, free, secure Skype replacement. Now alpha with A/V

#51

Post by nmflkjfelkrnfl »

shitlord wrote: post #46
nmflkjfelkrnfl wrote: post #30

For those that don't already know, this project comes from 4chan's technology board. While there's a lot of inane trash, there are also some real gems if you're patient enough. I find lots of really cool stuff there that doesn't seem to be anywhere else. More technically-capable people are always welcome to help drown out the inanity. :) http://boards.4chan.org/g/catalog

Interesting development: http://boards.4chan.org/g/thread/43340418/its-official-bitto...

Ignore all bait threads. Sage all bait threads. Report all bait threads. Hide all bait threads.

Don't take the troll bait. ;)

Re: Tox: A simple, distributed, free, secure Skype replacement. Now alpha with A/V

#52

Post by dredmorbius »

alex_duf wrote: post #14
phobitor wrote: post #8

What about its design makes it secure? Do you guys have a design document or a description of how you've implemented security? Have any security experts audited the code?

This is a good question. What makes it secure ? "encryption" is not enough. Do you have central servers or is it protocol using P2P ? how do you connect one client to another ? What kind of encryption ? How are the key generated, can we change them etc...

"Secure" is a lot of things.

"Secure against bulk surveillance" is a big push in a lot of areas, it's a button Bruce Schneier and Eben Moglen have been pushing hard for the past year or so. See especially their joint lecture at Columbia Law School in December, 2013, and Schneier's presentation to Stanford Law School in April, 2014 (both are on http://FixYT.com).

Anonymized persistent IDs associated with physical / persistent IP addresses represents a different level of threat, particularly for those who are engaged in activities for which concern from a APT (advanced persistent threat) such as a state actor, with either legal impunity or significant resources, or both, is a concern. In that case, I'd want to see a system with repudiable identifiers and Onion routing such that endpoints aren't clearly determinable.

That said, yours is a crucial question.

Related: what are the threat models against which Tox is a response?

Re: Tox: A simple, distributed, free, secure Skype replacement. Now alpha with A/V

#53

Post by notsecure »

dredmorbius wrote: post #49

NB: the tox project website is unusable w/o JS enabled. Please fix that. https://tox.im/ While we're at it, the rest of the suggestions may be useful: http://www.reddit.com/r/dredmorbius/comments/27d5xr/please_f... From the FAQ, this I like: "The goal of this project is to create a configuration-free P2P Skype replacement. Configuration-free means that the user will simply have to open the program and without any acc…

The website should be completely functional with JS disabled (and it is for me), what issues do you get?

Note: I'm not in charge of the tox.im website, if it were up to me there would be no javascript at all.

Re: Tox: A simple, distributed, free, secure Skype replacement. Now alpha with A/V

#54

Post by walterbell »

irungentoo wrote: post #36
alex_duf wrote: post #34

Earlier quoted context omitted.

Cool. Is this direct connection from peer to peer or does the communication bounce from one node to another as a TOR communication would do ? (I'm guessing direct for obvious latency reasons when using audio / video)

Direct connection when possible. Connection routed over one TCP node when direct connections are impossible due to NAT issues.

Does only the one-time signalling handshake go to a TCP node (NAT hole punching) or does all traffic? Are these TCP nodes similar to Skype "super-peers" - how are they selected?

Virtually all consumers are behind NAT devices.

Re: Tox: A simple, distributed, free, secure Skype replacement. Now alpha with A/V

#56

Post by hobarrera »

ledo wrote: post #19

i've been keeping an eye on this project for a while, it looks really promising. I'm spreading the word about it where i can.

How is it superior to existing IM protocols (eg: XMPP)?

The article comapres it to skype, which is popular, but, techonologically, one of the worst protocols around.

Re: Tox: A simple, distributed, free, secure Skype replacement. Now alpha with A/V

#57

Post by pikdum »

hobarrera wrote: post #55
irungentoo wrote: post #6

Earlier quoted context omitted.

Tox is distributed meaning it doesn't rely on any central servers.

As is XMPP. Does Tox actually offer any advantages?

From what I understand, XMPP is decentralized, whereas Tox is distributed.

http://cffn.ca/img/articles/Centralized-Decentralized-And-Di...

Re: Tox: A simple, distributed, free, secure Skype replacement. Now alpha with A/V

#58

Post by irungentoo »

walterbell wrote: post #54
irungentoo wrote: post #36

Earlier quoted context omitted.

Direct connection when possible. Connection routed over one TCP node when direct connections are impossible due to NAT issues.

Does only the one-time signalling handshake go to a TCP node (NAT hole punching) or does all traffic? Are these TCP nodes similar to Skype "super-peers" - how are they selected? Virtually all consumers are behind NAT devices.

The majority of NATs can be hole punched.

If you can't hole punch then you will connect to your friend through a couple TCP nodes. They act like relays.

TCP nodes are pretty much randomly selected by peers and anyone can host them.

Everything is encrypted and TCP nodes are regarded as being possibly hostile so there should not be any security issues.

Re: Tox: A simple, distributed, free, secure Skype replacement. Now alpha with A/V

#59

Post by dredmorbius »

notsecure wrote: post #53
dredmorbius wrote: post #49

NB: the tox project website is unusable w/o JS enabled. Please fix that. https://tox.im/ While we're at it, the rest of the suggestions may be useful: http://www.reddit.com/r/dredmorbius/comments/27d5xr/please_f... From the FAQ, this I like: "The goal of this project is to create a configuration-free P2P Skype replacement. Configuration-free means that the user will simply have to open the program and without any acc…

The website should be completely functional with JS disabled (and it is for me), what issues do you get? Note: I'm not in charge of the tox.im website, if it were up to me there would be no javascript at all.

Chromium w/ ScriptSafe installed: no text until I allow the primary domain's JS:

http://imgur.com/6xOfCr0

http://imgur.com/E8WK98R

Re: Tox: A simple, distributed, free, secure Skype replacement. Now alpha with A/V

#60

Post by gcb0 »

nmflkjfelkrnfl wrote: post #51
shitlord wrote: post #46

Earlier quoted context omitted.

Interesting development: http://boards.4chan.org/g/thread/43340418/its-official-bitto...

Ignore all bait threads. Sage all bait threads. Report all bait threads. Hide all bait threads. Don't take the troll bait. ;)

those "trolls" have a very sane point about having to be an idiot to trust bittorrent, the company.
Post reply on HN