Slashdot Mirror

Tox is decentralised, utilises DHT.

So you're telling me that people who want to participate in a secure, decentralised community pool resources to do so! Nice find, Sherlock.

Individuals choose if they want to operate a bootstrap node, but end users aren't acting as nodes by default because they are unsuitable for the task. It's possible that every active node throughout the entire world could go down at the exact same time, but highly unlikely. Some of those nodes have been running for years.

All of the best things are free.

You mean Tox? https://tox.chat/

Some chat services support end-to-end (E2E) encryption for one-to-one chat but not group chat. The point of the latter is to broadcast a message to all other users of a channel. How would end-to-ends (plural) encryption work?

For an example with many IRC-like features see Tox.

https://tox.chat/
Seem like a good option.

https://wiki.mumble.info/wiki/...
Likely safe from "we know better than you" trash-people.

https://wire.com/en/
Maybe?

https://about.riot.im/
Maybe?

http://www.teamspeak.com/en/te...
Guess running your own server removes the issues.

https://ring.cx/
Seem like it could work.

https://www.evolvehq.com/welco...
That's the stuff which came with AMD drivers before? Likely not safe for your freedoms.

https://app.twitch.tv/
Curse was direct competitor to Discord before. But Twitch .. Anything owned by a company like that I guess want to act like the anti-white globalists and their followers in idiocy want so .. likely not a good option? Unless one already use it and they haven't fucked around yet.

Not true: https://tox.chat/clients.html. All you got to do is email the tox profile to yourself for your phone. That's why I said it was like OpenVPN. I've used Antidote on iPhone with people using qTox on their laptop and it works very well.

https://tox.chat/clients.html Tox is open source, cross platform, free, and uses encryption and out of everything that's happened in the last few days, it hasn't been mentioned in Vault 7, as far as I know. There are apps for both desktops and mobile devices. You create a profile much the same way you create an OpenVPN config file. In other words, it can be shared across devices and isn't stored on a server. That profile, which stays on your computer/phone, contains information that's password protected regarding user info (user name and a profile pic if you want) when connecting to a Tox server. The Tox server only acts as a relay until it finds the person you want to talk to. Then, it's encrypted p2p. In most cases, it only works if both sides are running clients, much the same way as other instant messaging apps. Tox supports video or audio calling, text messaging, and file sharing. You can change your "availability." There is no phone number or "signup." The code used to act as a "phone number" is incredibly long and randomized. If someone contacts you via Tox, you either know them or you posted your Tox string online somewhere. Most clients support QR Code reading to make sharing contact info much easier. Be very careful though, Tox is also the same name given to a randsomewear designer on the dark web. They have nothing to do with each other and call me paranoid, but I suspect it was on purpose to scare people from something that works really well. I only say this because if you DuckDuckGo "Tox" by itself, bad stuff may or may not show up instead. Only people that care enough to use a Tox client are also probably the same kind of people that know what "randsomewear" is. Use the URL I gave at the beginning and you'll be fine.

It would be nice to see XMPP have a resurgence. IRC is great at what it does, but XMPP has multi-user chat that's similar (not as capable, though) as well as offline message storage. I think there was a protocol extension called Jingle iirc that brought video chat to XMPP.

Jingle is a massive family of XMPP standards (technically, XEPs - XMPP Extension Proposals). It was, in fact, the third mechanism added to provide voice and video. SIP tunnelling over XMPP and the thing Apple added with iChat were both there first, but Google did its own thing and released Jingle.

This pretty much embodies the problems with XMPP:

• They tried to be too impartial in the standards group and so you ended up with 3-4 competing XEPs that never achieved critical mass for any given feature.
• They really liked overengineering things. Eventually, Personal Eventing over PubSub is supposed to subsume most of the other things, but implementing just the core PEP parts in the client and server is a huge undertaking.
• They never backed a single permissively-licensed client library that implemented the important requirements in an extensible way. Jabber.org also changed their mind about the recommended server at least three times, so there was never a good reference platform.

I've been keeping an eye on Tox, which seems to have a better approach: they have a protocol and a reference implementation as a library, plus clients for all of the major platforms that use the library.

I don't know of any real alternatives to Skype

It still needs some polish and more features, but Tox is getting there.

He does regularly encrypt his e-mail, "but he doesn't recommend that average users scramble their email, because he thinks the encryption software is just too difficult to use."

How on earth do you use encrypted mail unless all your recipients also do the same, i.e. have public/private keys of their own that are configured in their email clients? He probably does communicate with other security minded folk who also use encryption, but the vast majority of ordinary people neither know nor care about these things.
The biggest drawback to encrypted anything is that it requires everybody to use it. There's plenty of open source and secure alternatives to popular apps but there's no point in recommending say, Signal or Toxwhen all the people you know couldn't be bothered to get off Whatsapp.

Only the Wire client is open source, the server is not.
And any proprietary centralized messenger can end up being bought by Facebook at some point.

If you want a real Free alternative, here's couple of examples:
Tox
Ring

They are both completely open source and decentralized.

It was always a stupid-sounding idea to use Whatsapp (I mean that as a totally independent fact, relative to whether or not Whatsapp was actually any good or not). From the very beginning, it was just someone's proprietary app that used an undocumented protocol. Nobody who is trying to do things right, is going to use anything like that.

Of the proprietary messengers, WhatsApp was the least bad. It was founded by people who grew up in the Soviet Union and left with an abiding hatred of surveillance, had a very strong privacy policy, and did end-to-end encryption. Also, using Erlang on FreeBSD, it had a lot of geek cred. Unfortunately, when Facebook bought it there wasn't much chance of it keeping the philosophy of the founders. On the plus side, they did donate $1m from the sale price to the FreeBSD Foundation.

I used to be a big advocate of XMPP, but it's largely been mismanaged into the ground by a lack of leadership in the standards body and a lack of decent reference implementations for the client side. Tox seems like the best bet at the moment for producing something that is both secure and open, yet with implementations that you can give to normal humans and get them connected.

Tox looks promising but it's not quite there yet from looking at their site. Their mobile device clients look buggy / under heavy development. I hope they get their soon though.

Wrong site.

https://tox.chat is the correct one.

... or until a viable competitor emerges...

Well, there is Tox.

It looks good on my initial check and i can't say what you are hearing. It is entirely possible that there is network congestion on the chosen account you are logging into or even the local ISP but I'm guessing you have taken that into account. Skype is becoming less and less of an option for those of us avoiding the biggest trojan in recentl Microsoft history, Their OS. LOL. And since there haven't been Skype update for linux for awhile it's entirely possible that change in their internal network could cut Linux users of the "latest" version for Linux off the network entirely. There is another product being assisted by Twilo but solid clients and networks for free use are tricky to find. Did you see anything on the Tox Project: https://tox.chat/ Now, I'm seeing signs on Reddit that there may be government interference attempting to circumvent/crippple the project but for the moment it still seems to be going. It has fully encrypted video/audio/chat data so that look like a possibility.

The site, twitter account and everything looks compromised: https://blog.tox.chat/2016/03/...

qTox.

https://tox.chat/clients.html

I do use a Windows phone, by the way. A /.er recommended it so I tried it and I'm pretty happy. I don't use Windows on my computer but I kind of like it on my phone. Contrary to popular opinion - there are apps available. There just aren't a few hundred thousand repeats of the same apps. I do everything that I can possibly want to do on my phone. I'm pretty happy with it and it's really quite snappy even though it's not as powerful as some of the other phones that I've owned.

At any rate, there are a bunch of clients for Tox. There is not one for Windows phone. It's end-to-end encrypted, it's decentralized, it's basically all the features that one probably wants such as video, groups, conference, text, voice (of course), and all that stuff. It's not bad. I've played with it a few times. It's not resource intensive even though it's encrypted. I dare say it's pretty good, actually. I'm not sure that I really need a chat client or anything but it's installed and I've used it a few times. It's still (seemingly) a worthy project.

Here are the FAQs:
https://tox.chat/faq.html

I am not associated in any way with the project unless one counts donating to the project.

qTox.

https://tox.chat/clients.html

I do use a Windows phone, by the way. A /.er recommended it so I tried it and I'm pretty happy. I don't use Windows on my computer but I kind of like it on my phone. Contrary to popular opinion - there are apps available. There just aren't a few hundred thousand repeats of the same apps. I do everything that I can possibly want to do on my phone. I'm pretty happy with it and it's really quite snappy even though it's not as powerful as some of the other phones that I've owned.

At any rate, there are a bunch of clients for Tox. There is not one for Windows phone. It's end-to-end encrypted, it's decentralized, it's basically all the features that one probably wants such as video, groups, conference, text, voice (of course), and all that stuff. It's not bad. I've played with it a few times. It's not resource intensive even though it's encrypted. I dare say it's pretty good, actually. I'm not sure that I really need a chat client or anything but it's installed and I've used it a few times. It's still (seemingly) a worthy project.

Here are the FAQs:
https://tox.chat/faq.html

I am not associated in any way with the project unless one counts donating to the project.

Does it do more than qTox?

Also, I'm pretty sure qTox has been doing this sort of thing (end-to-end encryption) for quite a while unless I'm missing something.

If anyone is unfamiliar with it, you can read about it here.

Put simply, there exist plenty of systems and techniques that don't depend on a third-party who could possibly grant access to secure communications. These systems aren't going to disappear. Why would terrorists or other criminals use a system that could be monitored by authorities when secure alternatives exist? Why would ordinary people?

That's a really easy answer -- terrorists use these simple platforms for the same reason normal people do: because they're easy to use. Obviously a lot of our techniques and capabilities have been laid bare, but people use things like WhatsApp, iMessage, and Telegram because they're easy. It's the same reason that ordinary people -- and terrorists -- don't use Ello instead of Facebook, or ProtonMail instead of Gmail. And when people switch to more complicated, non-turnkey encryption solutions -- no matter how "simple" the more savvy may think them -- they make mistakes that can render their communications security measures vulnerable to defeat.

If the choice was between (easy & insecure) and (hard & secure), you'd have a point, but there's plenty of easy ways to have secure communication: for example, OTR-over-(any IM protocol) is about as simple as it gets (it's literally a one-click thing, and can be set to automatically go secure with no user interaction), doesn't depend on a provider for keys, and can work with any IM network. If someone can install an executable file, they can install and use OTR.

Sure, it doesn't conceal metadata, but most (all?) IM networks leak metadata as well. XMPP-over-Tor-hidden-service can help mask that, and isn't really complicated for the users ("Open Tor, click 'Connect' and wait for the green light, then open your IM client.").

Tox is another option: anonymous, distributed, and with no single point of failure. It's as easy to use as any other IM client.

Even if secure communications weren't as easy as non-secure methods, there's plenty of easy-to-follow guides on how to setup and use secure methods. It's hardly rocket science, and those methods aren't going away, so there's no reason to expect that bad guys that are motivated to keep their communications private will avoid them simply because they may be slightly more difficult.

I'm not saying that the vendors and cloud providers ALWAYS can provide assistance; but sometimes they can, given a particular target (device, email address, etc.), and they can do so in a way that comports with the rule of law in free society, doesn't require creating backdoors in encryption, and doesn't require "weakening" their products. And of course, it would be good if we were able to leverage certain things against legitimate foreign intelligence targets without the entire world knowing exactly what we are doing, so our enemies know exactly how to avoid it. Secrecy is required for the successful conduct of intelligence operations, even in free societies.

Sure, a company could do that (and several do), but there's certainly a lot of interest from users to have secure systems (devices, accounts, etc.) that cannot be remotely unlocked or decrypted by the company or authorities (see Apple). Considering how massively the US Government abused its position of power and authority through massive, warrantless surveillance of people, hacking and snooping corporate networks, doing shady things like parallel construction, and generally violating everyone's trust, it should come as no surprise that there's some pushback from users and industry.

Statistically, the risk posed by terrorists is so low as to not be a concern in my day-to-day life. I'm in far graver danger from occasionally eating hamburgers or riding a bike than I am from terrorists. Considering that "free societies" are hardly permanent things, and that a major event or political upset can dramatically change the nature of government, I'm more worried abo

Tox is a free and open-source, peer-to-peer, encrypted instant messaging and video calling protocol. The stated goal of the project is to provide secure yet easily accessible communication for everyone.

https://en.wikipedia.org/wiki/Tox_%28protocol%29

https://tox.chat/

https://github.com/tux3/qTox

http://utox.org/