TOX – A New Kind of Instant Messaging

This has been the #1 reason that I havent convinced people to use tox yet.

I sometimes get up and walk away from a computer mid conversation, expecting to continue the conversation on my phone. It's the same reason I won't be using google allo. I need conversations to "sync" across mobile and PC.

I'm not going to sit at a desk all day chatting on my phone, and I'm not going to miss messages just because I went mobile.

I saw somewhere in a previous tox chat, that a possible solution would be a way to pin identities together (i say from desktop "this mobile is me" and from mobile "this desktop is me" and when they match, allow them to pair). And then send every message encrypted to both peers. If you have 5 devices linked, tox would behind the scenes send the message to 5 different destinations.

They havent done anything like this yet as far as I know.

We're in the process of writing a specification (https://github.com/TokTok/spec) and new implementation in Haskell (https://github.com/TokTok/hs-toxcore). There is also a Rust implementation in the works (https://github.com/zetok/tox).

As for security risks and mitigations, I'd like to do that when we have a web presence with space for it. Right now, the web presence is fairly poor (http://toktok.github.io/). The specification contains some security risks and mitigations.

Regarding security audit: my day job is developing high security software. I could do a formal audit, and it would take about 2-3 person-weeks, and be completely useless, because it would result in a huge number of trivial issues that need to be resolved before it could identify real problems. So instead of wasting time and money on that, I've decided to go and fix those trivial issues one by one, and once I'm a bit happier with the code, I'll have two other people do the formal audit.

List of security risks and Tox-ic (BDUM-KSSH) community are worrying, as is the lack of security audits.

As for the fact that it's written in C, GPG, Tor, Psyc, and many other pieces of security software that you trust are written in C. It's dangerous, but writing secure apps isn't impossible.

Choose two:

    Human-meaningful: Meaningful and memorable (low-entropy) names are provided to the users.

    Secure: Any entity in the system can act maliciously, including the majority of the entities or the available computational power.

    Decentralized: There is still only one, unique and specific entity to which a name resolves.

https://en.wikipedia.org/wiki/Zooko%27s_triangle

ToxMe[1] seems to attempt to solve this issue by creating a public databases of emails and Tox IDs, though this defeats the object of the service being anonymous.

[1] https://toxme.io/

> Why aren't Identicons or QR codes used more?

Nothing stops you from turning that hash into a QR code (afaik Antox does) - but then how do you copy & paste it?

This isn't a flaw, it's a feature. Whoever controls the phone book controls the keys to the kingdom. If the names are numbers generated by some cryptographic system, it is harder to subvert the system.

You underestimate how alien "http://www.yahoo.com./" looked in 1995.

Once upon a time, we didn't have user names when communicating:

https://en.wikipedia.org/wiki/ICQ

"If a government wants to track me, they will find a way."

So just hand the data right to them?

"I'm more concerned about Facebook/Google/Microsoft/Apple tracking me, reading my private conversations, and selling my data to the highest bidder."

End-to-end encryption is the only solution to that problem. Open source software and decentralization is nice and all but to become a mobile app it'll have to be compiled and run on a closed platform and will almost certainly use APIs of that platform.

riot.im [1] (which is based on matrix.org) seems a good, decentralized, open messaging app. They have relatively nice mobile apps and they promise to soon release end-to-end encryption based on the OLM [2] ratchet which is similar to the Signal encryption. In contrast to Tox, Matrix relies on federated servers. Tox is pure P2P which, in my experience, never works very well on mobile devices.

[1] https://riot.im/ [2] https://matrix.org/docs/spec/olm.html

> If a government wants to track me, they will find a way

Things like OTR: https://en.wikipedia.org/wiki/Off-the-Record_Messaging Actually stops these people though, and is even labelled in some of the Snowden Files as being "Catastrophic" to their efforts. But you are right, if they can't get chat on you they can just target you inside the Internet and send a malware payload disguised as an update to your browser.

Maybe https://wire.com/ could allow decentralization someday?

I think your distinction between gov't tracking and corporate tracking is misguided.

Tech that provably prevents one will provably prevent the other.

Look at cloudmask.com

That's by design to keep connections with other peers.

To get back on this, this might be only the Windows client, just had latest qTox idling on Linux overnight and network data usage is 1.3MB.

That works with UDP hole punching (https://en.wikipedia.org/wiki/UDP_hole_punching), and there is a branch with uPNP (https://en.wikipedia.org/wiki/Universal_Plug_and_Play) support. We still need to review that code carefully before accepting it into master.

I'm reasonably sure it does a UDP hole punch to do it.

Probably leveraging STUN servers https://en.wikipedia.org/wiki/STUN

It seems robust, but I do worry about the client. Has the client been audited properly? I hope the track record's not like Pidgin's https://pidgin.im/news/security/

But you realize that's like saying "Well, I tried IRC but there are dozens of competing clients that all do the same thing."

The Tox protocol is really the core tool. As long as the protocol is well-defined and maintained, I think developers should be free to make whichever clients that they want.

I used tox ages ago, and I used the Blight client or whatever it was called, and I liked it pretty well.

I think a bigger issue is convincing people to use it in small groups. My whole team is just fine using Mattermost/Hipchat/IRC and the majority of them don't see the need for something like this.

The preliminary plan is to deliver a high quality implementation of the Tox protocol and then deliver a high quality client. I personally don't have time to do both, and the team has very limited resources. The most actively developed client is currently qTox.

Looks like no, there's uTox and Toxic - can't get Toxic to run.... so maybe?

Woah, indeed.

http://i.imgur.com/3MdrSQi.png

Signal still relies on Google Play Services, which is an issue for many people (see GitHub issue #127, #1000, #1106, #5450 etc....)

Signal requires you to use your phone number.

It may surprise less of us than you think ;)