3 ms·

From the FAQ: "No, really, what's Tox? It's a VERY secure Instant Messenger ...." So they acknowledged this is not true in their issue tracker, but not public

From the FAQ: "No, really, what's Tox? It's a VERY secure Instant Messenger ...." So they acknowledged this is not true in their issue tracker, but not publicly? Further, they internally claim they don't know what threats it faces, don't understand what those threats are, and don't want to worry at this time about what insecurity they have? Also: "a largely undocumented, untested, and not well-understood code base of about 19 ksloc (C)" from one of their own developers. This is quite disappointing.

lightedman 10y ago
You'll find that most 'secure' projects rely upon external marketing while their internal tracking says otherwise. Man can make it, man can break it.
- iphy 10y ago
  I don't believe that marketing like that is the right thing to do. I want to help people be more secure, not just feel more secure through some snake oil security software. Because of that, we (in TokTok) have so far avoided any marketing, and are purely focussed on making the Tox protocol we inherited from the now mostly dormant Tox project properly secure.
iphy 10y ago
Some background: TokTok was started a year ago and inherited the core code from Tox with the intention to take the project to the place it claims to be in. TokTok is not equal to Tox, and we have no control over what the Tox project presents on its website. I do think that making such claims without any backing security proofs is quite bold. In TokTok, we've avoided that and instead say: our aim is to bring security software to everyone. We don't claim that the software is already secure, but we have confidence in the general architecture and are working towards provable security. Part of that is a formal specification (not the human language spec) helping us provide users and cryptographers with a security proof. We are aware of some flaws, and have concrete plans (roadmap) to fix them. I know that saying things like that statement you quoted doesn't improve confidence, but I think that saying "we're very secure" without proof is simply a lie. Many projects out there, some similar to Tox, claim security but aren't actually proven secure. We are now simply a group of people who believe in the idea and want to make it reality. I am affiliated with TokTok, not with Tox. Regarding public acknowledgement: I will update the TokTok website shortly.

lightedman 10y ago

You'll find that most 'secure' projects rely upon external marketing while their internal tracking says otherwise. Man can make it, man can break it.

iphy 10y ago
I don't believe that marketing like that is the right thing to do. I want to help people be more secure, not just feel more secure through some snake oil security software. Because of that, we (in TokTok) have so far avoided any marketing, and are purely focussed on making the Tox protocol we inherited from the now mostly dormant Tox project properly secure.

iphy 10y ago

Some background: TokTok was started a year ago and inherited the core code from Tox with the intention to take the project to the place it claims to be in. TokTok is not equal to Tox, and we have no control over what the Tox project presents on its website. I do think that making such claims without any backing security proofs is quite bold. In TokTok, we've avoided that and instead say: our aim is to bring security software to everyone. We don't claim that the software is already secure, but we have confidence in the general architecture and are working towards provable security. Part of that is a formal specification (not the human language spec) helping us provide users and cryptographers with a security proof. We are aware of some flaws, and have concrete plans (roadmap) to fix them. I know that saying things like that statement you quoted doesn't improve confidence, but I think that saying "we're very secure" without proof is simply a lie. Many projects out there, some similar to Tox, claim security but aren't actually proven secure. We are now simply a group of people who believe in the idea and want to make it reality. I am affiliated with TokTok, not with Tox. Regarding public acknowledgement: I will update the TokTok website shortly.