4 ms·
well, don't use either if you're a whistleblower up against an advanced adversary, unless you really have to - that will put you into a very small population fo
by tribby 8y ago
well, don't use either if you're a whistleblower up against an advanced adversary, unless you really have to - that will put you into a very small population for analysis.
attacks on tor are, increasingly, attacks on tor browser[1], so I'm not sure I understand your logic there. ricochet has nothing to do with the web, it is not a browser, it just uses a tor process for routing -- tor browser presents a gigantic attack surface that the tor process itself does not.
FWIW, there was an issue or PR on github at some point after the ricochet audit about removing the "experimental" warning, I could be misremembering a different conversation but I think the author just wasn't comfortable telling people that using software for this sort of thing isn't inherently high-risk.
1. https://regmedia.co.uk/2016/03/29/alfin.pdf https://regmedia.co.uk/2016/03/29/alfin.pdf
- crtasm 8y agoGet more people to use both so they become less unusual seems like a better plan :-) If you're only connecting to a newspaper's secure drop instance on a .onion the risk of running into malicious code seems low but I do agree that leakers need more than just Tor browser, so let's add whonix to that. Richochet does sound good and I'll try it at some point.