7 ms·

I really think tox is a cool idea, and I've used it quite a bit, but I think it's important to temper security expectations. I can't find a link, but I remember

I really think tox is a cool idea, and I've used it quite a bit, but I think it's important to temper security expectations. I can't find a link, but I remember the results of the security audit done in the project to be frankly disastrous.

bjoli 8y ago
They use good primitives, but are under some kind of assumption that this makes them invincible. I remember reading a rather serious bug report that was more or less closed with a link to libsodium/nacl.
wruza 8y ago
And they somehow actively push adoption in narrow circles. I often see “why xyz if you have tox” in local forums, from people who are otherwise professional in their areas, but believe in tox almost blindly. It also doesn’t implement any sort of push notifications for phones, rendered useless for battery-saving modes and vaguely competitioning xmpp-otr. https://github.com/irungentoo/toxcore/issues/1398 https://github.com/irungentoo/toxcore/issues/1398 - discussion on homepage claims https://news.ycombinator.com/item?id=12657891 https://news.ycombinator.com/item?id=12657891 - past
cjcole 8y ago
You may be thinking of this thread: https://github.com/irungentoo/toxcore/issues/121 https://github.com/irungentoo/toxcore/issues/121 I couldn't find any evidence of an audit. There is an actively developed Rust implementation of the core library here: https://github.com/tox-rs/tox https://github.com/tox-rs/tox Of course, any flaw in the specification (for example with respect to key exchange) will still apply if they've faithfully implemented it.
jdp23 8y ago
From the TokTok site (which is linked to from Tox): "Neither the Tox protocol nor the implementation have undergone peer review, and its exact security properties and network behaviour are not well-understood, yet. We are actively working on improving that situation. Until said peer review, Tox is not recommended for use cases that require proven, high-assurance security." https://toktok.ltd/ https://toktok.ltd/

bjoli 8y ago

They use good primitives, but are under some kind of assumption that this makes them invincible. I remember reading a rather serious bug report that was more or less closed with a link to libsodium/nacl.

wruza 8y ago

And they somehow actively push adoption in narrow circles. I often see “why xyz if you have tox” in local forums, from people who are otherwise professional in their areas, but believe in tox almost blindly. It also doesn’t implement any sort of push notifications for phones, rendered useless for battery-saving modes and vaguely competitioning xmpp-otr. https://github.com/irungentoo/toxcore/issues/1398 https://github.com/irungentoo/toxcore/issues/1398 - discussion on homepage claims https://news.ycombinator.com/item?id=12657891 https://news.ycombinator.com/item?id=12657891 - past

cjcole 8y ago

You may be thinking of this thread: https://github.com/irungentoo/toxcore/issues/121 https://github.com/irungentoo/toxcore/issues/121 I couldn't find any evidence of an audit. There is an actively developed Rust implementation of the core library here: https://github.com/tox-rs/tox https://github.com/tox-rs/tox Of course, any flaw in the specification (for example with respect to key exchange) will still apply if they've faithfully implemented it.

jdp23 8y ago

From the TokTok site (which is linked to from Tox): "Neither the Tox protocol nor the implementation have undergone peer review, and its exact security properties and network behaviour are not well-understood, yet. We are actively working on improving that situation. Until said peer review, Tox is not recommended for use cases that require proven, high-assurance security." https://toktok.ltd/ https://toktok.ltd/