3 ms·
> there isn't a currently easily available obvious way to have private secure conversations. Ricochet[1] works really well. It uses Tor hidden services to comm
by jstanley 6y ago
> there isn't a currently easily available obvious way to have private secure conversations.
Ricochet[1] works really well. It uses Tor hidden services to communicate. Your Ricochet ID is your onion address. To add a contact, you input their Ricochet ID and a short message, and Ricochet connects to their onion address and sends a contact request. If the contact request is accepted then you'll each show up as a contact on each other's client and can chat whenever you want.
Tor is really perfect for this, you can't get more private or censorship-resistant than Tor.
The UI is currently not great, but that's not a protocol problem.
The biggest problem with Ricochet is that hardly anyone is using it.
Private secure conversations: yes.
Easily available: yes.
Obvious: sadly not, for most people :(.
[1] https://ricochet.im/ https://ricochet.im/
- chc 6y agoDoesn't the security of Tor depend on the proposition "Surely my opponent would never operate a bunch of exit nodes"? That has always been my impression, and it seems like a problem when your opponent is a state actor.
- jstanley 6y agoHidden services don't use exit nodes.
- aendruk 6y agoYou could first charitably strengthen their argument by silently correcting “exit nodes” to “nodes”. The core point stands.
- jstanley 6y agoI don't think the core point does stand. 1. To deanonymise a hidden service connection you need to observe the traffic of all of the nodes in the circuit. 2. OK, let's say your adversary controls all of the nodes in the circuit and deanonymises the endpoints. Now what? You're no worse off than you would be if you weren't using Tor in the first place, so it's not an argument against Tor at all. All it's saying is "the absolute worst case of using Tor is no worse than the best case of not using Tor".
- 7steps2much 6y ago> the absolute worst case of using Tor is no worse than the best case of not using Tor While this is true I just wanted to point out that one does in fact not need *all* the nodes. It is possible to perform traffic analysis and infer which nodes are used by a certain user even if the attacker only controls a part of the nodes. [1] While this of course doesn't change the fact that using tor is a good idea, one should not let themselves be lured into a wrong feeling of security when using tor. [1]: https://murdoch.is/papers/oakland05torta.pdf https://murdoch.is/papers/oakland05torta.pdf