4 ms·
Shouldn't the first question be who is paying for all this (also who's done an audit)? Remember CryptoAG, Potonmail claiming they don't log IPs etc.?
by jmakov 5y ago
Shouldn't the first question be who is paying for all this (also who's done an audit)? Remember CryptoAG, Potonmail claiming they don't log IPs etc.?
- throwawaymanbot 5y agoI would throw truecrypt in to this grouping also.
- fwip 5y agoIt's open source and distributed. The only ongoing costs are the optional bootstrap DHT nodes, which are pretty cheap.
- paulryanrogers 5y agoFWIW, website says "Powered by Digital Ocean".
- aasasd 5y agoIf my site is powered by the Nginx server, it doesn't mean Nginx the company has anything to do with it.
- grayhatter 5y agoOur webservers and build/dev servers are graciously donated by DO. They're really an awesome company to FOSS projects :D
- grayhatter 5y agoFormer Tox dev, no one is paying for it. It's home grown FOSS. I guess technically, if you're using Tox, you are paying for it. There's no servers, being exclusively P2P so your internet bandwidth and participation in the DHT is what allows it to function. Anyone who you directly connect to can know your IP, but not much else. So your friends could log your IP, and your ISP could see you're using Tox, (The traffic doesn't try to hide itself.) So there's no way we (the devs) could log your IP, we never actually see it. And, as someone else said, you can tunnel through Tor if you need to keep your IP secret.
- ajconway 5y agoDoes it mean that an attacker with the ability to monitor network connections can see who is talking to whom?
- grayhatter 5y agoYes an no. If you can't trust the network you're running on, you could get around this by tunneling via Tor. Tox itself makes direct connections to friends, to exchange encrypted messages, so while they can see when you send packets, and to what IP. They can't know what's in those messages. The trade off is, they'd need to be able to MITM your network. There's no servers they can capture, to learn this information no matter where you are.
- GoblinSlayer 5y agoGenerally speaking to hide the social graph you will need to bury legit traffic in much bigger fake traffic, which isn't very efficient. Tor almost gets away from this problem by sending everything all the way around the globe.
- sleepybrett 5y agoHome grown by a gaggle of FBI agents like Anon?
- grayhatter 5y agoThat's our running joke, that there's at least one of the core dev team that's an NSA plant. The trick is, we used to demand at least 2 others review code, so in order to be a successful plant, you'd have to contribute good code. So if the FBI is playing the long con, they'd have to actually improve the code base too :D
- bilbo0s 5y agoOr have a minimum of three plants.