4 ms·

It is not possible to hide the fact that you conversed with a certain person from your service provider. That's part of why being able to choose a service provi

It is not possible to hide the fact that you conversed with a certain person from your service provider. That's part of why being able to choose a service provider is so important.

heavyset_go 1y ago
Theoretically, Cwtch[1] would afford you this obfuscation assuming Tor is secure and your adversary isn't nation-state level. Similarly, using SimpleX private message routing via .onion message relays and the fact that the system has no identifiers can also afford you that obfuscation. [1] https://docs.cwtch.im/ https://docs.cwtch.im/
- johnisgood 1y ago
  Differences between Cwtch, and SimpleX? Which are you leaning towards to and why? According to https://github.com/simplex-chat/simplexmq/blob/stable/protocol/overview-tjr.md https://github.com/simplex-chat/simplexmq/blob/stable/protoc...: > identify that and when a user is using SimpleX. Does this apply to Cwtch? Also, is it not possible to obfsucate this traffic? Tor with obfs4? Related: #1 - https://security.stackexchange.com/questions/241730/traffic-obfuscation-under-targeted-surveillance https://security.stackexchange.com/questions/241730/traffic-... #2 - https://github.com/simplex-chat/simplex-chat/issues/4300 https://github.com/simplex-chat/simplex-chat/issues/4300 #3 - https://github.com/tst-race/race-docs/blob/main/race-channels.md https://github.com/tst-race/race-docs/blob/main/race-channel...
  - heavyset_go 1y ago
    > Which are you leaning towards to and why? Heavily sandboxed SimpleX that's firewalled to block any non-Tor traffic. Chose this one because it allows for offline message sending/receiving, despite privacy implications, and because it has clients people will actually use. Cwtch doesn't let you send messages when the recipient is offline by virtue of how it works, which is more secure, but inconvenient. When evaluating Cwtch, I think I read somewhere it might send identifying metadata to your recipient, or something similar, but I might just be making that up. I'll have to look up what I was reading. > > identify that and when a user is using SimpleX. > Does this apply to Cwtch? With Cwtch you're running two hidden services, one on either end of the chat, and that happens over Tor with no middleman service, so no. A passive network observer can tell when you're connecting to Tor, but you can attempt to obfuscate that with transports.
    - johnisgood 1y ago
      > obfuscate that with transports. Such as obfs4, I presume. I read about RACE just now, seems interesting: - https://github.com/tst-race/race-quickstart?tab=readme-ov-file#what-is-race https://github.com/tst-race/race-quickstart?tab=readme-ov-fi... - https://github.com/tst-race/race-destini https://github.com/tst-race/race-destini Have you heard about it, or have you used it before? > Cwtch doesn't let you send messages when the recipient is offline by virtue of how it works, which is more secure, but inconvenient. I agree. How much more secure is that? In the case of Ricochet, this only applies to friend requests. You have to be online to be able to receive friend requests, which I am fine with.
      - heavyset_go 1y ago
        > Such as obfs4, I presume. Yep, but the author of obfs4 says not to use it, there are more modern transports with less flaws. At the end of the day, the transport lists are public, but sharded, so it's truly just obfuscation no matter what transport protocol you use. Someone observing your connection with the resources to map out transport relays can tell if you're using Tor. > Have you heard about it, or have you used it before? I haven't, but it looks interesting. It seems they're doing a similar mixnet approach to SimpleX. > I agree. How much more secure is that? If you don't to rely on a third party to queue and relay your messages when your recipient comes online, it's one less party that you're sharing information with. I also believe it opens you up to Tor correlation attacks, like what happened with Ricochet. Maybe an overlay mixnet can add some further obfuscation, as with SimpleX and RACE, but I assume those overlays are vulnerable to correlation attacks, as well.
        johnisgood 1y ago
        > Yep, but the author of obfs4 says not to use it, there are more modern transports with less flaws. Such as?
        heavyset_go 1y ago
        Check out https://torproject.github.io/manual/circumvention/ https://torproject.github.io/manual/circumvention/ and https://obfuscation.github.io/ https://obfuscation.github.io/

It is not possible to hide the fact that you conversed with a certain person from your service provider. That's part of why being able to choose a service provider is so important.

heavyset_go 1y ago

Theoretically, Cwtch[1] would afford you this obfuscation assuming Tor is secure and your adversary isn't nation-state level. Similarly, using SimpleX private message routing via .onion message relays and the fact that the system has no identifiers can also afford you that obfuscation. [1] https://docs.cwtch.im/ https://docs.cwtch.im/

johnisgood 1y ago
Differences between Cwtch, and SimpleX? Which are you leaning towards to and why? According to https://github.com/simplex-chat/simplexmq/blob/stable/protocol/overview-tjr.md https://github.com/simplex-chat/simplexmq/blob/stable/protoc...: > identify that and when a user is using SimpleX. Does this apply to Cwtch? Also, is it not possible to obfsucate this traffic? Tor with obfs4? Related: #1 - https://security.stackexchange.com/questions/241730/traffic-obfuscation-under-targeted-surveillance https://security.stackexchange.com/questions/241730/traffic-... #2 - https://github.com/simplex-chat/simplex-chat/issues/4300 https://github.com/simplex-chat/simplex-chat/issues/4300 #3 - https://github.com/tst-race/race-docs/blob/main/race-channels.md https://github.com/tst-race/race-docs/blob/main/race-channel...
- heavyset_go 1y ago
  > Which are you leaning towards to and why? Heavily sandboxed SimpleX that's firewalled to block any non-Tor traffic. Chose this one because it allows for offline message sending/receiving, despite privacy implications, and because it has clients people will actually use. Cwtch doesn't let you send messages when the recipient is offline by virtue of how it works, which is more secure, but inconvenient. When evaluating Cwtch, I think I read somewhere it might send identifying metadata to your recipient, or something similar, but I might just be making that up. I'll have to look up what I was reading. > > identify that and when a user is using SimpleX. > Does this apply to Cwtch? With Cwtch you're running two hidden services, one on either end of the chat, and that happens over Tor with no middleman service, so no. A passive network observer can tell when you're connecting to Tor, but you can attempt to obfuscate that with transports.
  - johnisgood 1y ago
    > obfuscate that with transports. Such as obfs4, I presume. I read about RACE just now, seems interesting: - https://github.com/tst-race/race-quickstart?tab=readme-ov-file#what-is-race https://github.com/tst-race/race-quickstart?tab=readme-ov-fi... - https://github.com/tst-race/race-destini https://github.com/tst-race/race-destini Have you heard about it, or have you used it before? > Cwtch doesn't let you send messages when the recipient is offline by virtue of how it works, which is more secure, but inconvenient. I agree. How much more secure is that? In the case of Ricochet, this only applies to friend requests. You have to be online to be able to receive friend requests, which I am fine with.
    - heavyset_go 1y ago
      > Such as obfs4, I presume. Yep, but the author of obfs4 says not to use it, there are more modern transports with less flaws. At the end of the day, the transport lists are public, but sharded, so it's truly just obfuscation no matter what transport protocol you use. Someone observing your connection with the resources to map out transport relays can tell if you're using Tor. > Have you heard about it, or have you used it before? I haven't, but it looks interesting. It seems they're doing a similar mixnet approach to SimpleX. > I agree. How much more secure is that? If you don't to rely on a third party to queue and relay your messages when your recipient comes online, it's one less party that you're sharing information with. I also believe it opens you up to Tor correlation attacks, like what happened with Ricochet. Maybe an overlay mixnet can add some further obfuscation, as with SimpleX and RACE, but I assume those overlays are vulnerable to correlation attacks, as well.
      - johnisgood 1y ago
        > Yep, but the author of obfs4 says not to use it, there are more modern transports with less flaws. Such as?
        heavyset_go 1y ago
        Check out https://torproject.github.io/manual/circumvention/ https://torproject.github.io/manual/circumvention/ and https://obfuscation.github.io/ https://obfuscation.github.io/