3 ms·

>Unlike any other existing messaging platform, SimpleX has no identifiers assigned to the users Lies by omission. SimpleX doesn't mask your IP-address by defau

by maqp 10mo ago

>Unlike any other existing messaging platform, SimpleX has no identifiers assigned to the users Lies by omission. SimpleX doesn't mask your IP-address by default. It leaks to the server. The ENTIRE public SimpleX network is hosted by two companies, Akamai and Runonflux. Metadata of two conversing users running on the same VPS can be detected with end-to-end correlation attacks, so pray that the two are not PRISM partners or whatever has replaced that program. I'd be fine with SimpleX if they 1) bundled Tor and had a toggle switch during initial setup. 2) were transparent about what the toggle switch does (lag/bandwidth vs IP masking) This is crucial as they already have Tor Onion Service server infra set up, but they're not making it easy for a layperson to use those. Instead they lie by omission. Their "SimpleX has no identifiers" only means "SimpleX does not add additional identifiers" They don't give a damn about your router gluing your IP address, that's increasingly becoming a unique IPv6 address, to every TCP packet header.

HNisCIS 10mo ago
Simplex is also going down the crypto drain, they're starting their own coin.
- irusensei 10mo ago
  Didn't knew. Do you have a source on that? Can't see any mention of coins in their blog. Are you maybe referring to the crypto exchange with the same name that normally appears on top of google searches?
  - thayne 10mo ago
    I would guess they are referring to https://simplex.chat/vouchers/ https://simplex.chat/vouchers/ Not exactly making their own "coin", but definitely involved with cryptocurrency, and if I understand correctly, the vouchers themselves involve blockchain.
- epoberezkin 10mo ago
  That is untrue. We do not plan any coins. We plain a private payment mechanism for the servers that will utilize blockchain for valid reasons - we call it Community Vouchers. But they are not coins, they are service credits that cannot be created out of nothing (as coins) and cannot be sold - they can only be used to pay for the servers. It's covered here: https://simplex.chat/vouchers https://simplex.chat/vouchers Whitepaper on that design will be published in early 2026. Disclaimer: I designed SimpleX network
  - wkat4242 10mo ago
    Hmm that's still very 'crypto'. I understand that servers need to be paid for but that's why I run my own matrix server. So I pay for that and for the users on it. Much nicer than having to trust another party to run them.
    - adamthegoalie 10mo ago
      What’s wrong with being “very ‘crypto’” when you use a real use case crypto can solve?
    - j45 10mo ago
      Feels like a use of a ledger technology where everyone is a stranger in a way that isn't a credit and debit system in a relational databse.
  - chaps 10mo ago
    "Buy Community Vouchers. Initially you would pay with a stablecoin (USDT/USDC). " You're literally requiring people to buy specific cryptocurrencies to buy your community vouchers.
throwaway73980 10mo ago
[dead]
epoberezkin 10mo ago
> "SimpleX has no identifiers" only means "SimpleX does not add additional identifiers" These two statements are identical. IP addresses are Internet user identifiers, not SimpleX identifiers. All other application-level networks have identifiers of their own, in addition to IP addresses. The goal of the design is: - to prevent correlation of which IP address communicates with which, - to prevent IP address from servers not chosen by the users. It is not supposed to protect IP addresses from all servers, and Tor does not achieve that either, as Tor relays are servers too. The reasons not to embed Tor are listed here: https://simplex.chat/faq/#why-dont-you-embed-tor-in-simplex-chat-app https://simplex.chat/faq/#why-dont-you-embed-tor-in-simplex-... Disclaimer: I designed SimpleX network, and the founder of SimpleX Chat.
- maqp 10mo ago
  >These two statements are identical. IP addresses are Internet user identifiers, not SimpleX identifiers. You are promoting SimpleX as an metadata-privacy improvement over Tor Onion Service based messengers like Cwtch, that hides the IP address by default. IP-addresses can be linked to users, and users will have to blindly trust the server is not collecting them. TelCos and ISPs keep logs of those as per data retention laws, so it's not hard to determine who a SimpleX user is if SimpleX wants to disclose that information. >to prevent correlation of which IP address communicates with which Which Akamai can do, and Runonflux can do. With 50% probability on per-target basis I might add. >It is not supposed to protect IP addresses from all servers, and Tor does not achieve that either Tor relays actively mask the IP of previous node from the next node. Tor relays do not have access to internal protocol of SimpleX queues etc. SimpleX servers do, so they can collaborate with better efficiency. Tor relays are chosen at random by the user, and random collaborating entry/exit nodes expose 10 minute windows for ciphertext-only metadata collection without access to IPs. SimpleX has 50% chance same company runs the server of both users. >Tor does not achieve that either, as Tor relays are servers too. This is ridiculous. You're effectively arguing, that because Tor isn't literally magical in being able to send TCP packets without IP addresses in headers, it's not significant improvement. As I showed you last time, the NSA itself has admitted they will NEVER be able to deanonymize all Tor users all the time, and that nor are they able to do that on-demand. Which is quite different from your "we run servers on two VPS companies ourselves, but pinky promise, they don't aggregate and correlate information." >I designed SimpleX network, and the founder of SimpleX Chat. I know. We two have had a looong conversation about this, first in Reddit, then here, then in privacyguides forum, and now again, here. Every single time you run to the hills. Link your open, honest, non-misleading threat model to your front page. Make sure it makes it extremely clear that "Unless you install and configure Tor, SimpleX client does not take actions to hide your IP-address from the server". I mean, look how professional https://tryquiet.org/ https://tryquiet.org/ looks when the treat model is up there in the title bar, and not as a fine print behind menus. Do that and we're done. I won't call you out anymore.

by maqp 10mo ago

HNisCIS 10mo ago

Simplex is also going down the crypto drain, they're starting their own coin.

irusensei 10mo ago
Didn't knew. Do you have a source on that? Can't see any mention of coins in their blog. Are you maybe referring to the crypto exchange with the same name that normally appears on top of google searches?
- thayne 10mo ago
  I would guess they are referring to https://simplex.chat/vouchers/ https://simplex.chat/vouchers/ Not exactly making their own "coin", but definitely involved with cryptocurrency, and if I understand correctly, the vouchers themselves involve blockchain.
epoberezkin 10mo ago
That is untrue. We do not plan any coins. We plain a private payment mechanism for the servers that will utilize blockchain for valid reasons - we call it Community Vouchers. But they are not coins, they are service credits that cannot be created out of nothing (as coins) and cannot be sold - they can only be used to pay for the servers. It's covered here: https://simplex.chat/vouchers https://simplex.chat/vouchers Whitepaper on that design will be published in early 2026. Disclaimer: I designed SimpleX network
- wkat4242 10mo ago
  Hmm that's still very 'crypto'. I understand that servers need to be paid for but that's why I run my own matrix server. So I pay for that and for the users on it. Much nicer than having to trust another party to run them.
  - adamthegoalie 10mo ago
    What’s wrong with being “very ‘crypto’” when you use a real use case crypto can solve?
  - j45 10mo ago
    Feels like a use of a ledger technology where everyone is a stranger in a way that isn't a credit and debit system in a relational databse.
- chaps 10mo ago
  "Buy Community Vouchers. Initially you would pay with a stablecoin (USDT/USDC). " You're literally requiring people to buy specific cryptocurrencies to buy your community vouchers.

throwaway73980 10mo ago

[dead]

epoberezkin 10mo ago

> "SimpleX has no identifiers" only means "SimpleX does not add additional identifiers" These two statements are identical. IP addresses are Internet user identifiers, not SimpleX identifiers. All other application-level networks have identifiers of their own, in addition to IP addresses. The goal of the design is: - to prevent correlation of which IP address communicates with which, - to prevent IP address from servers not chosen by the users. It is not supposed to protect IP addresses from all servers, and Tor does not achieve that either, as Tor relays are servers too. The reasons not to embed Tor are listed here: https://simplex.chat/faq/#why-dont-you-embed-tor-in-simplex-chat-app https://simplex.chat/faq/#why-dont-you-embed-tor-in-simplex-... Disclaimer: I designed SimpleX network, and the founder of SimpleX Chat.

maqp 10mo ago
>These two statements are identical. IP addresses are Internet user identifiers, not SimpleX identifiers. You are promoting SimpleX as an metadata-privacy improvement over Tor Onion Service based messengers like Cwtch, that hides the IP address by default. IP-addresses can be linked to users, and users will have to blindly trust the server is not collecting them. TelCos and ISPs keep logs of those as per data retention laws, so it's not hard to determine who a SimpleX user is if SimpleX wants to disclose that information. >to prevent correlation of which IP address communicates with which Which Akamai can do, and Runonflux can do. With 50% probability on per-target basis I might add. >It is not supposed to protect IP addresses from all servers, and Tor does not achieve that either Tor relays actively mask the IP of previous node from the next node. Tor relays do not have access to internal protocol of SimpleX queues etc. SimpleX servers do, so they can collaborate with better efficiency. Tor relays are chosen at random by the user, and random collaborating entry/exit nodes expose 10 minute windows for ciphertext-only metadata collection without access to IPs. SimpleX has 50% chance same company runs the server of both users. >Tor does not achieve that either, as Tor relays are servers too. This is ridiculous. You're effectively arguing, that because Tor isn't literally magical in being able to send TCP packets without IP addresses in headers, it's not significant improvement. As I showed you last time, the NSA itself has admitted they will NEVER be able to deanonymize all Tor users all the time, and that nor are they able to do that on-demand. Which is quite different from your "we run servers on two VPS companies ourselves, but pinky promise, they don't aggregate and correlate information." >I designed SimpleX network, and the founder of SimpleX Chat. I know. We two have had a looong conversation about this, first in Reddit, then here, then in privacyguides forum, and now again, here. Every single time you run to the hills. Link your open, honest, non-misleading threat model to your front page. Make sure it makes it extremely clear that "Unless you install and configure Tor, SimpleX client does not take actions to hide your IP-address from the server". I mean, look how professional https://tryquiet.org/ https://tryquiet.org/ looks when the treat model is up there in the title bar, and not as a fine print behind menus. Do that and we're done. I won't call you out anymore.