7 ms·
Hackers Build a Skype That’s Not Controlled by Microsoft
- Dylan16807 12y agoOh, they're talking about a Skype network alternative. I was excited for a moment to hear about a Skype client alternative. Oh well.
- lelandbatey 12y agoThere are Tox clients and in many ways they are on part with Skype. You can use it today. Edit: oh wait, I see what you mean now. Sorry I read that on my phone at first, missed what you where getting at. Yes, it's a new IM client/network. However, it's much more secure, and decentralized. It's pretty cool.
- phpnode 12y agoif switching IM networks was as easy as that, Skype would already be on the way out. We use skype because everyone else uses skype.
- Chronic29 12y agoThis. It doesn't matter what the tinfoil-hat techies think about privacy. What matters is what our non tech friends do.
- realusername 12y agoThe last time I've tried (~ 1 month ago), there was no video support (unlike what you can see on the screenshot) but otherwise I would be happy to use it, anything would be more stable than skype anyway. Do you know any other alternatives ? (I will try to install the new version, it might work better)
- myrdev 12y agoMicrosoft closed the skype api a few weeks ago :( Much sads.
- hobarrera 12y agoSo how is this an improvement over things, like, for example, XMPP? It's easy to stand out when comparing to the worst alternative out there.
- jeena 12y agoYou don't need to run a server.
- xorcist 12y agoYou don't really need to run an XMPP server either. There are plenty public ones available, and the more popular ones have been very stable since their inception.
- etiam 12y agoVery little configuration required seems to be one main idea. The most important reason I have been interested in Tox is that I got the impression early on that they intend to make it resistant to traffic analysis as well (and judging from this thread http://4chanarchive.net/threads/g/Tox-Thread/43340618 http://4chanarchive.net/threads/g/Tox-Thread/43340618 there are still such plans) but that isn't emphasized in the page at tox.im any more. I'm guessing they're prioritizing getting something that the average Skype user would be capable of installing and configuring, and saving the onion routing feature for later.
- tracker1 12y agoI do think that a directory service for search/lookup may be desired as well... where people can upload their device key(s) and bind to say their email address or other handle for search/discovery.
- davexunit 12y agoTox is peer-to-peer, whereas XMPP requires (de)centralized servers. Tox is encrypted always, XMPP is unencrypted by default and OTR is hard to use. The Tox API, as alpha as it is, is pretty easy to work with, too. I wrote mostly complete Guile bindings for libtoxcore and a basic Tox bot in about a week.
- metachris 12y agoHere's a little more technical information: https://github.com/irungentoo/toxcore https://github.com/irungentoo/toxcore
- sitkack 12y agoThis is on the same level of security as OpenSSL and CryptoCat.
- kachnuv_ocasek 12y agoAnd, in fact, as any other piece of software.
- TehCorwiz 12y agoHow so?
- matt4711 12y agoI think he is probably referring to these discussions: - https://github.com/irungentoo/toxcore/issues/121 https://github.com/irungentoo/toxcore/issues/121 - https://github.com/irungentoo/toxcore/issues/578 https://github.com/irungentoo/toxcore/issues/578 where the devs are quite defensive about their choices to (1) reinvent the wheel (2) use technologies that are (according to the comments) not secure (3) not audit their proposed crypto/security architecture by experts.
- makomk 12y agoThe crypto appears to be fairly standard - it uses NaCl's crypto_box to encrypt and decrypt almost everything, with a per-session keypair authenticated by the user's long-term key. Code quality is a bit OpenSSL-esque though.
- deleted 12y ago[deleted]
- lawnchair_larry 12y agoNothing about what you just said makes sense.
- dharma1 12y agoseems like a good project. how is it different from say, mumble? http://wiki.mumble.info/wiki/Main_Page http://wiki.mumble.info/wiki/Main_Page
- jeena 12y agoYou don't need to run a server.
- tapoxi 12y agoMumble is a low latency chat server. You join a server, people join your channel, you chat. Its designed for public group conversations, like in games. Tox is more like Skype, but it has no central server. You add friends to a buddy list and chat with them, you add more people to the chat and it becomes a group chat.
- touristtam 12y agomumble is more of an alternative to TeamSpeak (http://www.teamspeak.com/ http://www.teamspeak.com/)
- mcphage 12y agoSo it's a Skype that's controlled by hackers?
- tagrun 12y agoSounds like either they're not aware of Retroshare (uses Qt for GUI), or they think developing in C++ is too much of a hurdle. It's peer-to-peer, uses web-of-trust, completely encrypted, already has chat/mail/"www"/voice chat/file sharing/etc. Still missing the video chat plug-in though, but it's on the to-do list.
- dublinben 12y agoI'm more surprised there is no mention of Jitsi, a project that has been around for years. Tox is barely usable across multiple platforms.
- Balgair 12y agoOk, my grandmother can use Skype now. And yes, she has to use an instruction guide I printed out for her. My question: Would my grandmother recognize this as an alternative to Skype?
- Moru 12y agoWill she recognize Skype next month? I find printed manuals have to be changed every time Skype updates something...
- drivingmenuts 12y agoBeing on a Mac, I wasn't aware that Skype updated very often. And to the OP, it doesn't sound like this product is grandmother-friendly yet.
- Balgair 12y agoThank you!
- Balgair 12y agoManuals? It's a 6 step process for logging in and trying to talk to her sister, IF she is also online. If Skype changes that process, I'll have to write up another one, not that it'll be hard though. Still, I guess I should re-figure my question.: Can I write a process, in under 10 steps, that my grandmother can use to talk, face to face via video, to her sister in another timezone with this program?
- pbhjpbhj 12y agoIsn't https://appear.in/ https://appear.in/ and it's ilk "a skype not controlled by Microsoft" to some extent? AFAICT it creates an SSL secured peer-to-peer connection.
- ilaksh 12y agoWhat's wrong with WebRTC?
- tsahil 12y agoSome context please?
- ilaksh 12y agoWebRTC allows peer-to-peer video conferencing through a web browser without a third party server. Which means there is no intermediary server to record the data.
- JoeAltmaier 12y agoActually any peer-to-peer communication system has the property, regardless of the existence of a 'rendezvous' server to get them connected.
- ilaksh 12y agoOK so what's wrong with WebRTC? Why do we need this other client they just invented?
- JoeAltmaier 12y agoWebRTC is just a protocol. You can use it any way you like. Lots of folks use it to talk to a switching server, probably because P2P IP connections can't always be made, while a server connection is guaranteed to work.
- AlyssaRowan 12y agoI've seen Tox before and looked into it. Think I've commented on it before, but maybe not, so here's my take: Nice sentiment. Doesn't yet quite live up to what it wants to be. But if the project can listen and adapt to advice like this, it has scope to improve and be a really important contender. Firstly, it needs metadata protection with onion (or, better, garlic) routing. Without that, it still has a pretty big mass-analysis flaw. Please look at I2P for an example of the kind of architecture that would work well: two DHTs with decoupled garlic routing in between? You may, or may not, leverage an existing network for that; there are some obvious cover-traffic advantages if you do, but it's less synergistic. Secondly, I don't see a full forward-secure messaging ratchet in there, it's really per-session. Look into Axolotl, and in particular what TextSecure v2 aka Signal has done for group chats too. Tox - using libsodium - already has every tool it needs to do that, it just doesn't do it fully yet. Thirdly, more stability. The susceptibility of the DHTs to resource-starvation attacks. (I don't think I2P ever actually implemented the hashcash it planned for?) But there's been some further work on that. Scalability is tricky, especially in the face of on-path attackers... Skype is pretty awful. It's actually pretty much centralised now, using TLS, but still runs much like the bad P2P network it used to be: closed-source software with a bad reputation for eating 100% CPU and awful chat desync. Most people who use it would rather be using something better, and I think there's plenty of scope there - people would switch if there was something better. Let's make sure an alternative is much better? Oh, maybe look into a distributed consensus protocol of some form for name registration - if it's possible to do a light one which can impose ordering... I've not performed a full security review. It's too young for that, and it's too young to rely on. When the above are addressed, then it's time to give it a more thorough look. /akr