That's really cool, I like how you just give the other user a Tox id token and it sets up the secure channel. I wonder if that's a general approach for secure

That's really cool, I like how you just give the other user a Tox id token and it sets up the secure channel. I wonder if that's a general approach for secure communication, because as long as it's sent through another secure channel (that may use the traditional SSL certificates from an authority) it could be used to avoid a MITM attack. Maybe a way to do this in the future with an insecure channel is to give the peer your contact token using only context that both of you know. So the above token could get converted to a human-readable string like "that place we met that first time and what you said to me with 12345abcdef on the end" and the other party would have to know you to figure out how to find you. Proving who you are beyond that point would probably involve some back and forth questioning like in spy movies or a video call (which could be faked in 5-10 years with computer rendering) so shared history will be key. It already sounds like it can run over Tor, but it would be nice if it had a standard socket wrapper that could be run over UDP NAT tunneling to look like an SSH VPN. Maybe WebRTC could be integrated with it somehow. I just mean that I'd like the negotiation phase to be separate so that if it works, you're just presented with a secure socket.