3 ms·
Show HN: Open-Source Anonymous Encrypted TLS+OTR Messaging Written in Go
- thomasjudge 11y ago"How safe is my tunnel? Your tunnel remains safe until your password or our servers are not compromised." uhhh...
- RomanPushkin 11y agoFair enough, huh :) Actually, it's mentioned because we wanted to note it somehow - it's always better to have this set up on your own server
- kodablah 11y agoI haven't looked deeply into this implementation, but with OTR's forward secrecy and 3.1+ authentication, is that not enough to defeat even the server being compromised? (meaning, at least you would know it was compromised assuming you trusted the actor on the other end)
- Bogdanovich 11y agoIf server is compromised, web app source code would probably change to something else.
- susi22 11y agoI'm still waiting for the day that somebody does a "super simple chat" with NO dependencies. Why do they all need REDIS or some kind of persistence? Why not just hold it in memory? If you really have a use case where persistence & scaling is an issue you're likely not going to use any of those chat servers anyways.
- defaultcoder 11y agoOne of authors is here. Redis saves data to the disk by default but this can be turned off. That's what we did. GUIDs of connected users are stored in memory with expiration by the 10 min timeout. I think scalability does not hurt privacy. It's nice to have 10 servers with 40GB memory instead of one with 4GB. Connections between servers can be encrypted with TLS.