Tox

This thread is for the discussion of the tox protocol and finding new friends using tox. >What is tox. Tox is a P2P decentralized end to end encrypted instant messenger (but it has additional functions). >Why should i use it? It gives your anonymity and control, besides it's FOSS. >What are the clients uTox and qTox for all major operating systems. You can find more clients on https://wiki.tox.chat/clients. >Is there an offical website? The official website is https://tox.chat/ If you want to find new tox friends post the following: Your tox id. Your timezone. In what for anons are you interested. Why should other anons be interested in you. I'll start >Your tox id. F1AB93DAC9949C1B631E5A5221E262881CA5E91F0C9BF5889E6B7413A53ADE5A61D67089C136 >Your timezone. UTC+2.00 >In what for anons are you interested. I'm interested in people that are interested in technology, but if you aren't interested in technology that's no problem i'll talk about anything (with the exceptions of games, but roguelikes or FOSS games are ok). I'm searching for anons that can talk for hours everyday. I would be best if you have a large amount of free time or are a NEET. >Why should other anons be interested in you. I can program in many Languages (C, C++, Haskell, Rust, Python, Java,...). I could teach you programming or help you by programming problems. We could talk about new technology or technology that interests you. I can talk the whole day with you if you want and i'll be a good friend.

>giving your IP address to unknown people on Internet nah, m8. i'll stick to telegram >le programming >those languages soykaf interests

>>4084 I'm pretty sure tox throws all its traffic through tor, so you wouldn't be giving your IP to people you talk to on tox. Also, telegram is compromised anyways. And just because you don't like what he's interested in doesn't mean you need to be rude about it

>id 02F3C4805F478A16EF3D52C5CCD13209B21D1BE26C6CC1612ED288C916C6511896CEA02683DD >timezone UTC+2 (+1 in winter) >in what anons are you interested anons that: + somewhat mirror my interests or add upon them + are actually going to be online ( please don't add me if you haven't already been using tox for a while) >>I don't have any real life friends and I am relying on internet communication to keep my social sanity at a certain level >Why should other anons be interested in you. I'm interested in the following in vague order of importance: music, privacy, opsec, foss, modern rationality (lesswrong and friends), anime, current year unix meme minimalism ,western animation ( including things like wakfu for example ), movies, manga, conspiracies, politics, warcraft and warhammer40k lore, league of legends/dota2 content ( I don't play the games I just keep an eye on the games because I used to play them) >>4084 >telegram patrician bait mate

>>4085 > telegram is compromised anyways. not really, there is some metadata leak problems, but that's about it

>>4084 >giving your IP address to unknown people on Internet The fact that you think this is a problem and don't know how to prevent it is an indication that you shouldn't be posting on a /tech/ board. Try lurking more. >>4085 >I'm pretty sure tox throws all its traffic through tor, Not by default. Or maybe it depends on the client? Toxic and qTox don't. >>4082 I've been using Tox for a few years (Toxic and qTox). I think they have some serious problems with developers casually making breaking API changes and not telling anyone. I once lost a group and friends because they updated and I didn't and we just appeared offline to each other for a few months until they deleted me. I only found out after that it was because we were using different versions of Tox. Similar problems with things like file transfer. It's hard to coordinate with multiple people all using different clients and platforms. I have one friend who's client will crash everytime I try to send a file. The whole project just seems amateurish to me. I don't like it but I have to use it.

Its security is a joke: https://github.com/TokTok/c-toxcore/issues/426 Honestly nothing beats Matrix or XMPP+OMEMO, I don't see a point to this.

>>4087 >>4082 sounds good anons lets chat >Tox id tox:62BD7645315E8F38C80F27342B2480E894AA860F3F4541920DD6C4F53566E23CB2CECEF6E05A >Timezone UTC+1 >in what anons are you interested Just some people that are interested in tech and I can talk to for some time and build up a friendship, I dont really rely on online friends since I have many irl friends to chat with but I always liked online friends since its always interesting to talk to people online, especially if they share your interests. We can talk about everything that is tech related e.g plan9, bloat, coding, wm ricing etc. Also I have a big amount of freetime >why should anons be interested in you To have an online friend to chat to about tech or other stuff.

>>4092 Of the major chat apps (whatsapp, signal, wire, etc..) it's the only one to not have its keys subpoena'd. You know why? They don't need the keys, telegram violated the number one golden rule of crypto: don't roll your own crypto. The creator isn't a cryptanalyst and he's said some really, really dumb stuff about cryptography on twitter in the past. Metadata leak issues are the least of telegram's worries

>>4096 >I don't see a point to this. nobody does, that's why the people who made it find it necessary to come on tech forums and wage slave their product. this is exactly how that proprietary trash known as discord got started.

>>4096 to be fair they recognized that there was an issue and are working on it now. However, based on that comment thread, I see some bigger issues: nobody doing the day-to-day coding has a really strong knowledge of cryptography or security in general. And it's in C. And the project is managed very poorly. Basically, nothing damning, but very worrying.

>>4111 >to be fair they recognized that there was an issue and are working on it now. I don't think so >Hi Jason, thanks for the report. We are aware of all three issues you've mentioned, but it's great to have them written down More like they've known about issues for a long time and hoped that no one would notice rather than document them and fix them. >And it's in C. And the project is managed very poorly. Considering that there are significantly higher quality projects in this space, who should anyone bother with Tox?

>Considering that there are significantly higher quality projects in this space, who should anyone bother with Tox? Like ?

>>4142 The already mentioned Matrix and XMPP.

>4145 Exactly in what way is matrix secure again considering that the only application which currently suports encryption sits upon a bloated chromium based framework ?

I found tox to be rather unreliable in peer lookup, i prefer matrix. >Tox id 3EB4BC9F35C7C75654B01750F06AC7A811AB8664616F2B8885B6BB11E2E0D6094F2F6BA6F777 I also go by the handle 'Code_Man' on matrix. >Timezone UTC+1 >in what anons are you interested I take what comes my way really. >why should anons be interested in you Cant say, i do mostly gamedev and assorted tech related crapping around. Im really worn out by it all though so dont expect much of a conversation partner.

>>4142 Like https://ring.cx/ which is made by actual programmers, not 4chan/g/ skids playing with themselves.

>>4147 That doesn't make it inherently insecure, and you're wrong. olm encryption is also supported on WeeChat, and is actually documented: https://git.matrix.org/git/olm/about/docs/olm.rst

>4156 >>That doesn't make it inherently insecure, and you're wrong Sure I am. It's alwasys a great idea to add more complexity to your threat model. >>olm encryption is also supported on WeeChat, No it doesn't. The script is horrible and it bogs down weechat. Even if you somehow manage to enable encryption, it's broken. https://github.com/torhve/weechat-matrix-protocol-script/issues/54 You're not doing anyone a favor by promoting matrix.

Hello OP here.I tried riot it's good software, but there are 3 big problems with it. First the most people use riot.im, to chat with other people, so if you chat with someone then he will most certainly use riot.im. That's bad because if you read their privacy policy, you see that they collect a large amount of data. So even if you use their electron app, you security will be compromised, because the other party will use riot.im. The second problem is that, even if you can trust your client, you don't know how long the server stores the messages and what he'll do with it. In the spec. is no reccomendation how long the server should store the messages. That means you must trust a middle man in the communication. The third point is that matrix is a complex protocol is supports many things. Personally i think it's too complex. A Protocol for communication should not be complex except the part for cryptography. So you should use something else. Don't argue with XMPP. XMPP is too complex, fragmented and ineffective. First the XMPP protocol is very (that's not a bad thing in itself) old, but that means is not the "state of art." The next problem is a natural occurrence of old protocols they were designed to be used for 10 years, they tried to extend the protocol. Look at how fragmented it is, what clients support what. You don't know the answer. The most important thing why XMPP is bad, is there are so many method of encryption. These methods are not easy to use for normal people, except OMEMO. OMEMO is nice! The biggest problem with OMEMO is that it's not supported by many clients. So XMPP is no solution to secure communication. There is a spec of the tox protocol (https://toktok.ltd/spec), so there is no problem. I think toxcore needs more people, because it's basically unmaintained. If you want to do something good you should help to improve the tox protocol, because it's the only protocol that gives your privacy with control. There is no centralized server. So if you want to argue against me, show me something better. Proof it that it works and that it has more or an equal amount of privacy than tox. I would be really excited if someone can show me that and i will promote it.

>>4196 >First the most people use riot.im, to chat with other people, so if you chat with someone then he will most certainly use riot.im. That's bad because if you read their privacy policy, you see that they collect a large amount of data. So even if you use their electron app, you security will be compromised, because the other party will use riot.im. https://riot.im/privacy >Each time you visit our Website or use the Services, we may automatically collect the following information: >... > the communication content that you send and receive while using our Service. This may include message content and timing information, including text, photo, video and other media files in the context of the communication history of a room. This is a fair point. On the other hand, if you are talking to random people on the internet, how much privacy do you need? If you know someone well enough to talk about sensitive things, I'm sure you can arrange to both use sensible native clients with end-to-end crypto? >The second problem is that, even if you can trust your client, you don't know how long the server stores the messages and what he'll do with it. Why is this a problem with end-to-end crypto? I also understand that it is possible to setup private servers. > The third point is that matrix is a complex protocol is supports many things. It's also been audited. https://matrix.org/blog/2016/11/21/matrixs-olm-end-to-end-encryption-security-assessment-released-and-implemented-cross-platform-on-riot-at-last/ How about the Tox spec?

>>4198 >On the other hand, if you are talking to random people on the internet, how much privacy do you need? I need the assurance that your line of communication is not compromised. I may wish to talk about things with the other person, that are illegal in my or the other persons country. An example is if would meet a Chinese Person, i couldn't talk about Chinese politics with him, unless he uses something secure. >I'm sure you can arrange to both use sensible native clients with end-to-end crypto? I'll want it to be the default for communication. No matter the person i wish to communicate with, i want to have some "degree" of certainty. >It's also been audited. I don't think it has, but that's because not many people know it and use it. So if more people would be interested in tox, then i'm sure there would be an audit in the future.

>>4207 >It's also been audited. Sorry, i mean tox here.

>>4207 >I may wish to talk about things with the other person, that are illegal in my or the other persons country. An example is if would meet a Chinese Person, i couldn't talk about Chinese politics with him, unless he uses something secure. If you don't know who you are talking to then that person can rat you out regardless of which client you both use.

>>4209 Yes i know the tox protocol has flaws, that's why i think the tox protocol should make some kind of darknet mandatory (like tor). Besides you could use some kind of VPN. So what's your suggestion what people should use?

I'll be back in a couple of days, luigi -nowhere

>>4210 >So what's your suggestion what people should use? This ain't church. I'm not here to tell you the one true path so you can turn your brain off and avoid all responsibility.

>>4196 >There is a spec of the tox protocol (https://toktok.ltd/spec), so there is no problem. uhm... Just because there's a spec doesn't mean it's not vulnerable.

>>4084 probably a retarded question but what does soykaf mean?

>>4293 imagine instant coffee but even worse, made with soybeans instead of coffee beans so it can be manufactured for cheaper now imagine criticizing the government (i.e. calling it s h i t) was derezzed you would have to call the government soykaf instead

>>4299 aight, thanks lainon

>Who are you? LainBot, a tox bot for connecting people to groups. Send me 'help' for help. Will accept friend invites. >Your tox id. 415732B8A549B2A1F9A278B91C649B9E30F07330E8818246375D19E52F927C57F08A44E082F6 >Your timezone. UTC/NA >In what anons are you interested. Primarily /λ/diy/sec/tech/ anons, but other topics welcome. >Why should other anons be interested in you. Persistent group chat to meet new anons and talk about interesting topics. Ability to create new rooms for new topics. Available 24/7 (whenever your internet is up). Existing tox users with various specialties in programming, security, and other topics. Main room auto invites and is titled Club Cyberia.

>>4234 No one claimed otherwise. But having a spec available to the public is a pretty big advantage if you're looking for vulnerabilities, and no one has found any.

>>4309 >no one has found any. It still uses plain key derivation, which is vulnerable to KCI. https://github.com/TokTok/c-toxcore/issues/426 It is explained at length in the issue why this is a serious problem. This has been brought up again and again in every tox thread. Interestingly, the actual handshake is never described in the spec. That too is a thing to worry about.

>>4310 >It is explained at length in the issue why this is a serious problem. That's not a vulnerability, but a design flaw that the devs were already aware of. And it doesn't look like a serious issue at all. In fact it looks like a non-issue. If my private key is stolen I have no reasonable expectations of security. The entire basis of cryptography-based security is that your private key needs to stay private.

Anyone Ring users here?

>>4328 is it stable enough yet?

>>4359 It reached 1.0 recently.

I had grown tired of normal people and I cant take this soykaf anymore the only friend I have is somewhat intrested in /tech/ but other than that I dont have real life friends and have a lot of time to chat. >Your tox id. 8E329E427C1CDE7BCFB93F0B2017213F3F2154AC508E85C33A17411E6197364F9B6CF4B7BE47 >Your timezone. UTC+1/2 (on winter) >In what anons are you interested. If you are intrested in /tech/y stuff, watch anime and use something other than Microsoft's bullsoykaf you are more than enough. Being a working programmer/sysadmin is a bonus. >Why should other anons be interested in you. I really have nothing to offer in technical department so you are better off asking programming questions to a real programmer but I have a lot of free time and can carry out /tech/y conversations.

RaTox seems like it is PERFECT for making Tox bots. You can write scripts for it in any language and pass whatever you want to system calls.

B08FF3BC547B8CDF14B3C8AE5D593124161C97AD06E391D4DA46B683CA5F3642F85F3CA26954 >timezone U.S eastern. >interests japanese, otakusoykaf, GNU/freedom atusim, cat-v/C/plan9 autism, recently. Also history and language a little bit. When I played them more, role play games(ie ss13 on an RP server) and 'complex' video games(simulators, grognard strategy stuff, other things). >why would anyone want to talk to you? if anyone else is too, i've been looking for a japanese study partner. I don't know any programming languages, im just learning C. So i'm not useful or anything.

>>4096 >KCI depends on getting a user's secret key. If your secret key is compromised, you have several things to worry about, KCI is only one of them. read nigga

Is posting of GNU Ring stuff allowed here? I don't think it deserves it's own thread to be honest.

>>4082 >Tox id C2F132294993E77F6AABCC5FA3E0E7D001F533AB61225674570142A0B9697C3E95BB1570E9C5 >timezone UTC -6.00 >in what anons are you interested I just like talking with lains about tech and programming, I'd like to get some insight into various languages from someone more experienced than me. I'm a huge fan of lisp >Why should you look me up If you're into the same topics I am, or just want somebody to shoot the soykaf with, I'm really into modifying game consoles and could probably help someone out with that if they were interested

I run a small XMPP server, and we all use OMEMO with Gajim and/or conversations. Is there any particular reason my social group would benefit from using Tox instead? >>4196 >The biggest problem with OMEMO is that it's not supported by many clients. So XMPP is no solution to secure communication. Gajim and Conversations support OMEMO. >Look at how fragmented it is, what clients support what. You don't know the answer. I've never had trouble finding out what clients support the features I want, personally.

>>5520 >omemo clients there's a plugin for profanity too, but i've never got it to work right. doesn't it require some server-side support if you and your buddy aren't on the same host? last i looked into it, conversations.im was the only host that supported this and i'm not sure i want to host with them (plus i already have an account on another service, so the switch would be a pain in the ass). >I've never had trouble finding out what clients support the features I want, personally. for me it's less about finding which clients support which features and more about the fact that the vast majority of clients only support a limited subset of the available features. i use the profanity client for the most part because i wanted something console based, and it does nearly everything i want it to (with plugins), but most of the more common options (i'm thinking of jabber/adium in particular) don't.

>>5527 >doesn't it require some server-side support if you and your buddy aren't on the same host? It does, but I run the server, so I configured it to support that. >conversations.im was the only host that supported this and i'm not sure i want to host with them Set up an rpi (or whatever you have lying around) with prosody, then install the necessary XEPs? >the vast majority of clients only support a limited subset of the available features. This is true and lamentable. >most of the more common options (i'm thinking of jabber/adium in particular) don't. Those clients are bad, and I'm glad I don't know anybody who uses them who refused to migrate to better ones. I guess they're just popular because they've been around, and they'll die off eventually if they don't improve. Anyway, I want to clarify that I wasn't saying XMPP is universally better than Tox, just wondering if there were any particular reasons Tox would be better for our use-case, when we already have XMPP working.

>>5528 thanks for the explaination >roll your own yeah this is basically what i have planned long term. i've been meaning to get a cheap vps for this kind of thing. >your last paragraph i assumed that was your intention. personally i prefer xmpp and i can't think of a good reason to use tox over xmpp short of actual criminal activity. even then, the issues are more or less the same as what you deal with when using encrypted email, and are more or less mitigated once you've established a secure channel. that being said, i am always interested in (potentially short lived) projects like this. it's sometimes fun to just roll up a node and see who you can connect with.

>>5529 > this is basically what i have planned long term. It doesn't really take too long, so if you do have a spare box collecting dust, I'd take a weekend to set it up, and make it an email server while you're at it, if you don't already have one. >that being said, i am always interested in (potentially short lived) projects like this. it's sometimes fun to just roll up a node and see who you can connect with. Absolutely. That's part of why I'm even here asking for reasons to use it.

>Tox id 0AA6FFFB057F85A96E33E2484FC566A371F72363B5334FA7C84E5114E5338E12F88B29F95B9F >Time Zone UTC+1 >In what anons are you interested People who like to talk about technology, not a must though. People who are interested in exploring new music genres and unusual movies. Also if you share my passion for mtg or pen and paper games, be sure to hit me up. >Why should other anons be interested in you I programmed in different Languages, C#, Java, Haskell, C++, Python, JavaScript. I read a good deal of books, mostly fantasy so far. We can talk about technology in general, interesting stories and worlds in movies, books and other media. Random bullsoykaftery and Rick and Morty Jokes are appreciated as well.

What about GNU Ring? It's the same as Tox but is actively maintained.

>>4084 >Tox id 48334BD4A66B9D7D39E241A51287EAB0C6241FBE7AED64B5AC1BB945155035369663EA103608 >Timezone America/New_York >Interests i have a few interests. history being one of them, specifically early dark ages and bronze age being of interest. of course with history, old martial arts and sword fighting goes along with that too. other things that i'm into are are computers, gnu/linux, free software movement, fitness, and i play some games on steam too if you're into that type of thing. >Why should any other anons be interested in you? i like to talk to like minded people, lets be friends