Simplex Chat

Any Lains familiar with Simplex Chat? I haven't seen people on the internet talking about it much. It's cross-platform and requires no phone number or other personal info. You don't sign up at all, actually: its big new feature is unidirectional queues, which means there's almost zero metadata and you connect to other people using one-time invitation links. At the message level it uses standard double-ratchet encryption, and the core library was audited in 2022. I want to like it, but the comparisons section on the website makes me suspicious (see pic). I hope someone can tell me that I'm wrong. >Possibility of MITM Isn't the whole point of E2E encryption that you don't have to trust the server? What makes Signal and OMEMO vulnerable to MITM that doesn't also apply to Simplex? >Dependence on DNS Simplex invite codes are literally URLs. >Central component or other network-wide attack Same problem as the DNS comparison, plus how can there be a network-wide attack on XMPP if it's federated? It just feels like a VPN ad ("You're vulnerable to these dubious threats unless you use our service!") and it makes me distrust the whole project.

There was a thread on it a while back but I don't remember it going anywhere. Also I still have to do my homework on how it really works under the hood. The code is open source afaik though so that's cool. What did throw me off was their TOS even back then that made me suspicious. And sure, you can (as they claim) host some sort of node or instance of your own with blackjack and hookers but it would be effectively shut out of the officialTM channels which would be controlled by simpleX staff or what ever and you need to appeal to them in order to be granted their blessing thus leaving you with two use cases: a walled garden which is going to be a reddit tier soy fest and unlisted dark channels that are going to be used by pedos. I may of course be wrong but what speaks against just using matrix instead?

I tried it a while back and thought it was pretty cool. Just opened the latest version inside a sandbox (like I did last time) and this time it got killed when I tried to add a contact: > simplex: mprotectForLinker: failed to protect 4096 bytes at 0x40000000 as read-execute: Operation not permitted. Of course, I have no idea what it's trying to do with that chunk of memory.

>>24091 I read over the site and github page and I see no evidence for any gatekeeping such as you claim. As for Matrix, it has definitely had its share of shenanigans. Disregarding that history and speaking purely technically, Matrix's design is based on updating and synchronizing a database (or, in practice, multiple databases, because of federation), not about anonymously passing messages. It's a data vacuum with a fig leaf of non-mandatory E2EE.

That might be useful for one time chats with some random person but having to send a link every time you want to chat you sending a link basically are creating a connection between you and this other person so you have to have another form of communication to get there.

>>24106 The link is used to add a contact. You don't send a link every time you want to chat. There's also the option to generate a long-term "address" that multiple people can use to add you as a contact (and you can delete it later). >you have to have another form of communication to get there Just like any other network. If I want to chat with you on Tox I would need to post my Tox ID here. I encourage anyone with questions to read the developer's blog posts. Many things are explained there.

>>24090 I'm a retard so sorry if dumb question, but how does it not depend on DNS? do computers not use DNS if clicking a URL as opposed to typing it in? That doesn't sound right but thats the implication I'm getting from your comment saying the invite codes are URLs

>>24098 >operation not permitted did you try this in linux? do you need to use sudo or maybe change the permissions?

>>24112 is tox even actively maintained anymore? Last update for qtox was 3 years ago.

>>24126 I'm not a networking expert but it was an IP address link a DNS would not be needed, though im not sure if IP address links always evade DNS's. If it was a URL it should be going through a DNS regardless of if typed or linked.

>>24129 Oh the invite links are just straight IP addresses? That would make more sense, when OP said URL I figured it would be a domain name but it could also just be an IP address

>>24128 I looked into Tox about a year ago, iirc it was the cross platform tox that wasn't maintained (That might be qtox), but I think the strictly android or linux ones were maintained, but it's been awhile. I'm still struggling to set up XMPP with Swift in linux, I might try SimpleX if it's easier

>>24146 A word got cut out. I meant IF it is an IP link it would make the statement correct but it would be false if it's a URL. I havent looked into it yet.

>>24106 u can also uz the public shatroom/s >>24128 it wuz finished n sheet yeers ago but yes unfortunately >>24147 toxic & rattox r the super eyor clients

>>24127 I actually got to talk to the devs about it and the error was because of post-quantum encryption(!) that they added. Modifying my sandbox settings got the latest version working. >>24090 >What makes Signal and OMEMO vulnerable to MITM They're not more "vulnerable" at the encryption level, but SimpleX forces you to do key exchange out-of-band so you know your connection really is end-to-end instead of being intercepted and spoofed. There's nothing stopping you from doing the same with Signal/OMEMO but you aren't forced to do it. >Simplex invite codes are literally URLs. The key exchange is contained in the long code that comes after the #. The URL is just to provide a landing page with instructions for people you invite who don't already have the app and open it in a browser.

>>24194 Correction: there's nothing stopping you from exchanging Signal/OMEMO confirmation codes out-of-band. I don't think you can exchange actual keys out-of-band.

unofficial lainchannel: simplex:/contact#/?v=2-5&smp=smp%3A%2F%2FPQUV2eL0t7OStZOoAsPEV2QYWt4-xilbakvGUGOItUo%3D%40smp6.simplex.im%2FS1nwJ9LdwghU2uTvw8FW1oX-ClHJcOma%23%2F%3Fv%3D1-2%26dh%3DMCowBQYDK2VuAyEARU2C3aTqnQfkZPC8nEmsvNLe8U2StTftWGhZSIlh5Ck%253D%26srv%3Dbylepyau3ty4czmn77q4fglvperknl4bi2eb2fdy2bh4jxtf32kf73yd.onion&data=%7B%22type%22%3A%22group%22%2C%22groupLinkId%22%3A%22wg7YY3gqPrGuz5sSwmbolw%3D%3D%22%7D

>>24206 New, permanent link (same channel): https://simplex.chat/contact#/?v=2-5&smp=smp%3A%2F%2Fu2dS9sG8nMNURyZwqASV4yROM28Er0luVTx5X1CsMrU%3D%40smp4.simplex.im%2FBHhXf_DmqQBaT8hMWtIPr6C74t8RgDJN%23%2F%3Fv%3D1-2%26dh%3DMCowBQYDK2VuAyEABUE6BzWw6mWD-govxFbL0XOzT_azOagFEBAdXqyr2WE%253D%26srv%3Do5vmywmrnaxalvz6wi3zicyftgio6psuvyniis6gco6bp6ekl4cqj4id.onion&data=%7B%22type%22%3A%22group%22%2C%22groupLinkId%22%3A%22wZlXQ7LCrP99RftpAYUlYg%3D%3D%22%7D

The thing that bothers me the most is that it's just one client and server implementation for everyone. I think SimpleX would greatly improve if you could choose your client like you can with XMPP. I really like the project for what it's trying to do, but they really need more client and server implementations to actually be a protocol and not just an app. If there is a hole in just one server, it's in every server and this makes me see black in regards to the project.