I think about trying to hide the metadata of who is communicating...
I wonder about a public stream of end-to-end encrypted messages.
Anyone can add a message to the stream.
Everyone reads all of the messages, and tries to decrypt all of them.
There are lots of variants to this, lots of ways to optimize it, probably lots of ways to implement it. But that's the core idea.
One variant is that what everyone downloads is just enough of a message metadata identifier to see if they're the intended recipient (something about Bloom Filters or PGP Signatures or something, I dunno). Then, if you are the intended recipient, you request the message contents itself. To obscure which messages were for you, you also download some very large number of other messages.
Something about microtransaction fees to pay for all of it. Maybe something about distributed ledger. Mumble, mumble. Maybe messages only live for X days or something.
I believe there is a Usenet newsgroup, somewhere under alt.binaries, that's effectively a numbers station: it's just GPG-encrypted (but not signed) blobs with no titles. Anyone can post, anyone can listen, everyone has to download everything to figure out which things they can personally decrypt.
Sadly, googling related keywords doesn't seem to pull up the name of the newsgroup. I believe I read about it during a discussion on a Tor onion-site forum, on "why people keep getting caught doing illegal things on Tor, and what real OPSEC looks like."
> something about Bloom Filters or PGP Signatures or something, I dunno
Would this not defeat the purpose? Once an individual was tied to a unique piece of data, they'd be tied to all data in the stream.
I think such a system would definitely require guaranteed expiration (impossible?). Or some sort of rotating keys or the metadata piece would still be uniquely identifying.
I like this idea, as a concept, but I have no idea how it would actually work in real life with bad actors who can and would download all messages as they appear.
I wonder if there's some way to enforce expiration?
I recall there was a proposal to use "chaffing" as an alternative to encryption; partly motivated by cryptographic signatures not being export controlled.
The basic idea is to split a message into very small pieces, say individual bytes or even bits. And the sign each bit, and iirc add a sequence number. Then you end up with a triple: sequence number, data, signature. Then you generate random triplets - and distribute the lot: the recipient orders by sequence number and keeps the bits with valid signatures.
I'm not sure about how ordering was achieved, but it was a clever idea.
Ah, here's Wired's coverage of the Ronald Rivest's idea in 98:
You basically create a hash table over public identities (bucket = pubkey % n) with an n chosen such that you get a bunch of unrelated people in each bucket but not so many that peers are overwhelmed by the message load on their bucket. Messages can be as simple as ES-SS-DH (basically Noise_X), same properties as e.g. PGP, i.e. no forward secrecy, no KCI resistance.
use hash(best block + sender id + recipient id + sequence number) then only the senders and receivers would be able to get the metadata... though recipient would need to “check” their whole contact list to pull the data... maybe this is where the bloom filter is?
ricochet[1] is my preferred option for situations that would require something like tor messenger (which is very few situations, but I digress). I like that the UX has a built-in threat model (e.g. "do you really want to click on this?")
TAILS users can't use it because tor-over-tor is weird (ricochet uses its own tor process). but it looks like it's getting close.[2]
I wish the page had screenshots. That's usually a good measure of how the software is maintained. Currently the page mentions that it's "experimental".
As far as I can see currently the only widely used, secure protocols are Matrix and XMPP with OMEMO.
> Running Retroshare over Tor has a number of definite advantages: it does not require firewall management (Tor does it for you); you do not need a DHT to find your friends (Tor does it for you), and whatever code is tied to ensuring security of your IP information is not needed anymore.
For what it's worth, they've provided a version that can use Tor for a while now. What's new is that the provide a portable version that ONLY uses Tor. Pretty handy!
Would like to read, but it looks like my work is blocking access to torproject.org. I had not realized that this sort of blocking was in place. Gauntlet thrown. My project for today is now to gain access to Torproject on my work machine. Bonus points for installing and running Tor without elevated privileges.
Perhaps try running TAILS in a VM and connecting through bridges? Tor project's hidden service is at expyuzz4wqqyqhjn.onion
You certainly should not need elevated privileges for Tor Browser but I realize that accessing their download site in the first place is the issue. I'd post a magnet link but doubt that follows the rules here.
Matrix.org/Riot.im has all the encryption you could wish for, a modern, useful interface, and a federated model in which everyone can run their own server and talk to everyone else, just like email.
Matrix doesn’t protect metadata on the server currently - so you have to trust the admins that run the servers you are participating in. In the longer term we want to fix this (https://matrix.org/~matthew/2016-12-22%20Matrix%20Balancing%...) but we haven’t started on it yet.
As far as I remember you needed quite big servers if you wanted to "federate" with others, like join big chatroom because Matrix will try to replicate the history and keep it in sync. Is it still the case?
What metadata mitigations does matrix have (the point of Tor Messenger)? We already have a federated protocol called XMPP. Sometimes you are interested in not revealing who you are talking to.
That won't be enough for the average Tor Messenger user. Email's failings were the impetus behind both instant messaging and Tor. Users don't want/need federated models. Security aside, they want a convenient little app that will receive messages instantly while online but doesn't have to remain online 24/7.
I think the world of secure messaging is in an odd-way at the moment. It feels a bit like competing standards at this point[1]. I'm personally still using signal as the metadata shared by Wire is way too much imho.
Even more interestingly the EFF has stopped trying to recommend the best one and instead is encouraging the users to do their own reasearch (even redirects old urls[2])
Signal is great; except there's also tonnes of metadata.
If I'm trying to talk to someone anonymously, having to give them my phone number somewhat defeats that anonymity. Even having it installed is potentially dangerous; it scans your phone book and suggests other signal users (thereby outing you as a user in the first place).
I tried it a while back but never really liked it. Clunky UI and the project in general seemed to have a lot of problems. The kickstarter project was basically a ripoff, the project management is (or at least was) scattered and basically non-existing.
I have much better experience with Matrix[1]/Riot[2].
Matrix is an open protocol with end-to-end encryption (still beta IIRC) and is federated (like IRC) rather than fully distributed.
Matrix is now a stable project with funding and riot has a future business plan to also continue develop.
I rather support KeyBase or Wire (Open Source back-end exists and I think the clients are open source too!) as an alternative. I'm leaning cleanly toward Wire, though everyone I've suggested KeyBase to enjoys it. I like the free storage of KeyBase... sue me.
Note: The interesting part is not the vulnerability itself, that is relatively minor. The interesting part is where the tox developers explain that they don't really understand their code.
[+] [-] VikingCoder|8 years ago|reply
I wonder about a public stream of end-to-end encrypted messages.
Anyone can add a message to the stream.
Everyone reads all of the messages, and tries to decrypt all of them.
There are lots of variants to this, lots of ways to optimize it, probably lots of ways to implement it. But that's the core idea.
One variant is that what everyone downloads is just enough of a message metadata identifier to see if they're the intended recipient (something about Bloom Filters or PGP Signatures or something, I dunno). Then, if you are the intended recipient, you request the message contents itself. To obscure which messages were for you, you also download some very large number of other messages.
Something about microtransaction fees to pay for all of it. Maybe something about distributed ledger. Mumble, mumble. Maybe messages only live for X days or something.
Thoughts?
[+] [-] derefr|8 years ago|reply
Sadly, googling related keywords doesn't seem to pull up the name of the newsgroup. I believe I read about it during a discussion on a Tor onion-site forum, on "why people keep getting caught doing illegal things on Tor, and what real OPSEC looks like."
[+] [-] dranov|8 years ago|reply
https://bitmessage.org/bitmessage.pdf
[+] [-] lukeqsee|8 years ago|reply
Would this not defeat the purpose? Once an individual was tied to a unique piece of data, they'd be tied to all data in the stream.
I think such a system would definitely require guaranteed expiration (impossible?). Or some sort of rotating keys or the metadata piece would still be uniquely identifying.
I like this idea, as a concept, but I have no idea how it would actually work in real life with bad actors who can and would download all messages as they appear.
I wonder if there's some way to enforce expiration?
[+] [-] e12e|8 years ago|reply
The basic idea is to split a message into very small pieces, say individual bytes or even bits. And the sign each bit, and iirc add a sequence number. Then you end up with a triple: sequence number, data, signature. Then you generate random triplets - and distribute the lot: the recipient orders by sequence number and keeps the bits with valid signatures.
I'm not sure about how ordering was achieved, but it was a clever idea.
Ah, here's Wired's coverage of the Ronald Rivest's idea in 98:
https://www.wired.com/1998/03/a-work-around-for-crypto-expor...
http://people.csail.mit.edu/rivest/pubs.html#Riv98a
[+] [-] WorldMaker|8 years ago|reply
[+] [-] blattimwind|8 years ago|reply
(This is patented, or at least pending)
[+] [-] rickycook|8 years ago|reply
[+] [-] tribby|8 years ago|reply
TAILS users can't use it because tor-over-tor is weird (ricochet uses its own tor process). but it looks like it's getting close.[2]
1. https://ricochet.im/
2. https://labs.riseup.net/code/issues/8173
[+] [-] Boulth|8 years ago|reply
As far as I can see currently the only widely used, secure protocols are Matrix and XMPP with OMEMO.
[+] [-] mtgx|8 years ago|reply
That doesn't look very promising.
[+] [-] jerheinze|8 years ago|reply
[+] [-] fosco|8 years ago|reply
All I have been able to find is related to uncertainty is it is good or not
[+] [-] buovjaga|8 years ago|reply
> Running Retroshare over Tor has a number of definite advantages: it does not require firewall management (Tor does it for you); you do not need a DHT to find your friends (Tor does it for you), and whatever code is tied to ensuring security of your IP information is not needed anymore.
[+] [-] skrowl|8 years ago|reply
[+] [-] shp0ngle|8 years ago|reply
[+] [-] e12e|8 years ago|reply
Is this some new feature of the protocol/network?
[+] [-] anc84|8 years ago|reply
[+] [-] sandworm101|8 years ago|reply
[+] [-] jerheinze|8 years ago|reply
https://via.hypothes.is/https://blog.torproject.org/sunsetti...
https://web.archive.org/web/https://blog.torproject.org/suns...
https://archive.fo/U8jHR
https://archive.is/U8jHR
https://archive.today/U8jHR
> Bonus points for installing and running Tor without elevated privileges.
Try https://github.com/TheTorProject/GetTorBrowser then use meek-amazon as a pluggable transport to get it working if your network censors Tor traffic.
[+] [-] buildbuildbuild|8 years ago|reply
You certainly should not need elevated privileges for Tor Browser but I realize that accessing their download site in the first place is the issue. I'd post a magnet link but doubt that follows the rules here.
[+] [-] mackwerk|8 years ago|reply
[+] [-] ktta|8 years ago|reply
[+] [-] pbhjpbhj|8 years ago|reply
[+] [-] nukeop|8 years ago|reply
[+] [-] Arathorn|8 years ago|reply
[+] [-] edhelas|8 years ago|reply
[+] [-] upofadown|8 years ago|reply
[+] [-] sandworm101|8 years ago|reply
That won't be enough for the average Tor Messenger user. Email's failings were the impetus behind both instant messaging and Tor. Users don't want/need federated models. Security aside, they want a convenient little app that will receive messages instantly while online but doesn't have to remain online 24/7.
[+] [-] homulilly|8 years ago|reply
[+] [-] datamoshr|8 years ago|reply
Even more interestingly the EFF has stopped trying to recommend the best one and instead is encouraging the users to do their own reasearch (even redirects old urls[2])
1. https://xkcd.com/927/
2. https://www.eff.org/secure-messaging-scorecard
[+] [-] BuildTheRobots|8 years ago|reply
If I'm trying to talk to someone anonymously, having to give them my phone number somewhat defeats that anonymity. Even having it installed is potentially dangerous; it scans your phone book and suggests other signal users (thereby outing you as a user in the first place).
[+] [-] prabhaav|8 years ago|reply
Would love your thoughts & feedback on how we could better meet your needs!
[+] [-] untog|8 years ago|reply
https://www.ovpn.com/en/blog/webrtc-might-expose-your-ip-add...
[+] [-] jayess|8 years ago|reply
[+] [-] practice4u|8 years ago|reply
[deleted]
[+] [-] ryan-c|8 years ago|reply
[+] [-] waynenilsen|8 years ago|reply
[1] https://tox.chat/
[+] [-] DrRobinson|8 years ago|reply
I have much better experience with Matrix[1]/Riot[2].
Matrix is an open protocol with end-to-end encryption (still beta IIRC) and is federated (like IRC) rather than fully distributed.
Matrix is now a stable project with funding and riot has a future business plan to also continue develop.
1. https://matrix.org 2. https://riot.im
[+] [-] giancarlostoro|8 years ago|reply
https://github.com/irungentoo/toxcore/issues/1379
Also:
https://blog.tox.im/2016/04/01/litigation/
I rather support KeyBase or Wire (Open Source back-end exists and I think the clients are open source too!) as an alternative. I'm leaning cleanly toward Wire, though everyone I've suggested KeyBase to enjoys it. I like the free storage of KeyBase... sue me.
Edit:
Wire Github: https://github.com/wireapp
[+] [-] hannob|8 years ago|reply
Note: The interesting part is not the vulnerability itself, that is relatively minor. The interesting part is where the tox developers explain that they don't really understand their code.