I think you’re right. Is it just me or is all the I2P documentation stored on .i2p servers? I can’t find any information from the outside.
@goldstein Can you confirm?
Also, I added a blurb on coyIM then saw your old thread about it + Moxie dick moves:
A secure replacement for Pidgin
Will pull info from that thread. Maybe a table is in order…
I think a good rubric for recommending IM programs is:
*Written in a type safe language
*Encryption is the built-in default not a plugin
*The code is audited
Bonus points:
*No metadata collection possible
*PQ Crypto
*OMEMO support
Gajim Notes:
Note on XMPP Privacy from https://securejabber.me/en_security.html:
XMPP was designed long time ago without anonymity kept in mind. Depending on the capabilities of your XMPP client it may leak some sensitive information about your software configuration such as the time on your machine, your timezone, geolocation (XEP-0080), version of your operating system and version of your XMPP client. Some XMPP clients can also download a content (pictures, files) authomatically that may be used by attacker to reveal your IP address. Thus, if anonymity matters for you, it is always better to run XMPP client inside some virtual operating system (on virtual machine), that doesn’t share its software configuraton with your main operating system.
Tor Messenger (v0.2.0b2):
CoyIM (v0.3.7):
wow.wow.wow. Love what I’m reading here: https://coy.im/about/
These guys are our kindred spirits. If coyIM does what it says it does, Tor Messenger is dead-on-arrival.
I’ll mostly just be repeating what’s on their About page… so what… it’s good.
The goal of CoyIM is not to have every feature under the sun. Instead we want to carefully pick and choose the features that are necessary to create a good chat experience, while keeping the attack surface of the system to a minimum.
If more than one account is configured, when connecting CoyIM will insert random delays before connecting to each account, in order to make fingerprinting of connections between accounts harder
On their wishlist:
Blacklisted features:
Issue tracker looks pretty clean. Mostly UX stuff. Some tickets worth watching:
Audit Progress: Audit CoyIM · Issue #297 · coyim/coyim · GitHub
Mandatory OTR: Make OTR mandatory · Issue #270 · coyim/coyim · GitHub ; coming next release
Debian packaging: Add deb packaging · Issue #260 · coyim/coyim · GitHub ; coming days timeframe
Fedora packaging: Easy CoyIM install on Fedora · Issue #197 · coyim/coyim · GitHub ; also coming soon
Sandboxing: Sandboxing · Issue #108 · coyim/coyim · GitHub ; leaning toward seccomp but apparmor also mentioned
This seems like a no-brainer for Whonix 14!
EDIT: I need to re-test the isolation using non-hidden services. I know streams going to different HS are isolated from each other. (per [tor-talk] hidden services and stream isolation) I’m not sure if multiple streams going to same HS share circuits or not.
EDIT2: re-tested with non-onion jabber servers and stream isolation still works. fyi coyIM won’t allow connections to clearnet servers if an onion server exists.
Also, EFF will be releasing their new Secure Messaging Guide soon:
https://www.eff.org/secure-messaging-scorecard
Version 1.0 was rather… weak:
Recognizing that unpublished audits can be valuable, we do not require that the results of the audit have been made public, only that a named party is willing to verify that the audit took place.
Hmm… (those private audits also included closed-source apps).
Translation: “Trust us when we say that our audit (which no one has seen) says that this program has solid code (which no one has seen).”
Good day,
Wait what?! SO THEY DIDN’T EVEN REQUIRE RELEASING THE RESULT?!?! What purpose does that serve?
I can only think of this one:
Source: xkcd: Clinically Studied Ingredient
Actually, if the RESULTS (still can’t get over that part) aren’t even required to be released, even that translation is to good. That XKCD fits really perfectly for this.
Have a nice day,
Ego
Had a closer look at gajim because gajim and a gajim OMEO plugin are installable from packages.debian.org. Here are the notes that came out of it.
Great stuff in this thread!
FYI unmessage. Had quite some discussions with its developer recently. They even added experimental VoIP support recently!
How to their encryption features compare to OTR and/or OMEMO?
They use the same circuit unless they are using a different SocksPort or socks user name.
ricochet does not use an inside application encryption layer. The only encryption is the one used by Tor onions. Therefore it does not provide OTR like encryption features. Maybe not catastrophic but also not great. Source:
unMessage uses stronger encryption, Double Ratchet Algorithm for in application encryption, which is similar to OMEMO (which is similar to OTR). More details:
The ‘Wire’ chat is created by Estonian ex-Skype mastermind (pre MS takeover) announced that they will opensource both client and server code. Multiple code audits over time show they are improving their codebase. The most recent by JP Aumasson (who uncovered bugs in Signal) confirms its robust crypto implementation. IM protocol uses Moxie’s ratchet. VoIP recently became E2E encrypted otherwise past notes say its RTP with SRTP. E2E encrypted group VoIP planned which no other major client has:
RTP is usually UDP based. Now that they are open source we can potentially ask for a TCP implementation like they did for Skype before. Maybe suggest Tor support too.
Licensing:
Server still has some proprietary components as of now (April 2017) but opening it up.
Both components client and server are released under strong copyleft licenses. However I noticed there are extra restrictions on client modification if the derivative app wants to connect to the Wire company server - that seems normal considering projects like Signal even forbid this from happening at all. They are aiming for a federated network anyhow so this restriction is less problematic long term.
Another point is contributions must happen under a CLA. Looking thru it: it seems a defensive agreement to make sure no one can abuse patents against them, copyrights are co-owned between contributors and them, promises that any contributions will be kept under an OSI or FSF license. Sounds reasonable.
Updates:
Some progress on gajim was made. gajim has a separate thread:
Odd fact: signal (android app) does not work on a phone without google installed. Requires google services to run.
There’s more. I have a few online friends who keep dragging me into signal. But my main problem isn’t signal requiring google (which I’m not a fan of, for obvious reasons). My problem is that I don’t own a cellphone at all. I was glad when the users won the Linux battle on PC, but very sad when they lost the whole war by surrending to iOS/Android on their shiny smartphones. Most likely I would not buy a phone until it will be possible to install a standard Linux distribution on it, like I can do on my PC. I did a very superficial search online and it looks like signal also has a desktop app. Yet, to register an account, one still needs to have a phone to receive some authorization code to it. I would be glad to hear your feedback on this if you have anything to add.
You might be interested in this.
2 posts were split to a new topic: Redirect Whonix-Workstation Ports or Unix Domain Socket Files to Whonix-Gateway