I’m looking for a end-to-end encryption type app that can be installed both on whonix desktop and on a mobile device.
Tox chat , but keep in mind it doesnt has good mitigation to metadata (so as other apps)
Matrix: but you need to trust in the server that you made your account on and so as your friend server because encryption/decryption made on the server level. (for sure metadata not anonymous as well)
same good protocols as these two above i dunno any exist.
any oppinion on
signal or
https://wire.com/en/download
or some other that are recomended
https://alternativeto.net/software/ricochet/?license=free&platform=iphone
https://alternativeto.net/software/ricochet/?license=free&platform=android
I assume that all tox traffic will be routed trough tor but is there any way to check what IP does the person i add see when i friend request them
Riot has a Debian repo with .deb packages. Available in F-Droid. Needs to be tested if functional over Tor. Can work with any Matrix server. Their default server has sketchy privacy policies though. It is bloated and a battery fiend.
https://packages.riot.im/debian/dists/buster/
Must solve Google capcthas to create account.
Wire does not have .debs.No apk in F-Droid. Don’t know if it possible to use another server. Centralized solutions not acceptable.
Signal may or may not have solved their Google dependency on phones. Still insist on using phone numbers. Centralized - only usable with one server. Not possible to use over Tor without tunneling. Needs a ton of insecure to obtain node.js code to build on the desktop last time I checked. No Debian packaging.
Alternativeto lists a bunch of trash. It’s never good to use that as a reference.
SFLPhone/Ring/Jami/Whatever-name-this-time-of-the-week is pure garbage from a cryptographic PoV. Even if it wasn’t, it doesn’t work over Tor because it uses DHT. They succeeded in obtaining GNU branding for marketing purposes, but still doesn’t change reality.
When it comes to VoIP none of the solutions out there except Tox have TCP support. Yet to hear how good that is.
1 Like
Use WireShark to check that, no easy way i know to do it correctly.
Even wireshark won’t see it. The traffic ends up being directed to the Tor process. From there the Tor process will apply its layered onion encryption. The only traffic easily observable is the traffic from user to Tor relay or Tor bridge.
https://upload.wikimedia.org/wikipedia/commons/e/e1/Onion_diagram.svg
In theory perhaps there could be something like a wireshark plugin which understands how Tor applies the layered onion encryption, locally accesses the keys Tor is using to do that, and then adds that traffic to wireshark or similar but I don’t think anyone developed something like that.
Meanwhile, best you can do is this:
Or set up a destination on a computer that you control and then check incoming connections on that computer.
1 Like
Threema is one (apparently I am forbidden to include the link).
A knowledgeable friend suggested me to buy it (3 USD), but he’s actually my only contact in it LOL.
You don’t have to put in your phone number or e-mail. So, you can change phone number and keep the same Threema ID, which you can backup elsewhere in case your phone gets lost or stolen. From PC, you can access your chats by authorizing the web access from your phone, scanning a QRcode (just as Whatsapp does).
An Android phone (I bet any smartphone today), is however pretty much guaranteed to give NO PRIVACY at all.
Good , because its a proprietary software:
1 Like
Unfortunately i need something that is also mobile friendly and easy to use so my main focus is towards wire and tox at the moment, I saw this guide for wire on whonix wire for desktop - encrypted messenger
I’m not that technicaly skilled so i must rely on outside info to understand weather or not an app has the ability to leak my IP or any other technical info like mac or hardware info
That solution doesn’t currently exist. Tox doesn’t have a decent and functional Android app.
Wire is not in F-Droid so it could be bundling non-free deps or some other reason that’s preventing it from being available in the FLOSS repo.
My assumption was that MY true IP wont be leaked if I use Wire on MY whonix workstation. Is that assumption correct?
That’s the basic point of Whonix…