Hacker News Reader

Comment by tribby | Hacker News Reader

ricochet[1] is my preferred option for situations that would require something like tor messenger (which is very few situations, but I digress). I like that the UX has a built-in threat model (e.g. "do you really want to click on this?")

TAILS users can't use it because tor-over-tor is weird (ricochet uses its own tor process). but it looks like it's getting close.[2]

1. https://ricochet.im/

2. https://labs.riseup.net/code/issues/8173

View on HN

I wish the page had screenshots. That's usually a good measure of how the software is maintained. Currently the page mentions that it's "experimental".

As far as I can see currently the only widely used, secure protocols are Matrix and XMPP with OMEMO.

> I wish the page had screenshots.

The Github page has one: https://github.com/ricochet-im/ricochet/

> As far as I can see currently the only widely used, secure protocols are Matrix and XMPP with OMEMO.

secure != metadata free

Well, that placeholder conversation in the screenshot sure made me cringe. That being said, I look forward to it being integrated and working with Tails.

Yeah. I haven't watched that show in a while, but isn't Phineas usually supposed to be totally oblivious to Isabella's advances?

> The latest version is 1.1.4 (November 5, 2016)

That doesn't look very promising.

> That doesn't look very promising.

Please see this comment by Sarah, https://github.com/ricochet-im/ricochet/issues/555#issuecomm...

```

Hi, I don't speak for @special, but I think some context might be useful.

There is currently a bunch of (official|unofficial) work going on in the wider ecosystem - most of it related to factoring out the base library[1] to go to make it more useful as well as porting the main client to go[2].

There are also a few experiments regarding running on mobile[3] and using ricochet and these other libraries for other things besides traditional IM[4].

Most of this wider work has been updated within the last couple of weeks, ricochet is still actively being worked on & used - just not in the most visible places right now.

Some of the features you have pointed to are sitting waiting for someone to come along and design/write them. For most there is a lot of UX work that needs to be done in order for these features (layered crypto, hidden service auth, multiple profiles etc.) to be secure & useable.

In many cases, adding them to the new Go code might be preferable in terms of ease of implementation. That is partly why work is being put into the libraries there, to make new changes to ricochet as easy and as useful as possible. These libraries are also in development right now, and it may take a little while before everything comes together.

So the best thing people can do right now if they want to move these things along is to contribute to the discussions on the feature threads if they have ideas about how those features could work & to submit code/pull requests to the various code bases.

```

Another great metadata free app like Ricochet is unMessage which has in addition audio support: https://github.com/AnemoneLabs/unmessage

I have been looking for info on why tor over tor is bad and would love to understand the technical reason why, can you share any links?

All I have been able to find is related to uncertainty is it is good or not

This link discusses it: https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWT...

The issue mentioned of reusing nodes doesn't seem like much of a concern considering how the onion routing works (even if the routes are all the same nodes).

But the performance alone is probably terrible.

this is interesting to ponder on, it is clearly over my head because I am not sure why this would cause an issue, even if they reused some of the same nodes. in theory if anything could be gained with tor over tor why would that same information not be attainable in a single tor instance? why is information considered exposed if any node is reused?

>It is not clear if this is safe. It has never been discussed.

why not discuss it now?

Reply on news.ycombinator.com