Tox: A secure Chat Voice and Video program

[viking60]

With all the government monitoring programs these days there is a need for free and open programs that provide privacy and security.
Tox is a new and rising star in this market.

Most of the features are not implemented yet but I have tested the secure chat and it is easy and works well.

What you do is hit a copy button (looking like two pieces of paper) that puts a hash code on your clipboard.
Paste it on a document or whatever and send it to your friend (maybe in the PM field of your forum or per mail - to give the NSA a fighting chance ).
He then hits the add friend button on the bottom left and enters/pastes the hash code in the Friend Address field.


Tox will now automatically contact you and ask you to accept the communication from your friend (which you do of course).
That is it! You can now start chatting and the government will not be able to "listen" in.

Tox will never have adds and always be free - sounds good to me!

At the moment Manjaro has it in the default repos and it can be installed via AUR in Arch - but I bet this one will be on all distros once it is ready.

Old school people like the existence of something they called private talks - it was possible in the old days...

Tox could bring that back. And it must be good business too as there used to be something called business secrets....

It looks like Tox aspires to become the new and secure Skype. Only you will not have to pay for extra features.

[dedanna1029]

*raises eyebrows

Hoping I can get back to my netbook soon...

[viking60]

I guess the competition is Jitsi and Linphone

[viking60]

Well it has been a While and this bleeding edge "privacy minded Skype" is moving forward.

Your videos calls and chats will be encrypted and do not require a NSA controlled server - it uses bittorrent peer to peer technology.

So the tox engine has several clients but the best one seems to be utox.

This is still pretty bleeding edge but Video Calls and chat + file transfer do work in my tests between my Manjaro and Arch boxes.
The Encryption library used is NaCl and is pronounced Salt ... well because Natrium Chloride is Salt - Even the name is cryptic.
It works on Windows Mac and Linux, but OSx and Android have a "minimal" but functional install.

To use it simply:
Start tox and click on the edit button. Change the name to your wanted nick. Click on the copy button. Pass this generated hash to your friend.
He can add you by clicking on the Add Friend button (a plus symbol +) and paste in the hash. You will get a notice that someone will add you. Accept it. Now you both are connected without a hassle.

It does work just fine here and it should not matter that it is inhouse since it uses bittorrent technology.

But If some of you can install it and pm me your generates hash I will add you as a friend and you will be notified so we can chat...in an encrypted and secure way.
I do not have a microphone on my main box but I will be able to show you my unshaved computer face - while the NSA guys go cold turkey - because they will NOT see it

Windows guys can download it here:
https://github.com/notsecure/utox-updat ... runner.zip

Linux people can install according to the wiki:

https://wiki.tox.im/UTox
And if they are lucky they might have utox-git in the repos. Manjaro and Arch people can install it from AUR.
Yum guys (Fedora, OpenSUSE, CentOS, RHEL) can simply add this repo:

https://repo.tox.im/tox.repo

Aptitude/Apt get people (Debian, Ubuntu, Mint, etc.) can add the repo with this script

Code: Select all

#remove old key
sudo apt-key del 0C2E03A0
 
sudo sh -c 'echo "deb https://repo.tox.im/ nightly main" > /etc/apt/sources.list.d/toxrepo.list'
wget -qO - https://repo.tox.im/pubkey.gpg | sudo apt-key add -
sudo apt-get install apt-transport-https #for https repos
sudo apt-get update -qq
echo "Tox Repository Installed."
echo "You can now install utox, qtox, toxic, ratox and tox-bootstrapd"

And you Gentoo guys ...you know what to do
Skype is dead - use this!

I found a video of it:

More here

[Snorkasaurus]

I don't see a way to run your own server. If you can't, then it is not secure.

S.

[viking60]

From the linked site above:

Tox requires no servers to relay communications between its users, not even servers hosted by the users themselves. Instead, it relies upon the same technology as Bittorrent, the peer-to-peer networking protocol that spreads bits of files across all the sharers of said files in a way that makes it impossible to say who owns a file, or controls the network. There is no person, human or corporate, for government agents to serve with subpoenas or “national security letters.” Better still, all connections between Tox users are encrypted, so outsiders cannot tell what they are sharing.

Here are the Nodes
https://wiki.tox.im/Nodes

[Snorkasaurus]

Is it not possible for "node maintainers" to record data?
S.

[viking60]

No I don't think so - It is only a list of clients in the pool.
But I have never communicated over the internet so I have no experience how it works there.
In any case it is an end to end encryption so the bits and pieces seeded by everybody are still encrypted.

[Snorkasaurus]

Hmmm, still sounds like nodes could be used to collect some metadata such as when clients connect/disconnect and what IP address they were coming from at the time. The advantage Tox seems to have over regular SIP/RTP is that it may not have the ability to log call details. It also sounds like all Tox nodes are connected to each other, which makes me wonder if it is vulnerable to "client list poisoning" in some way.

My solution so far is to use an application like Mumble, TeamSpeak, or Ventrillo on a server that I maintain and which is only accessible via SSH tunnel.

S.

[viking60]

Well that is an option - you can run your own node:

https://wiki.tox.im/Run_a_node

And only use that.
I am not sure you need it though - it only makes things easier

Install it and send me your hash and we will see

[Snorkasaurus]

I would see that as still being insecure:

To be able to connect to others, Tox needs to connect to a DHT node first. All DHT nodes are connected to each other, and since everyone is connected to at least one DHT node, you can connect to others one way or the other.

Without the ability to run a standalone and private "DHT Node" it sounds like there is no way to use Tox without at least some level of information disclosure.
S.

[viking60]

I dunno if generating that hash and sending it to the receiver who has to paste that looooong number into the Tox id field constitutes a DHT node

I just installed it on a couple of boxes here and copied the hash and pasted that ID into the other tox box under adding a friend.

After some time the real name popped up and I was able to communicate - just like that.

The end point is not a Facebook or Microsoft server at which point the data are decrypted. All their security talk is about the transport to and from those servers on that server the data are readable by Facebook and Microsoft even if nobody else can read the data.
That is not the case here.

Ubuntu presents it like this:
http://www.sysads.co.uk/2014/08/install ... ntu-14-04/

It looks like that node thing is for finding people on sites like this.

https://toxme.se/
Here you can register your id and give it a readable name.

If you want to stay private it should/may be enough to exchange those long Tox ID's