ricochet VS auth

This looks like a much more polished alternative to Ricochet: https://github.com/ricochet-im/ricochet

Ricochet seems dead. It's been five years since its last commit to their git repo, and their website's certificate expired last year. This is probably why you can't find much information.

I think something like Ricochet (if it were still actively maintained) could be a good solution.

https://github.com/ricochet-im/ricochet

Every user is their own Tor onion service, so you get E2E encryption and no centralized servers. The whole thing hinges on the security of Tor itself which is probably a safe enough bet.

With that being said, if I had just one piece of advice - try to avoid ostentatious phrases like Speek is by far the most secure way to converse or 100% anonymous. Tor itself is not 100% anonymous, so that should immediately make anyone cautious. One of the things that I admired about the original Ricochet was that the developers never made brazen claims about their software. In fact, quite the opposite.

Check out https://github.com/ricochet-im/ricochet/blob/master/doc/prot.... It is metadata-free. It does not require a centralized server. It uses Tor.

[1] https://cwtch.im/ [2] https://ricochet.im/

Abandoned, unmaintained, deprecated or unreleased: Ricochet, TOR Messenger, Cwtch

ricochet.im website not working (??)

> there isn't a currently easily available obvious way to have private secure conversations.

Ricochet[1] works really well. It uses Tor hidden services to communicate. Your Ricochet ID is your onion address. To add a contact, you input their Ricochet ID and a short message, and Ricochet connects to their onion address and sends a contact request. If the contact request is accepted then you'll each show up as a contact on each other's client and can chat whenever you want.

Tor is really perfect for this, you can't get more private or censorship-resistant than Tor.

The UI is currently not great, but that's not a protocol problem.

The biggest problem with Ricochet is that hardly anyone is using it.

[1] https://ricochet.im/

Re: key distribution, we're just changing it now but in a few days the scheme will be:

1. a community member sends you an invite link containing some onion addresses of community members

2. you sync community data and send a CSR to the community owner.

3. We show an "unregistered" message next to your name until the community owner signs your CSR, at which point you're a full member.

We use PKI.js for the certs. For multi-party message-layer encryption with multi-device support we plan on using: https://github.com/local-first-web/auth, which is inspired by Keybase and a Martin Kleppmann paper.