Tox VS session-android

How does it compare to the more mature Tox[0]?

0. https://tox.chat/

You already can, apart from some DHT and bootstrapping stuff.

https://tox.chat/

https://jami.net/

I tried to like Jami, but it never worked right when I tried it. I didn't find a decent Android Tox client with video call, but it should work alright for text.

Still, Tox still around and kicking 😎

jami.net and tox.chat sort of being the way skype originally was.

Just heard about Tox today from a podcast: https://tox.chat/ (instant messenger, voice, video, screen share, file share)

Options are limited. All modern messengers require trust in the company running the server they connect to. So the only way to eliminate needing that trust is to use a messenger that is peer 2 peer (no server). This is limiting though since no server means no offline messaging. I know of one messenger that is encrypted, anonymous (required no identifying info to sign up) and is peer 2 peer. tox.chat

Other alternatives include Session (free) and Threema (paid - 5€).

Test it by downloading session at getsession.org and DM the bot by starting a new message and sending it to “Simple” (without quotes)

Figured there should be moves to set one up if not - https://getsession.org/

* marketing "Perfect Forward Secrecy" AKA "Forward Secrecy"[0].

I favor Session Private Messenger[1] because it is decentralized and allows third party clients, but Signal enthusiasts warn me that the Session client may, hypothetically, at some future date, integrate a cryptocurrency, as the Signal client already does[2].

[0] https://en.wikipedia.org/wiki/Forward_secrecy

[1] https://getsession.org

[2] https://www.stephendiehl.com/blog/signal.html

If you have a mobile phone number, the domestic intelligence agency knows exactly where you are at all times and any LEO (without a warrant) can also find you. In addition, there have been numerous CCC presentations showing how insecure the global (excluding US) and (separately) US carriers are guilty of promiscuous metadata trafficking ($$) and insecure SS7 setups. As a consequence, for low $, you can go to any one of several shady websites and find the last location of almost any phone number (person unique ID) globally. There are additional varying exploitable vulnerabilities depending on the exact combination of {handset x carrier x country} to impersonate them, tap their line, reveal their exact location, and redirect their phone number through a third-party handset or even a PBX. These are more expensive and some capabilities are forbidden for all but a few selective intelligence uses.

Session (Signal fork) doesn't use phone numbers. It's pretty well-designed overall and uses an onion routing approach. It's already a superset of Signal except it doesn't use phone numbers. https://getsession.org

Also look interesting:

* (unproven) https://www.olvid.io/technology

* (unproven) https://simplex.chat

PS: Using regular TOR on home broadband or cloud servers is relatively risky and inefficient. Sybil attacks on it are common. And to network operators and security agencies it gives an easy "flow tag" of your uplink and exit node data traffic as automatically suspicious.