Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Communications Software Encryption Privacy Security

Tox, a Skype Replacement Built On 'Privacy First' 174

Posted by Soulskill from the pet-rock-also-built-on-privacy-first dept.
An anonymous reader writes: Rumors of back door access to Skype have plagued the communication software for the better part of a decade. Even if it's not true, Skype is owned by Microsoft, which is beholden to data requests from law enforcement. Because of these issues, a group of developers started work on Tox, which aims to rebuild the functionality of Skype with an emphasis on privacy. "The main thing the Tox team is trying to do, besides provide encryption, is create a tool that requires no central servers whatsoever—not even ones that you would host yourself. It relies on the same technology that BitTorrent uses to provide direct connections between users, so there's no central hub to snoop on or take down."
This discussion has been archived. No new comments can be posted.

Tox, a Skype Replacement Built On 'Privacy First' More

Tox, a Skype Replacement Built On 'Privacy First'

Comments Filter:

  • Back door (Score:3)

    by WillKemp ( 1338605 ) on Monday September 01, 2014 @07:06PM (#47803097) Homepage

    Even if it's not true [......]

    Considering all the revelations that have emerged about surveillance in those ten years, the possibility that it's not true seems barely worth considering.

    • Re: (Score:1)

      by Anonymous Coward

      The idea of backdoors is just convoluted and pointless, it's often a way of perpetuating some illusion of shady corporate and government collusion. Oddly enough the product is used by many different governments and other corporations across the globe so I've never quite understood who the supposed conspirators are - though it is often Microsoft and the US government while the rest of the world are bumbling fools living in ignorance, but these people who tell us all about these back doors (except what they a

      • Re:Back door (Score:5, Interesting)

        by AHuxley ( 892839 ) on Monday September 01, 2014 @08:19PM (#47803419) Journal
        AC the backdoor aspect is both national and international
        "FBI Wants Backdoors in Facebook, Skype and Instant Messaging"
        http://www.wired.com/2012/05/f... [wired.com]
        ".... drafted by the FBI, that would require social-networking sites and VoIP, instant messaging and e-mail providers to alter their code to make their products wiretap-friendly."
        Then the world was given more details "Encrypted or not, Skype communications prove Ãoevitalà to NSA surveillance" May 14 2014
        http://arstechnica.com/securit... [arstechnica.com]
        As for the "nobody on the inside has ever leaked out." aspect try http://cryptome.org/2013-info/... [cryptome.org]
        The "inside" can now be understood by aspects like "Drug Agents Use Vast Phone Trove, Eclipsing N.S.A.Ã(TM)s"
        http://www.nytimes.com/2013/09... [nytimes.com]
        ..."employees sit alongside Drug Enforcement Administration agents and local detectives and supply them with the phone data from as far back as 1987."
        How past "parallel construction" and telco support will respond to any new "peer-to-peer and voice calling" will be interesting.
        How did the US and UK get to past bespoke crypto telco hardware in the 1950's and beyond? Plain text always seemed to emerge just in time.

      • Leaving the conspiracy theories aside (indeed, who needs them, except strawman erectors) -- tell me, do you think for instance there were some average Janes and Joes that got rather a bad wrap, undeservedly so, during the housing and banking crises the other day?

      • Hows this.

        We know-- for a fact-- that Skype has worked with the Chinese government to provide bugged versions of skype (TOM Skype). We know-- for a fact-- that Microsoft has access to provide call logs for law enforcement, on demand.

        Call it what you like, but both of those are well documented and can be found in a 5 minute google search.

    • Of course it's backdoored. The only reason why eBay bought Skype is to cross-correlate with PayPal accounts in exchange for taking the heat off threats of banking regulation.

  • it's a great idea with one major flaw (Score:5, Insightful)

    by Anonymous Coward on Monday September 01, 2014 @07:16PM (#47803139)

    Decentralized services are a great idea, but there is one big flaw. Not enough people care about it to get a critical mass of users. Virtually everyone outside a handful of tech geeks will keep using the centralized services, so to talk to people out there in the real world, you'll need to use the centralized services too. Or, restrict yourself to these decentralized networks and find they are mostly empty, maybe several thousands of users across the whole of the world.

    And good luck trying to explain to Joe/Jane Sixpack how to use them. You have to fight against the centralized data-mined services that came preinstalled on their devices, and that's a non-starter for most people.

    It fails not for technical reasons. It fails because of widespread tech illiteracy in the general population.

    • Re:it's a great idea with one major flaw (Score:5, Insightful)

      by dcollins117 ( 1267462 ) on Monday September 01, 2014 @07:24PM (#47803167)

      Decentralized services are a great idea, but there is one big flaw. Not enough people care about it to get a critical mass of users.

      There's a group of Hollywood celebrities that have just been made aware of the need for decentralized and more private internet services. I think people will care, albeit only after a problem has occured.

      • Re: (Score:1)

        by Anonymous Coward

        Do you think a single one of those celebrities will move to such a system?

        I wager not one of the ones effected by it will.

        • Do you think a single one of those celebrities will move to such a system?

          I really think they will if it's the easiest option. It's up to developers to make encrypted, decentralized storage the default and easy to use. Build it and they willl come (pun half-heartedly intended.)

        • Step one is to have the big high-profile stories in the press about the problems. Step two is to have the big high-profile stories in the press about the alternatives. The important thing now is for anyone who is contacted by the press as an expert to ask about the iCloud hack to make it very clear that this isn't an Apple-specific problem, it's a problem inherent in the entire design of centralised services and to list alternatives.

      • There's a group of Hollywood celebrities that have just been made aware of the need for decentralized and more private internet services.

        In that context what is the solution? Certainly not to host the services yourself. The security was beaten by a flaw in the server software that allowed a brute force attack to take place, so how does decentralization help you there?

      • Re:it's a great idea with one major flaw (Score:5, Insightful)

        by Bing Tsher E ( 943915 ) on Monday September 01, 2014 @07:37PM (#47803237) Journal

        They just have to stop storing personal content 'on the cloud'. Don't buy into the idea of no local storage. Say NO to devices that don't have an SD slot ( sorry, Apple and Google...)

        32g sd cards are really cheap now.

        • I agree with your idea of not buying into "no local storage", but ...

          The device doesn't matter, it's the software. My 16gig iPhone has plenty of storage for my to do what I need/want without using cloud/off-device solutions. I don't need a device with sd cards. Software is the issue. The software I use IS going to send some information to a server SOMEWHERE for storage or re-routing - that is the problem. Having software that does proper peer-to-peer, fully encrypted with proper up-to-date encryption metho

    • It fails not for technical reasons. It fails because of widespread tech illiteracy in the general population.

      You do see what I mean, right?

    • Not much the average consumer can do about wire tap friendly products built into tame telco approved hardware and software as offered globally.
      You can code a software layer into your consumer device that offers really good quality encryption.
      The problem is not so much a back door, trap door, just that every letter and number entered on the device is open to hardware logging by default by a gov activated telco layer..
      A person is walking around with a gps becon, live mic, camera and plain text capturing de

    • Re: (Score:3)

      by Tom ( 822 )

      It fails not for technical reasons. It fails because of widespread tech illiteracy in the general population.

      We've largely solved the issue with things like magnet links and decentralized databases.

      The issue we still haven't solved is in our mind: We believe everyone needs to have "tech literacy", completely forgetting that every invention in history became successful only after someone made it easy to use for people without learning all the mechanical details about it. When only car mechanics could drive a car, the total number of cars in the world was less than that in your local shopping malls parking lot today

  • Why reinvent the wheel, again?

  • I don't use skype for a 'chat box.' Really, I hardly 'chat' at all anymore. Did enough of that in the late 80's to early 90's. I use skype as my long distance phone carrier. As long as I'm at home or have a wifi connection, I can call any phone in the continental US at no extra cost. This costs me about $4 a month. It's a nomadic sort of thing, I used to do it with an iPod touch, but now use an unsubscribed Android phone (the iPod touch 'for the rest of us', which even has an SD slot!). When home I make lon

    • Re: (Score:2)

      by mellon ( 7048 )

      I use SIP for my PoTS gateway. It's pretty seamless. Something like Tox, if it works, would be an incremental improvement.

  • Tox? What happened to BitTorrent Chat? I though the bittorrent folks themselves were making a secure decentralised chat client, it even made news on slashdot once.

  • Microsoft Gave the NSA Backdoor access to Skype .. (Score:4, Informative)

    by Anonymous Coward on Monday September 01, 2014 @07:39PM (#47803243)
    'A lengthy new Guardian report claims Microsoft worked directly with the NSA by giving complete back door access to Outlook (and Hotmail), Skype and SkyDrive. The report basically says each service was easily circumvented in order to make the NSA’s job of sleuthing data incredibly easy, as if your private info was selling at a weekend garage sale. One NSA document even described the collaboration with Microsoft as a “team sport.”' ref [technobuffalo.com]

  • Diaspora (Score:1)

    by Anonymous Coward

    Who wants to meet up on Diaspora and chat about Tox?

  • Key exchange (Score:3)

    by manu0601 ( 2221348 ) on Monday September 01, 2014 @08:04PM (#47803325)
    And how do you exchange key? Do they plan a web of trust à la GPG?

    • Re: (Score:3, Interesting)

      by Anonymous Coward

      I discussed it with one of the admins on their IRC.
      "it's up to the users to give their public key to their friends in a way that it won't be intercepted in transit and replaced"

    • It could be handled like SSH: when you get an invite to connect to someone, their key fingerprint is displayed. If you are paranoid, you can verify the fingerprint via alternative channels. Otherwise, you blindly accept it. In either case, you are protected against man in the middle attacks after that first connection is made. Also, if you did accept a fake key, any time you try to talk to that person over a network where the man in the middle is not present will trigger a key mismatch, revealing that an at

      • You assume that people actually pay attention to these key mismatches and don't automatically click "yes" to them.

        Would be worth a social experiment just to prove you idiots wrong ;)

    • Re:Key exchange (Score:5, Interesting)

      by BitterOak ( 537666 ) on Monday September 01, 2014 @08:45PM (#47803533)

      And how do you exchange key? Do they plan a web of trust à la GPG?

      A better approach would be to generate a random session key and each user's client would display some sort of hash (it doesn't need to be really long: 6 or 8 digits would suffice) of that key. Assuming the two parties know each other and recognize each other's voice and/or face, one of them can read the hash to the other. If there's a MITM attack, they won't match. As I said, the hash doesn't need to be long, since one mismatch would indicate trouble.

    • Re: (Score:2)

      by Bob9113 ( 14996 )

      And how do you exchange key? Do they plan a web of trust à la GPG?

      That was one of my first questions. The answer is; however you want. They provide an "easy" (hence vulnerable) method for doing so, but you can check the public key hash against your securely transferred value before approving a key if you want.

      Or, slightly differently; this is not a key exchange system, just a comm system you can use once you have authenticated a key to your level of security requirement.

  • Kazaa (Score:3)

    by gringer ( 252588 ) on Monday September 01, 2014 @08:04PM (#47803333)

    Hmm, interesting. It might be worth pointing out that Skype was originally based on a decentralized service pushed through the Kazaa network:

    http://arxiv.org/abs/cs/041201... [arxiv.org]

    Like its file sharing predecessor KaZaa, Skype is an overlay peer-to-peer network. There are two types of nodes in this overlay network, ordinary hosts and super nodes (SN). An ordinary host is a Skype application that can be used to place voice calls and send text messages. A super node is an ordinary host’s end-point on the Skype network

    Of course, the problem with the Skype system (as it was when that paper was written) is that the decentralised nature of the network means that your video call could be routed through any number of Skype network nodes (i.e. computers) before it arrives at its destination. I think now Microsoft has replaced most of the supernodes with microsoft servers, so replace "any number of Skype network nodes" with "any number of Microsoft servers".

    Presumably Tox is doing something similar to going back to the roots of Skype, with maybe a bit more encryption thrown in.

    • Re:Kazaa (Score:5, Insightful)

      by WoodburyMan ( 1288090 ) on Monday September 01, 2014 @08:18PM (#47803413)
      I can attest to Skype doing this. A friend away moved away for graduate school and we would communicate using Skype, so I started just leaving the desktop application open. My computer is located in my bedroom, with a switch next to it. I woke up like 3am, see the lights FLASHING going all sorts of nuts on my switch, which was weird as I had nothing on my pc open at the time. I check net stat... i see a inbound and outbound connection, one to some SBC DSL user in Atlanta, another to a Comcast user somewhere else, forgot where, but some other state. I kill Skype. BAM, connections close, traffic resumes normal operation. Skype was using my computer as relay service, since I have active UNPN, and the other two client presumably had some sort of firewall blocking direct communication. To this day i tell *EVERYONE* who uses the Desktop app to close it as soon as they're done to prevent this as most home connections now have meters. (Charter's is 250gb/mo for 30mbit, which I hit 150gb+ some months when I was toying around with AOSP and downloading the entire repo a few times after screwing up a VM or something).

      • I have noiced the same thing on my skype in the past. I am fine with contributing some p2p bandwidth but wish the program was a bit more upfront about telling you about it.

        On a separate but related issue, I used to use netstat for the same kind of thing you did, but now I run a program called nethogs, which is a command line tool a lot like top, but shows bandwidth usage by process in real time in more sane units like kb/s instead of the ugly packet buffer counts netstat uses which are kind of hard to read

      • Re: (Score:1)

        by Anonymous Coward

        Skype CAN and DOES read your messages, and quite probably your voice and video too.
        Send a text chat message with a unique one time URL to your own box in it over Skype, such as:
        http://yourbox.com/laks2312kjceie
        You will see a bot fetch you. Skype scraped the link out of your so called privately encrypted chat.
        Google it if you don't believe me.
        SKYPE CANNOT BE TRUSTED, EVER!!
        NO CLOSED SOURCE CAN BE TRUSTED!!!!!
        Quit freaking using closed source, there's no reason to anymore.

      • I'm curious whether Skype changed to a more centralized service primarily because of the mobile world. Skype used to be a huge connection and battery hog on phones primarily because of the decentralized nature. Skype used to send messages through that were 'pending' to a contact even when your phone was in standby, because it was constantly trying to push the message to the user.

        After microsoft acquired Skype, one of the first changes was this was removed, but it made it difficult to send messages sometim

  • Privacy Last (Score:3, Informative)

    by westlake ( 615356 ) on Monday September 01, 2014 @08:07PM (#47803351)

    Readers of this story will have noticed the links to four of the major social media sites, including Facebook.

    Since the earliest days of USENET and IRC Chat, the geek has a flawless record of making one-on-one communication over the Internet as painful a process as possible for the non-technical user.

    It took the commercial services like Sype to break the spell.

    • Re: (Score:1)

      by Anonymous Coward

      Even just downloading and running it is a PITA. Click the flashy download button on the front page and you get to a crappy wiki page listing several "proof of concept clients" - pick one! Of course, if you look further in the Wiki you'll find that there's about a dozen other clients as well, and none with the complete feature set. So now we have gone from downloading and installing to reading, studying, pondering and failing... great way to make people use your software!

      Oh, about the failing part: why isn't

    • Re: (Score:3)

      by Bob9113 ( 14996 )

      Since the earliest days of USENET and IRC Chat, the geek has a flawless record of making one-on-one communication over the Internet as painful a process as possible for the non-technical user.

      Don't be facetious. One-on-one communication could be much more painful. In the specific case of secure (ie: end-to-end encrypted) communication, Tox is approaching the theoretical limit of simplicity. Key exchange has a mathematically bound minimum complexity in order to be secure. The reason Skype is not secure is pr

    • Re: (Score:3)

      by rastos1 ( 601318 )
      Where did you get the idea that USENET or IRC is supposed to facilitate one-to-one communication?

  • It always seemed we could at least sandbox Skype as a limited unique user, but 4.3 requires Pulse and pulse is increasingly the de facto sound system over alsa. Correct me if I'm wrong but doesn't pulse running at the user level only allow ONE user and system-wide utilization is vehemently discouraged by the developers for SECURITY reasons? If so, it seems like Microsoft and the NSA have worked out a way to p0wn any linux box where a person has installed a working 4.3 Skype.

    I guess you could still use it fo

    • Re: (Score:2)

      by hweimer ( 709734 )

      Correct me if I'm wrong but doesn't pulse running at the user level only allow ONE user and system-wide utilization is vehemently discouraged by the developers for SECURITY reasons?

      No, it's the other way round: Running PulseAudio as a system daemon (as opposed to the default way of per-user sessions) has security implications [freedesktop.org].

  • Fucking 'Dependencies" (Score:1)

    by Anonymous Coward

    Just tried to install it after adding the PPA and it's missing mysterious dependencies, thus cannot be installed. Rubbish. Promotion should offer an incentive, not a host of obstructions! Back to Jitsi, cunts.

  • Toxic? (Score:1, Interesting)

    by profi ( 29705 )

    Tox is licensed under GPL v3 which is incompatible with iOS. Brilliant idea to exclude one of the most popular mobile platforms, this will surely replace Skype.

  • Easy way to make this much more useable is to keep the current user rendezvous infrastructure, but use a layer on top for key exchange that goes through user-elected central servers.
    The entire Moxie Marlinspike's trust agility thesis. Let the users choose the central entity that they trust for making the rendezvous via a plugin or a high level protocol layer - something as simple as a REST api over https. Every trust provider just has to provide an API endpoint for signing and exchanging keys.

    App to user :

  • I discuss similar stuff with people. You have a few that don't care but you also have many that are getting wrong advice. Many were told that legally they can't highly secure their cell phones, computers, tablets, etc. Plus a few even said that to be as secure as possible will have them put under suspicion of illegal activities and they don't want that kind of attention.

    I believe security is good if it accomplishes what it is intended for. But many that are not secure because for a decade they were tol
  • ... consists of 64 hex characters. This gives a 256 bit public key. Not very strong or am I missing something?
  • Instead of some man in the middle proxy bullshit such as Skype we can take advantage of getting away from NAT and have point to point communications over IPv6 just like ringing a phone number.

Slashdot Top Deals

"Protozoa are small, and bacteria are small, but viruses are smaller than the both put together."

Close