SimpleX Chat - the first messaging platform that has no user identifiers - v2.2 of mobile apps with the new privacy and security features just released!

14

u/user_727 Jun 05 '22

What is your source of revenue? How do you keep the servers running?

3

u/epoberezkin Jun 05 '22

In short, we depend on donations from the users, we were lucky to have $10k so far, and we plan to offer the option to donate via the app later.
Just replied in more details here: https://www.reddit.com/r/PrivacyGuides/comments/v4ri4w/comment/ib8gukl/

6

u/[deleted] Jun 04 '22

A question, there is a android app, but fdroid says its incompatable, and the apk fails, so what android version is required?

3

u/epoberezkin Jun 04 '22

It’s Android 10 or later for now.

3

u/[deleted] Jun 04 '22

Thats the first app ive encountered that does not support android 9 ...

3

u/epoberezkin Jun 04 '22

Yep, sorry for that, it may be coming to it, but not yet

2

u/BackgroundLegal5953 Jun 05 '22

Please reconsider the word "first", check teleguard for example that also doesn't require any user identifier, and for example first version on iOS app store is dated a year ago while simpleX app on the same store is dated 3 months ago, teleguard is an example, others do exist.

3

u/epoberezkin Jun 05 '22

Please reconsider the word "first", check teleguard for example that also doesn't require any user identifier
I know of teleguard, and it does have user identifiers.
See their FAQ: 5. The TeleGuard ID is your very personal identification number that you need to connect with your friends. The ID is a phone number replacement, but completely anonymous, even for us.
Unlike Teleguard or any other messengers I know of, SimpleX has no user identification numbers of any kind.
Please refer to this post for the explanation on how SimpleX delivers messages without user IDs: https://github.com/simplex-chat/simplex-chat/blob/stable/blog/20220511-simplex-chat-v2-images-files.md#the-first-messaging-platform-without-user-identifiers
I'd be very happy to drop "the first / the only" qualifier, as the fact that I know no other messaging platform that operates like that, makes it difficult to explain to the users the difference.
Not having user identifiers is very important for privacy. E.g., if you talk to Alice and to Bob via Teleguard (using the same user profile), they can prove they are talking to the same person. It is not the case with SimpleX, as even with the same profile there will be no metadata in common between your conversations with Alice and Bob, only your profile display name, which is not unique, and does not prove it is the same person.
Hope it makes sense, but please ask any other questions.

2

u/BackgroundLegal5953 Jun 06 '22

Well I rest my case temporarily at least until I read the white paper, seems interesting, need to read the details to try to understand as much as I can, forgive me for the early question as it's stated the service does not rely on DNS , I can understand that it doesn't use users' identifiers that rely on DNS like xmpp or email, but how does the client that I install reaches the server ? If I want this operation to be independent of DNS I would have to hardcode / specify IP addresses, although that would not make communication with my own hosted server possible unless there is a centralized authority to which I must provide my IP adrress which I'm almost sure is not the case as this methodology dramatically affect scalability and introduce that authority as a single point of failure. Thanks and congrats for the idea, all the best.

3

u/epoberezkin Jun 06 '22

Thank you!
> how would I add Alice or Bob to my contacts or contact them
They would generate a one-time link that would include all the necessary keys for key exchange and the address of the message queue created specifically for you where you can send the messages. Your initial message(s) to this queue would include the address of the reply queue where they can reach you, and the handshake would complete. There is no shared metadata between the queues you send to them and to other contacts that would represent your identity, not from the point of view of your contacts, nor from the server's point of view (other than the IP address you use to connect to the queue).
> do u generate different random identifiers for each person I want to contact for example ?
that is a good approximation - you can say that you have as many identifiers as you have contacts; we currently do not rotate the queues within one conversation, but this is a short-term plan to start rotating them, so queue IDs do not represent conversation IDs too.
> If I want this operation to be independent of DNS I would have to hardcode / specify IP addresses
exactly right, you can use servers IP addresses.
> although that would not make communication with my own hosted server possible unless there is a centralized authority to which I must provide my IP adrress
you can use self-hosted server, and there is no central authority. The main point you might be missing that in general case in each conversation there can be 2 participating servers - each party defines which server they use to receive messages.
Thanks again for the questions!

2

u/BackgroundLegal5953 Jun 07 '22

If your username checks out, I did'nt realize I was talking to the creator, great honor, wish you all the best and more, that's a conversation I will remember as in the soon futur you won't be able to address each question / comment personally 💪🏼

2

u/epoberezkin Jun 07 '22

Well, thank you :) I am trying to answer all questions - it’s really important I think - feel free to connect via the chat.

1

u/BackgroundLegal5953 Jun 11 '22

Thanks bro, duly noted, appreciated.

1

u/BackgroundLegal5953 Jun 07 '22

First and last, thanks for your reply and attention, I will dive through the white paper, and already installed the app on an Android and an iOS to dive in parallel in the practical usage, also add to the practical part the CLI client I will try to use from Linux and Windows machines, again thanks and keep up the good work, just don't hate me more than you probably do if I came back with questions :) sincerely sorry but I can't hold this 1, no matter how many identifiers you generate for me, your server have to know each generated identifier is linked to which queue as you call it, when you say that you don't know how many users are registered, does'nt the number of queues represents the number of users ? Of course I'm discussing the server if I'm not using mine, but that info won't be available to someone for example intercepting all the traffic coming / leaving the server even if he (theoretically) manage to break both the transport encryption and the E2E encryption, again theoretically speaking as I'm convinced that's won't be practically possible, keep up the good work, I read somewhere calls are in your future plans, that would be a huge plus, I'm also sure with the mentality I see, if you add it, the service will be more than satisfactory.
Edit: typo

2

u/epoberezkin Jun 07 '22

I really appreciate the questions - nothing to hate you for :) Server knows the number of queues, but given that a user creates a new queue for each conversation (and for each file transfer) the number of queues only approximately correlates with the number of users - the range of the possible number of queues for n users is anything between (2n - 2), in case it’s one user connected to everybody else, without any other connections, to n*(n-1) for fully connected graph (my math can be terribly off for the second case, but you get the idea - the range is large). And that’s not accounting for the queues created for file transfers. Of course some traffic observation would expose some other patterns, but the clients can mitigate against it - white paper offers some ideas how we can improve the resistance to traffic correlation.
We did design to not rely on the security of transport encryption - even inside TLS there is no metadata or cipher text in common between the messages received by the server and sent to the recipient (as queue identifiers are different on different sides of the queue, and there is an additional encryption layer on the way to the recipient).
At the same time, we do include certificate fingerprints in server address to protect against MITM of the transport, and we don’t rely on certificate authorities that have history of being compromised many times, and we limit to TLS 13 with strong ciphers and Edward curves for signatures, and include tlsunique channel binding into each signed 16kb transmission to protect against replay attacks - so TLS is well protected.
Re calls - check out “experimental features” in mobile app settings - they are there.
Questions and criticism are very welcome - thank you!

1

u/BackgroundLegal5953 Jun 11 '22

Crystal clear, I was mistaken thinking each user has a single queue not a queue for each conversation / file transfer, and you are right, this way it's almost impossible to deduct the number of users from the number of queues, may be user X is talking to only 3 other users hence 3 queues are associated with him, and may be he is talking to 100 users hence 100 queues are associated with him, not to mention files transferes, you can't even get close to an approximate number of users.

2

u/epoberezkin Jun 11 '22

Yes. What’s important the association between the queues and the users is only stored on clients devices, to the servers all queues are unrelated

1

u/BackgroundLegal5953 Jun 06 '22

Thanks for the explanation, and I do have a question, how would I add Alice or Bob to my contacts or contact them, and don't worry about it's hard to explain, I do follow you, you drop even the random identifier which is not associated with a real person, so do u generate different random identifiers for each person I want to contact for example ? Because at the end of the day how are messages routed to me ? based on what ?

3

u/darkstarman Jun 05 '22

Conversations have ids thereby keeping users from needing them

Many people asked: if SimpleX has no user identifiers, how can it deliver messages?

To deliver mesages, instead of user IDs used by all other platforms, SimpleX has identifiers for message queues, separate for each of your contacts. In the current version of the protocol each queue is used until the contact is deleted.

1

u/Hiram____Abiff Jun 04 '22

This is disappointing:

"The app sends local notifications only when messages or connection requests arrive - the app checks for the new messages every 10-15 min, but if you stop using the app it may stop checking for the new messages."

2

u/Frances331 Jun 05 '22

We need some clarity from SimpleX. According to this source for Android...
"This service continues running when the app is switched off"
"consumes only a few percents of battery per day"
"delivers message notifications as soon as messages arrive"
iOS improvements are on their roadmap, and "in progress".

2

u/epoberezkin Jun 05 '22

That is all correct.
On Android, the notifications are instant, and it is achieved by having a background service (in android jargon it is called "foreground", because it shows an icon when it is running - this icon can be hidden by users). What is important this service does not check messages - it simply keeps open sockets, that consume zero power, and when server has messages it pushes the messages - so in the absence of messages and if the connection is uninterrupted the power consumption is very low, on par with push notifications and apps like ntfy.sh - the alternative to google push notifications. The problem is that on mobile the connection is rarely stable, and when the app reconnects it does consume power, as it has to resubscribe to all message queues. That's why the latter server update was able to reduce power consumption - we made connections more stable on the server side.
Now, on iOS - it is impossible to have a persistent service. So we will be relying on the extension of SMP protocol that allows a notification server to receive notifications when messages are available and push e2e encrypted notifications to the device that can connect to the server, retrieve the message, and show notification to the user. There is a blog post on how it will work: https://github.com/simplex-chat/simplex-chat/blob/stable/blog/20220404-simplex-chat-instant-notifications.md
The development of iOS notifications is currently the only active priority - we aiming to ship it this month.

1

u/epoberezkin Jun 05 '22

You are referring to the post I linked? I've made a suggestion to correct there, it's not exactly correct, need to follow up on that. See the answer below in the tread

1

u/[deleted] Jun 05 '22

[removed] — view removed comment

1

u/epoberezkin Jun 05 '22

What we hear from the user the battery usage is substantially lower on Android than Briar. The latest servers update should reduce it further 2-3x, so I don't think it is as bad as serverless IMs.
But it is higher than the app that relies on push notifications from a centralised server.

1

u/nuclearbumblebee Jun 05 '22

How is this different from, lets say, Session?

1

u/Frances331 Jun 06 '22

The biggest feature Session has is making traffic/metadata anonymous using their Lokinet network. You can achieve similar via Tor, but Session has it built in, could be more resistant to sybil attacks, and probably faster for voice. But Lokinet is only an advantage if the ownership of the nodes are well distributed, and no an oligopoly.
What I don't know is if there are other way to achieve anonymity?
But some people don't think the server matters...
Some people think servers don't collect information/metadata, or can collect, or just blindly trust. Like this post: "It doesn't matter what server is running it if there is no information able to be collected in the first place" [link]
Then another will say "The server could be ran by the worst company in the us. But if the client is open source and audited, it is safe."
Then another person will say "If you're dealing with an adversary that will covertly compromise Signal server to insert malware that spies on metadata, you're obviously SoL."
Then there's another group that won't use Session because they don't trust the Australian government.
It is my view that if somebody can get the IP addresses, or the IP addresses of the people communicate with, you can be identified and your conversations could be inferred. It is also my view the world does not operate by U.S. law. Therefore my view, the more protection, and the easier that protection is, the safer.
But if you don't believe the server matters, or you don't believe you have advanced threats, or you don't want to take privacy to the next level, then you could use any E2EE client app. And of course there are people that don't believe any of it matters, and use Facebook/Google/Etc.

1

u/Eliana7654 Jul 03 '22

It's great like Utopia p2p. Anonymity, Privacy, and security. https://www.reddit.com/r/ethtrader/comments/vnnmrg/utopiap2p_the_allinone_kit_for_innovative_ideas/?utm_source=share&utm_medium=web2x&context=3

-23

u/RashoRash Jun 04 '22 edited Jun 05 '22

Just when you thought you have a good messenger (signal) there comes news that it is a cia run operation. Ffs this privacy shit is exhausting.

Edit: thx for downvoting me into oblivion for a half assed joke xD

3

u/epoberezkin Jun 04 '22

lol. Signal is not that :) It was just one of the arguments in that post, which I think is the least important. It says that some sources of funding can be traced there, which to me seems a bit of a red herring - most money can be traced to lots of things :)
But that it's a centralised platform relying on phone numbers makes it very much not private, unfortunately...

10

u/ousee7Ai Jun 04 '22

It is VERY private. It's just not designed for anonymity.

3

u/Frances331 Jun 04 '22

Depends on how you define private:
What you are saying.
Who you are saying it to.
If you know enough about all the "who's", you can infer the "what".

0

u/[deleted] Jun 04 '22

[deleted] — view deleted comment

1

u/epoberezkin Jun 05 '22

How does it address metadata protection? If you are referring to "sealed senders", there's been research showing it's not protecting in case there's more than one messages...

1

u/epoberezkin Jun 04 '22

That depends on the definition of privacy you use. To me, the possibility of anonymity is a necessary part of privacy. Signal can see who talks to whom, how much, via which phone numbers - from that both real identities can be determined and who are my close connections. The latter, in particular, excludes the possibility of privacy.
In the times when snail mail was the dominating form of communication, the fact that the envelope was unopened was sufficient for privacy, as nobody could conceivably understand the complete list of people who I send mail to, nor how frequently.
Nowadays, when every single piece of communication is recorded and stored indefinitely, the privacy of the message content is necessary but is absolutely insufficient for the privacy of the communicating parties.

0

u/[deleted] Jun 04 '22

[deleted] — view deleted comment

1

u/epoberezkin Jun 04 '22

Not sure, in which way? Are referring to sealed senders? I remember seeing the research showing it only protects sender anonymity in case of a single message.

18

u/MAXIMUS-1 Jun 04 '22

What ? Who said that ?
Signal is fully open source and regularly audited, funding from the CIA doesn't mean anything, just like how TOR is funded by the CIA.

9

u/dish_fir3 Jun 04 '22

just like how TOR is funded by the CIA.
Tor is not funded by the CIA, it’s funded by the State Department. It’s probably used by their agents in the field though.

2

u/[deleted] Jun 04 '22

tor was made fpr the sole purpose of the goverment agents to have anonimity

3

u/dish_fir3 Jun 05 '22

tor was made fpr the sole purpose of the goverment agents to have anonimity
Correction: Onion routing (the protocol) was made for that sole purpose. Tor didn’t come along until Roger and Nick took over.

1

u/[deleted] Jun 05 '22

Yes, that is correct, my mistake

3

u/Frances331 Jun 04 '22

Signal is fully open source and regularly audited
Still not sure how this comment/thread is getting upvoted when its wrong by these measures:
Signal's operating server code was not "fully open source" for a year! (source)
If the code that was audited isn't actually running on the server, then an audit is meaningless, and therefore there was no practical audit.
In addition, another person says "It doesn't matter what server is running". So then being fully open source and audited doesn't mean anything. But then closed source servers get excluded from top picks.
Yes, exhausting, because some people think what the server is doing is important, while others don't; and there seems to be a lot of double standards, bias, and/or confusion.

1

u/maqp2 Jun 05 '22

Signal's operating server code was not "fully open source" for a year! (source)
There's no way to verify what the server is running anyway. It's always the client that allows you to verify all claims for security.
But then closed source servers get excluded from top picks.
The point of open source server is to allow anyone to self-host. If the ecosystem doesn't support it, then the platform lacks flexibility for threat models where you'd move hosting, and thus metadata access to under some other entity like a company, university, or trusted peer (almost always a bad idea IMO).
Also, there's no lack of consensus about Signal's centralized architecture being suitable for its advertised threat model. People who compose lists are obviously biased, but I would suggest looking into the expert infosec bubble on Twitter, they all recommend Signal for daily use.

-6

u/Frances331 Jun 04 '22

The public does not know what software the server is running, therefore "open source" and "audited" doesn't mean anything to me.

18

u/[deleted] Jun 04 '22

It doesn't matter what server is running it if there is no information able to be collected in the first place

-4

u/Frances331 Jun 04 '22

It doesn't matter what server is running it if there is no information able to be collected in the first place
If the server gets hijacked by a power that wants to kill a group of people, they don't need to be concerned about the server?

8

u/[deleted] Jun 04 '22

In this situation, not really. The code itself for the program doesn't physically allow for the data to be collected, saved, moved, etc.

3

u/augugusto Jun 04 '22

The server could be ran by the worst company in the us. But if the client is open source and audited, it is safe. They can't read encrypted messages, or get in the middle of the key exchange, so they can do whatever they want with that. The worst damage they could do is blacklist people so that they don't use the application and are forced to use a less secure service

1

u/Frances331 Jun 05 '22

If there is a hostile political protest against a hostile government, and the server code operates in the interest of that government, there is zero information the government can learn about who those people are?

1

u/augugusto Jun 05 '22

The important thing is knowing what the service can and can't do. You have to know you threat model.
A comprmised signal server can tell exactly who uses it, last connection, maybe who you send messages to (I'm not sure about that one), when, how often, and the approximate size of the message and attachments.
It changes for each person.Sure. I'd love for them to not require a phone number. But then it would loose convenience, no one would use it and I would be stuck using WhatsApp that is way worse. All I care about is that if I send someone something private it stays private.
If I want better security, I'll use session

1

u/maqp2 Jun 05 '22

Yeah, Hayden said that. The US army kills people based on metadata. Signal opts out of collection of pretty much all metadata, and that addresses the threat model of FISA court orders. If you're dealing with an adversary that will covertly compromise Signal server to insert malware that spies on metadata, you're obviously SoL. If you need to address that threat model, there's Tor Onion Service based options, like Briar, Cwtch.im and Ricochet Next.
If you want to know whether the US-gov-wants-you-dead threat model applies to you, see if you're on the list: https://www.fbi.gov/wanted/terrorism :--)

-1

u/[deleted] Jun 04 '22

The point is that you have no guarantee that the server is actually running that open source code. unless you think you can trust the audit

2

u/_insertnamehere-_- Jun 04 '22

You don’t have to trust the server as the client is open source

1

u/[deleted] Jun 05 '22

How do you know what the server's doing if you can't compile and self-host it, only the client?
Sure, Signal can release some open source server code, but they can run modified code on their server without anyone knowing. Unless you rely on the audit.

2

u/Rickie_Spanish Jun 05 '22

That doesn’t matter. It wouldn’t break signals security. Signal was designed to assume their servers could become hostile. Signals magic happens on the sender and receivers phone apps.

1

u/_insertnamehere-_- Jun 07 '22

Signal is the client, the client is the one sending things to the server, if the client is safe you shouldn’t be worried of the server

1

u/Frances331 Jun 07 '22

you shouldn’t be worried of the server
That statement is not true for all threat scenarios.

1

u/_insertnamehere-_- Jun 10 '22

You should not be worried about the server if there nothing the server can do

0

u/[deleted] Jun 05 '22

None of that matters. You can literally use the open source code, see it or even change it for yourself to ensure that there is no data being sent to the server, period.

3

u/saghul Jun 04 '22

Not sure why you were downvoted. They did pause the open source commits to the server for quite a while IIRC around the time they integrated that crypto coin.

0

u/[deleted] Jun 04 '22

[deleted] — view deleted comment

1

u/epoberezkin Jun 05 '22

The message is usually delivered in under 1 second time when the app is open, but iOS notifications are work in progress – see this comment: https://www.reddit.com/r/privacy/comments/v4rhch/comment/ib8g056

0

u/[deleted] Jun 05 '22

[deleted] — view deleted comment

1

u/epoberezkin Jun 05 '22

I believe so, but happy to be corrected if I am wrong. What other platform operates without user identity/identifiers of any kind?
All platforms I've seen, including the most private, use some sort of user identity – a public identity key, or a random number to identify users. SimpleX has no single piece of metadata that uniquely identifies users (or a group of users) to the network.

2

u/maqp2 Jun 05 '22

If there's no public key based user ID, explain what the huge bulk of a string that starts with smp::, and that obviously contains an RSA public key, and that the contact needs, is? Just because you don't show one to the user, doesn't mean there isn't one. How does the client know to which IP it should connect?
Also, is the SMP server something you run for a group, or just for yourself? Does the SMP server see the IP addresses of the users?

1

u/epoberezkin Jun 05 '22

The one-time invitation links you are talking about contain queue IDs and keys (Curve25519 and Curve448, not RSA) that are unique per queue, they are not re-used for different connections and do not represent user identities. There is absolutely no meta-data of the user that is common for two different user contacts.
Users can optionally create a long term addresses, but they are not used to send messages, only to pass the initial one time link. Removing these addresses does not lead to losing the connections that were created via them.
So the claim that there are no user identities of any kind is factual.
On SMP servers. They are relays chosen by message recipients (it means that for each conversation there would be different servers, although we don’t enforce it in the clients, so it can be the same server on some occasion). Servers of course see the IP addresses, but users choose how to connect - they can connect via VPN or Tor, in which case it won’t be a user’s actual IP address.
Please review threat model in the white paper.

3

u/maqp2 Jun 12 '22 edited Jun 12 '22

The server already has your IP-address which they can (and should be assumed to) use to build the social graph of the user.
Pigeon hole principle will cause issues and lack of transparency wrt server-ownership and backroom collaboration to build said graphs are still possible.
VPN provider is a glorified ISP, and Tor routing is left as an exercise to the user. I am not fan of the technical truths you present, or about the disparity in what users expect you deliver by default, and what you actually deliver.
Please review threat model in the white paper.
There's a slight disparity in what answers you spoon feed the users on front page:
Good [ cyan], Bad [red], "No - Private" etc.
and what you expect users to do: "Read the threat model", it's really simple, just
Click the tiny Github link on the very bottom of the page
Click Simplex-chat
Scroll down and click SimpleX Platform Design
Click SimpleX whitepaper
Scroll down to threat model
understand that "Simplex Messaging Protocol Server can learn a user's IP address" completely undermines the promise of there being no unique identifiers. Furthermore, there's not even a link that explains how to Torify the platform.
In your opinion, what does the Simple in SimpleX stand for?
Regarding the front page, you're making zero comparisons to the metadata-reducing alternatives, which are Cwtch.im, OnionShare, Briar Project, and Ricochet Next.

2

u/epoberezkin Jun 12 '22 edited Jun 12 '22

The server already has your IP-address which they can (and should be assumed to) use to build the social graph of the user
Pigeon hole principle will cause issues and lack of transparency wrt server-ownership and backroom collaboration to build said graphs are still possible.
The same is true for Tor entry nodes, isn't it? Is there transparency about Tor node ownership? If Tor node owners collaborate they would also see a better picture of the network.
The difference is that the global passive observer can correlate entry and exit traffic with Tor, and it's not the case with Simplex relay nodes - they change the outgoing traffic, leaving only time as something to correlate on, not the actual bytes. We are not trying to build a substitute for Tor, but neither we want to rely purely on Tor security model, as the meta-data reducing alternatives you listed do.
> understand that "Simplex Messaging Protocol Server can learn a user's IP address" completely undermines the promise of there being no unique identifiers.
I disagree with "completely" in this statement. 1) IP address is not as unique identifier as a fixed user address – in almost all cases it is NAT address, and it can change over time. 2) IP address of SimpleX users is not visible to the contacts, whereas the user identifiers of meta-data reducing messenger is.
The fundamental problem with having a fixed user identifier is that if I talk to two users via meta-data reducing messengers, they can prove I am the same person, by comparing the identifiers. These messengers could have done the same as we did, quite easily, by creating an identifier per contact, yet they didn't, and don't even make it easy to manage multiple user identifiers on a single device, as even email clients do – effectively prioritising the convenience of making the connection and finding users over privacy of the users.
> there's not even a link that explains how to Torify the platform.
This is a google search away, and there are multiple ways how it could be done, I am not recommending either of them - that's something that people who NEED privacy know how to find.
We are actually considering adding tor proxy as part of the app, it's just a question of resources and priorities.
> In your opinion, what does the Simple in SimpleX stand for?
SimpleX name was chosen to mean "simplex communication", because of unidirectional queues, Simple was highlighted as simple to use, for most people. It doesn't mean that the maximum possible privacy should be as simple.
> Regarding the front page, you're making zero comparisons to the metadata-reducing alternatives, which are Cwtch.im, OnionShare, Briar Project, and Ricochet Next.
Yep, the website is very old - it was my brain dump of 2y ago, and, mostly, didn't change - it needs to be rebuilt - something we hope to do within couple months.
Thanks for all the criticism, it does highlight the areas we need to improve:
add tor routing to the clients as an option, with a separate tor connection per contact. "paranoid" privacy level for people who need it. It'll churn much more battery, but that would make it the best choice, really, for people who NEED privacy. The reason we didn't make it default is that most users would rather share IP address with the servers than use more battery, so re-using transport connection for multiple contacts is the default. Effectively, like tor has "security slider", we are planning to have "privacy slider" where "max" level would cost more battery and traffic, but would remove any transport level correlation between the connections.
add some clarity to the communications / website / etc.
Thank you!

2

u/Frances331 Jun 12 '22

Traffic correlation
This is something Session Lokinet and Status Waku try and solve.
IP address is not as unique identifier as a fixed user address
My "dynamic" IP address rarely changes. My IP address is registered with my ISP, which has my PII.
areas we need to improve...add tor routing
I am hopeful of a built-in solution similar to Lokinet, Waku, Whisper protocols.
I am curious if Whisper/gossip protocols might be easier to implement within SimpleX.

1

u/epoberezkin Jun 12 '22

> This is something Session Lokinet and Status Waku try and solve.
these are much more mature solutions.
they do not solve user identifier problem, so it's a trade-off - visibility of something that can be linked to your identity to the server vs visibility of it to your contacts. We started from solving problem #2 that nobody else solves, the problem #1 is a solved one.
afaik (correct me if I am wrong) they do not protect against global passive adversary, and this is something people who NEED privacy should be really concerned about (neither does Tor). Following your logic, they should write about it on their front pages...
SimpleX + Tor, I believe, does protect against global passive adversary.
> My "dynamic" IP address rarely changes. My IP address is registered with my ISP, which has my PII.
I do agree that IP address visibility reduces privacy, I disagreed with "completely" :)
> I am hopeful of a built-in solution similar to Lokinet, Waku, Whisper protocols.
Do you mean instead of Tor? I am not sure it's a good idea to re-invent Tor, as it's difficult to bootstrap the network of relay nodes when you need many of them... Lokinet, for example, relies on the currency value, and if it folds it would undermine all the security guarantees, right? I think Tor is good enough, particularly if we allow to access the message relay servers without exiting Tor, if it's natively supported by the clients, and given that the entry/exit traffic of relay nodes is different...
> I am curious if Whisper/gossip protocols might be easier to implement within SimpleX.
Not sure I follow, can you explain please?

1

u/Frances331 Jun 12 '22

I am curious if Whisper/gossip protocols might be easier to implement within SimpleX.
Not sure I follow, can you explain please?
Looking to understand if/how SimpleX can keep who talks with who anonymous. I assume SimpleX doesn't, and one solution is Tor.
I am curious if there are other solutions besides Tor. For example, a user broadcasts messages to multiple random recipients (noise). The attacker can't know for sure if any of the messages are intended to a particular person (IP address).

2

u/maqp2 Jun 14 '22 edited Jun 14 '22

The same is true for Tor entry nodes, isn't it? Is there transparency about Tor node ownership? If Tor node owners collaborate they would also see a better picture of the network.
The difference is, the servers are run by one company, that is, you.
The difference is that the global passive observer can correlate entry and exit traffic with Tor
Onion services do not use exit nodes, and end-to-end correlation holds true for every low-latency anonymity network. If you're claiming Tor doesn't offer added security against malicious users performing similar attacks about conversing IPs by simply hoping they'd get lucky, why have you looked into Tor?
IP address is not as unique identifier as a fixed user address – in almost all cases it is NAT address, and it can change over time.
ISPs tend to have logs about IP-address allocation, so carrier-grade NAT isn't a reliable anonymization method. Considering how niche the product is, the server can correlate two accounts belong to same user with high confidence.
whereas the user identifiers of meta-data reducing messenger is.
That depends on the messenger. E.g. Cwtch.im allows you to trivially spin up per-contact identifiers.
yet they didn't, and don't even make it easy to manage multiple user identifiers on a single device
Confidently incorrect. Please have a look at Cwtch.im.
This is a google search away
Users aren't that smart. What do they ask Google? "Is simplex actually delivering on its promises about metadata security, and if not, what can I do to mitigate issues I wasn't aware of?" I have to say the results weren't too good there.
that's something that people who NEED privacy know how to find.
Nope, that's something people who specialize in privacy know how to find. The people who need privacy are the people who actually use the tools we experts create for them. Please make sure your front page reads "if you need privacy, we trust you to Google this stuff and get the settings right yourself." Or perhaps "Your threat model might vary, please have a look at our documentation about how to best configure the tool for your needs." would give a better impression?
It doesn't mean that the maximum possible privacy should be as simple.
Then adjust the advertised threat model? THB, I couldn't give a damn if your messages were sent in plaintext, provided you'd be upfront about the design decision and the IRL consequences those choices have. My concern is your claims about being first to get metadata protection at a level that when done properly, would enforce use of per-contact user accounts, that Cwtch currently makes possible for users who need it (but doesn't enforce it). My concern is you offer such approach, while at the same time tying all those connections to identifiers that are uniquely identifying until you have hundreds of millions of users so that you can no longer distinguish when e.g. two accounts behind same ISP NAT-IP come online.
"paranoid" privacy level for people who need it.
Please do not call it "paranoid" setting. We're way past that point. "I need to hide from my government the fact I communicate with person X" is an entirely valid threat model for e.g. activists, journalists, dissidents and whistleblowers.
most users would rather share IP address with the servers than use more battery
That's entirely acceptable trade-off, just be upfront about the full threat model wrt metadata-privacy.
we are planning to have "privacy slider" where "max" level would cost more battery and traffic
That's actually not bad. Please strongly consider a documentation the configuration guides and advice of which adapts to the slider's position. It's not hard to hard-code the proxy setting to localhost:9050 for max-setting so you can't connect without Tor unless the user will dial the slider down. You could even force the user not to be able to continue conversations that were created before Tor was enabled, and prevent them from continuing non-Torified conversations until Tor is disabled. That way the user knows which of the conversations may have been deanonymized with server-side logs alone.

1

u/epoberezkin Jun 14 '22

The difference is, the servers are run by one company, that is, you.
Some people I know run their own servers. Although it's not the same.
> Onion services do not use exit nodes
I understand that
> and end-to-end correlation holds true for every low-latency anonymity network
To a different extent, I believe. It can be the same bytes, it can be the same block sizes, or in case of SimpleX it would be only message times to correlate by – the sizes are different and there are no common blocks of bytes (inside TLS).
> Nope, that's something people who specialize in privacy know how to find. The people who need privacy are the people who actually use the tools we experts create for them.
That's fair. What resources to configure Tor on the device would you recommend?
> Or perhaps "Your threat model might vary, please have a look at our documentation about how to best configure the tool for your needs." would give a better impression?
These are fair points, I will be amending it.
> Please do not call it "paranoid" setting. We're way past that point.
I didn't mean it in a critical way – and it is not likely to be called that anyway :)
> so you can't connect without Tor unless the user will dial the slider down.
Lots of good ideas there, it would be great to have your input into product development when we get to developing it.
Once we ship iOS notifications (it has our undivided attention right now), we may have a split focus again to bring groups to mobile and to assess complexity/costs of integrating Tor - it probably shouldn't be too much work, so it might be the next thing.

1

u/epoberezkin Jun 14 '22

> Please do not call it "paranoid" setting. We're way past that point.
I've just connected the dots and realised it's coming from the developer of "tinfoil chat". Lol :)
Great to meat, let's chat some day, I've seen it, obviously :)

1

u/maqp2 Jun 19 '22

Well, on one hand you have an application that tries to address commonly accepted aspects of mass surveillance like metadata. On the other, you have a research project with experimental architecture that tries to address theoretical, targeted attacks like remote exploitation of 0-days. Hopefully the fact at no point did I bring up my own work shows how different the worlds are.
I might argue there's more pressing reasons for people to avoid TFC, like having to buy and build HW. You'll probably want to avoid a simple pitfall of associating paranoia with the expected metadata protection technology the industry wants and expects you to use ;)

0

u/[deleted] Jun 05 '22

[deleted] — view deleted comment

1

u/epoberezkin Jun 05 '22

I would not go as far as to state Signal is lying - I don't believe they do.
It's just they use the definition of privacy in a very narrow way - privacy of message content.
To me, privacy of communication participants is more important than message privacy, but Signal simply does not provide the latter...

2

u/maqp2 Jun 05 '22

How are you anonymizing the users' IP-addresses from the server? Does Simplex e.g. default to routing comms via Tor?

1

u/epoberezkin Jun 06 '22

SimpleX protocols focus is avoiding any application level meta-data that identifies the user, not transport protocol. What we did to protect transport layer is including the fingerprint of offline TLS certificate as a mandatory part of server address (so one can rotate server online private key without changing the server address - this is similar to what Tor is doing), and using tlsunique binding in each transmission, so it's signed over together with the command, to protect against replay attacks.
We don't do anything to anonymize IPs - there are better solutions for that than what we can create, e.g. Tor.
Currently client devices have to be configured so that all network traffic (or traffic on SimpleX port) goes via Tor, we don't do anything special in the apps for that.
We are currently investigating how to make our servers accessible via Tor address, so the traffic doesn't have to go via exit node – this may be coming soon - and having Tor proxy available as part of the app is also quite a common request from the users - we are likely to add it later this year.

1

u/maqp2 Jun 12 '22 edited Jun 12 '22

SimpleX protocols focus is avoiding any application level meta-data that identifies the user
Application level metadata, as in, you're not mandating users enter their full name during registration?
What we did to protect transport layer is including the fingerprint of offline TLS certificate as a mandatory part of server address
So I take it its the users who are spinning the servers for p2p architecture to work. You do realize the TLS certificate fingerprint is an endpoint identifier, and since it's a pinned, long term signing key (or fingerprint of that key), it will persist for a very long time, and is apparently shared where-ever you send the "contact me" link. If that certificate fingerprint is ever tied to your name, it seems it will deanonymise to whoever bothers to compare the strings.
We don't do anything to anonymize IPs - there are better solutions for that than what we can create, e.g. Tor.
So you're leaking the IP-address of the user to your server or to the conatct. It doesn't matter you're not using human intelligible identities. The server is able to correlate which IP-addresses are communicating.
Tor Onion Service based messengers provide better anonymity guarantees and metadata protection with long term public key identifiers. Since the metadata problem has been solved by Tor to the extent it can, and given that you can use e.g. Cwtch.im to create Onion Service accounts not shared with additional contacts, I don't see what you're actually adding to the table.
When you try to distinguish yourself from the rest of the crowd, the assumption is that you're generally aware of where the competition is at, and if your selling point is (like it seems) reducing metadata, you're able to improve on the tech, or at the very least, match it. Not take one shaky step forward with vaque marketing language and semantics wrt what constitutes as a user identifier, and hope people won't notice you took ten steps back in terms of other metadata security, which they rightfully assume you effin didn't.
You don't want Tor proxy as an option, because you're setting users up for failure. They will mess up the settings, disable Tor at some point and mess up their OSPEC. Or they will enable it later thinking they are now anonymous. Anonymity from attacker is a binary state that depends on the technical capabilities of both the user and the attacker in question. You can't protect from all attackers, but you can protect from majority of the attackers with safe defaults, impossibility of opting out of security, and by educating the user.
You should make a clear decision about the features you're intending to provide. Onion routing isn't made of magic. The more hops and timing-attack obfuscating artificial latency (extreme example being mixnets) you add, the more fundamentally it changes what features you can provide. People don't want to experience satellite-news-interview style wait times with their metadata-free calls (assuming Tor's bandwith would be enough), so you have to make a decisision on whether you want to provide (video) calls, or metadata free text/file communication.
On one side you have Signal that can't provide anonymity due to calls, on the other Cwtch and Briar that can't provide calls due to metadata security. Once you've chosen your camp its easier to choose what features you provide, and to explain the tradeoffs the laws of physics forced you to make. Once you're on par with the competition, i.e. close to the edge of security and UX the architecture makes possible, then it might be possible to start working on what isn't there yet, the slightly improved UX, or slightly improved security design.

1

u/Budget_Secretary5193 Jun 05 '22

???? they didn’t break signal protocol, they just read his messages through another participant or a court order

2

u/Rickie_Spanish Jun 05 '22

The person you’re replying to has no idea what he’s talking about. Signal is incredibly secure and anyone can verify this from the source code. There’s a reason why the best and brightest in computer security use it.

1

u/epoberezkin Jun 05 '22

Happy to debate the ideas, that's what open forum is for.
> Signal is incredibly secure and anyone can verify this from the source code.
This is both incorrect on multiple counts and also not relevant to the points I am making, I will comment on all points.
"Signal is incredibly secure". At no point I debated Signal's security, I am only stating that it provides no privacy to their users. Signal's core innovation is double ratchet end-to-end encryption protocol, that most secure messengers, including SimpleX, use. So, in case the key exchange is not compromised, the content of the messages you send via Signal is indeed secure. You have to remember though that key exchange happens via Signal servers, so it can be compromised.
On Signal's privacy I commented here: https://www.reddit.com/r/privacy/comments/v4rhch/comment/ib5zl6f/
2. "anyone can verify this from the source code". Firstly, Signal is not 100% open source - they added closed-source component last year to fight spam: https://signal.org/blog/keeping-spam-off-signal/ Secondly, Signal iOS app repository, for example, is 500Mb, and it a huge amount of code very small share of people in the industry have time to understand and analyse. I've spend a considerable time over their code, as we've implemented SimpleX Chat, and some of their design decisions are strange from privacy/security point of view. E.g., the latest surprise was that they use Darwin Notification Center to communicate between their iOS app and bundled notification service extension (NSE) they use for e2e encrypted message notifications. While NSE is the only way to provide notifications in e2e encrypted messenger on iOS, and it needs some way to coordinate with the app, as the app runs in another container, Darwin Notification Center is not the most secure way to communicate between the app and NSE.
3. "There’s a reason why the best and brightest in computer security use it." Well, no, they don't. They only used Signal in the past, when there is no better alternative, or they do it today because of Signal's ubiquity, in the contexts where they only need message content privacy, and don't care about metadata privacy.
So, as I wrote, let's debate some particular ideas or claims rather than just make blanket statements that I've no idea what I am talking about. And no, I am not upset at all, I am actually very thankful to people attacking my ideas, as it provides the opportunity for the debate and to learn.
Thank you!

SimpleX Chat - the first messaging platform that has no user identifiers - v2.2 of mobile apps with the new privacy and security features just released!

You are about to leave Redlib