Tor Messaging

What does your smartphone say about you when it phones home? If you hire security pros to look into it, they can find some information, but only when it's connected to a router for internet. When it's connected to cell towers, it's a total black box and the outbound data can't be read in transit, no matter who you hire. Whatever a manufacturer or developer classifies as "telemetry", which could include screenshots, can be sent to their cloud and used for profiling.

If cell phones are compromised, the first step to take before you can be really private is to use a non-cellular device (practically speaking, a computer on Wi-Fi/LAN). The next step is to pick an app. Signal is regarded as the most secure by people more experienced than I am, and it's available on desktop. However, it has a couple weaknesses that I may be qualified to point out:

›The fact that you use Signal, and how frequently, is known by Signal Messenger LLC and your ISP. This fact is likely harmless on its own. Millions of people use encryption apps.

›However, if you do some messaging on your phone and more private comms on desktop, it is inferrable with AI traffic analysis that you have something juicy to justify the separation. That is something a rogue employee can work with.

This is where Tor (the protocol used for the deep web) comes in. When A messages B over Tor, there are multiple hops and layers of encryption that get peeled like an onion, so that no intermediary has the full context. The association between A and B is invisible.

For private messaging specifically, there are two additional measures we add for security and recognition.

›For security against traffic sniffers, we'll disguise the request as regular HTTPS and obfuscate it so that it looks like common web traffic, rather than an uncommon pattern. The diagram below shows how this is done with open source software like Snowflake and a network of volunteers.

›Additionally, A and B need to recognize each other. Tor, by design, hides the requestor from everybody except the entry point. By default, the destination doesn't know about the source

Check out Briar for Desktop (not my app) if you just need private messaging for close friends and family.

I'm making an app that combines messaging with a profile editor (pfp, bio, posts, pages) and a Monero wallet. Private social + finance, done peer-to-peer over the Tor network. Watch my progress here.