Ricochet-IM: Anonymous, decentralized, metadata-resistant instant messaging

Re:Ricochet-IM: Anonymous, decentralized, metadata-resistant... by DyslexicAtheist on Sunday January 13, 2019 @04:00PM (#18898659)

I'd never accept a request from a random user. My workflow would be like this: agree to discuss on signal or via pgp, which you use to get the ricochet-ID from the person that intends to connect with you. Once they tell you their id via this out of band channel, it's easy to reject any other requests that you don't expect. My ricochet-id is public knowledge now.

But say you're a journalist who wants to protect their source (on your end) e.g. a total stranger who is going to tell you some secrets then no need to even have a contact list. No need for a history. You just use the ricochet-id once. Maybe in a short-lived VM, Qubes or Tails whatever ... And tear down the whole system anyway once I'm done with the chat.

So in the first case you can simply avoid spam with boostrapping a safe rendezvous point, the second case would never see any spam.

[ Parent | on HN ]

Re:Ricochet-IM: Anonymous, decentralized, metadata-resistant... by jstanley on Sunday January 13, 2019 @04:04PM (#18898674)

I deliberately publish my Ricochet ID (ricochet:it2j3z6t6ksumpzd) and accept most requests from random people. It's led to mostly people who add me as a contact then close Ricochet before I reply and never open it again, a large handful of fun conversations with interesting people, and a couple of weird conversations with crazy people :).

[ Parent | on HN ]

Re:Ricochet-IM: Anonymous, decentralized, metadata-resistant... by samatman on Sunday January 13, 2019 @11:49PM (#18900745)

Sadly not scalable, but one of the great pleasures of using early or obscure communications media.

The entire early Internet worked this way and it was lovely.

[ Parent | on HN ]

Re:Ricochet-IM: Anonymous, decentralized, metadata-resistant... by dfabulich on Sunday January 13, 2019 @04:33PM (#18898837)

If you'd never accept a request from a random user, then you're not doing anonymous messaging.

If you're a journalist who wants to receive a message from a total stranger, then you'd have to accept a contact request from a that stranger. Spammers can then deny the journalist access to anonymous requests by spamming them with anonymous requests.

The journalist could try to keep their contact ID a secret, but then anonymous sources would have no idea how to contact the journalist.

[ Parent | on HN ]

Re:Ricochet-IM: Anonymous, decentralized, metadata-resistant... by gye on Sunday January 13, 2019 @07:49PM (#18899747)

Terminology is the single biggest problem here: "Anonymous communication" in CS does NOT mean you do not reveal your identity to the person you are communicating with. It means you stay anonymous from the network perspective: No third party learns with whom you are communicating, and everything you reveal to your communication partner becomes an explicit attribute: Your "identity"/name/nickname, but also your location.

[ Parent | on HN ]

Re:Ricochet-IM: Anonymous, decentralized, metadata-resistant... by DyslexicAtheist on Sunday January 13, 2019 @05:27PM (#18899112)

>If you'd never accept a request from a random user, then you're not doing anonymous messaging.

as mentioned you can use other anonymous channels before you switch to another one such as ricochet. the point isn't to establish authenticity before moving to anonymity but to add a layer of protection that allows you to decide on the rendezvous point and further increase plausible deniability

[ Parent | on HN ]