7 ms·

Why not 0xchat? Private key login, encrypted private chats and contacts, encrypted group chats, and lightning payments. Decentralised, built on Nostr. Availabl

Why not 0xchat? Private key login, encrypted private chats and contacts, encrypted group chats, and lightning payments. Decentralised, built on Nostr. Available on all platforms. https://www.0xchat.com/ https://www.0xchat.com/

data_maan 1y ago
0xchat on the surface seems better: looks like a professionally maintained codebase, with clear ways to interact with the devs. But - has there been security audit been done?
rpdillon 1y ago
I think the point here is that everyone has email. A chat client built on Nostr is fine (and I want to love Nostr), but it just doesn't have the reach or ubiquity of email.
- AJ007 1y ago
  When you start looking at alternative messengers outside of Matrix, XMPP, and IRC, there isn't much where third parties can operate or implement both servers and clients. Certainly if no one can implement these two things it is functionally a closed source project. It also is a security failure from the standpoint of control, validation, and also future security and vulnerability patching (there's a graveyard of dead "secure" messaging apps.) Is DeltaChat perfect from a security standpoint? No, but it's certainly well above the hurdle most people are at now. Most people are using non-encrypted communication that is actively scanned & stored, or e2e on paper stuff where one party controls the client, server, application, and storage (trust me e2e security.) Telegram, Discord, Facebook Messenger, stop using that shit.
  - promptdaddy 1y ago
    Apologies for any nativity here, but wouldn't storing encrypted messages on a blockchain be a robust solution for this?
    - heavyset_go 1y ago
      Why would you want that? The last thing I'd want in a secure messenger is a permanent ledger that holds message content and associated metadata which anyone can analyze. edit: I didn't downvote you and I don't think someone asking an honest question like this should be downvoted
  - maqp 1y ago
    >Is DeltaChat perfect from a security standpoint? No, but it's certainly well above the hurdle most people are at now. It's less safe compared to Signal, and Signal is the gold standard recommendations for average Joes. "Better than Telegram" is a low bar.
    - em-bee 1y ago
      telegram is the most user friendly chat out there. the only ones that compete in usability are wechat (yes, the chinese one) and, deltachat. signal just got a bit better by finally allowing me to hide my phone number. of all these, deltachat is the only one that doesn't require a smartphone and a phone number.
      - maqp 1y ago
        >telegram is the most user friendly chat out there. Telegram is a walking time bomb with 900 million users' data waiting to be leaked from the servers. >and, deltachat. That must be why I've never heard of anyone using it. >deltachat is the only one that doesn't require a smartphone and a phone number. It leaks the IP-address to the server, which by default (defaults matter) is nine.testrun.org. That server can amass metadata about users conversing, and any government entity that comes knocking can look at TelCo records about to which user the IP-addr was assigned at the time. If you're going to try to address metadata privacy against service provider, you're going to have address it properly, and DeltaChat isn't the one at that point. Neither is Signal. You'll want Cwtch for that.
        em-bee 1y ago
        nine.testrun.org is owned by deltachat developers. it is about as trustworthy as, say, matrix.org. the only better alternative would be self hosting. the question is not what is the best, most secure, most private, option, but what has the right balance between easy onboarding, ease of use, security and privacy. and maybe deltachat is not the best possible, but it is pretty good. remember, when security and privacy are to onerous then you don't have security or privacy because people will refuse to use the tool.
- lxgr 1y ago
  Nor does Delta. Nobody will “chat” with me via their Gmail email focused UI, so it’s effectively a separate network anyway. Using an email address as an identifier for IM is a great idea (I hate that everything uses phone numbers for this, which are not internationally portable and not possible to reasonably “self-custody” the way TLDs are). But using the actual email protocol as a backing protocol for instant messaging seems like a weird contortion and still makes this effectively a separate protocol, the split being servers that do and don’t support all necessary extensions. The overhead must also be staggering; just look at an email header to see how much is going on for each message these days.
  - em-bee 1y ago
    you got a point with the overhead in email headers. also an email is sent not only for every message but also status updates. that adds up to a lot of emails.
maqp 1y ago
https://github.com/0xchat-app https://github.com/0xchat-app states it doesn't have desktop clients. Also, the direct messages have three types 1) NIP-04 DM: "Most widely used", but also, "not recommended". Reeks of Telegram that also has non-secret chats being the most popular option 2) Gift-Wrapped DM: Uses different encryption algorithm but no forward secrecy? Forward secrecy has been around for 20 years. 3) Secret DM: Can't be recovered on different devices. Why can't the backup be self-contained database like Signal has? Also "Secret chat requires consent from peer." Like what :D You have to wait for contact's approval to have a private conversation with them. Sounds like it incentivizes all chats to start with less secure protocols. The nice part about writing your own chat system is the security agility in that you can bump any security property without having to fight with protocol standardization bodies. Having three DM protocols inside the same app is wild.
heavyset_go 1y ago
Doesn't Nostr expose the fact that you sent messages to certain people via its blockchain?
- unboxingelf 1y ago
  Nostr doesn’t have a blockchain or token. Notes and Other Stuff Transmitted by Relays. It’s just signed json messages distributed by [websocket] relays.
  - heavyset_go 1y ago
    I'm probably mixing up analogies with actual implementations, but I'm basing my question on sentiments like this[1]: > While nostr offers the ability to send encrypted DMs to user pubkeys, the metadata of these messages are broadcast publicly via relays. This is the same as a bitcoin transaction being viewable on the public ledger. The contents of the direct message will be encrypted, but other metadata like the sender and recipient can be viewed by anyone. [1] https://ron.stoner.com/nostr_Security_and_Privacy/ https://ron.stoner.com/nostr_Security_and_Privacy/
    - styanax 1y ago
      Your intuition is correct, Nostr objects are stored on relays and can be retrieved by any client with the proper private keypart. In my test runs of trying Nostr proper for a month or two, I had problems deleting objects (clients lack support for the NIP API calls was common) - and you can only delete your end of a DM, not the whole thing. (another frustration - your "chat" or "inbox" can never be cleaned or deleted of the other person's messages). Effectively nostr objects lay around on relays until they reach some server-side expiry policy and sometimes forever if one can't figure out how to delete them. Nostr clients (web and mobile) are the wild west of good luck with which features and NIPs they support (XMPP all over again). My experience here led to dissatisfaction as well. Relays are another wild west - it's choice paralysis and a helping of good luck with that. The real problem for IM: Nostr does not ensure all relays sync, instead a user chooses their preferred relays (some you pay for in crypto). It is entirely realistic (I experienced it) that you're on relays other people aren't and you can't share content. This is death for an IM app and just trying to use Nostr became frustrating. (not to mention it's flooded with porn and crypto shills) Edit: a nostr client has to keep open network connections to all these relays, as objects can be stored on multiple relays and it's up to the client - not the relays - to query all relays and then de-dupe the JSON responses. There are combobouncers in use (who will de-dupe) but they're not the default and tend to be read-only (because you can't choose which relays to post to when using a combobouncer).
emptysongglass 1y ago
Is it just me or does the website render poorly on mobile?

data_maan 1y ago

0xchat on the surface seems better: looks like a professionally maintained codebase, with clear ways to interact with the devs. But - has there been security audit been done?

rpdillon 1y ago

I think the point here is that everyone has email. A chat client built on Nostr is fine (and I want to love Nostr), but it just doesn't have the reach or ubiquity of email.

AJ007 1y ago
When you start looking at alternative messengers outside of Matrix, XMPP, and IRC, there isn't much where third parties can operate or implement both servers and clients. Certainly if no one can implement these two things it is functionally a closed source project. It also is a security failure from the standpoint of control, validation, and also future security and vulnerability patching (there's a graveyard of dead "secure" messaging apps.) Is DeltaChat perfect from a security standpoint? No, but it's certainly well above the hurdle most people are at now. Most people are using non-encrypted communication that is actively scanned & stored, or e2e on paper stuff where one party controls the client, server, application, and storage (trust me e2e security.) Telegram, Discord, Facebook Messenger, stop using that shit.
- promptdaddy 1y ago
  Apologies for any nativity here, but wouldn't storing encrypted messages on a blockchain be a robust solution for this?
  - heavyset_go 1y ago
    Why would you want that? The last thing I'd want in a secure messenger is a permanent ledger that holds message content and associated metadata which anyone can analyze. edit: I didn't downvote you and I don't think someone asking an honest question like this should be downvoted
- maqp 1y ago
  >Is DeltaChat perfect from a security standpoint? No, but it's certainly well above the hurdle most people are at now. It's less safe compared to Signal, and Signal is the gold standard recommendations for average Joes. "Better than Telegram" is a low bar.
  - em-bee 1y ago
    telegram is the most user friendly chat out there. the only ones that compete in usability are wechat (yes, the chinese one) and, deltachat. signal just got a bit better by finally allowing me to hide my phone number. of all these, deltachat is the only one that doesn't require a smartphone and a phone number.
    - maqp 1y ago
      >telegram is the most user friendly chat out there. Telegram is a walking time bomb with 900 million users' data waiting to be leaked from the servers. >and, deltachat. That must be why I've never heard of anyone using it. >deltachat is the only one that doesn't require a smartphone and a phone number. It leaks the IP-address to the server, which by default (defaults matter) is nine.testrun.org. That server can amass metadata about users conversing, and any government entity that comes knocking can look at TelCo records about to which user the IP-addr was assigned at the time. If you're going to try to address metadata privacy against service provider, you're going to have address it properly, and DeltaChat isn't the one at that point. Neither is Signal. You'll want Cwtch for that.
      - em-bee 1y ago
        nine.testrun.org is owned by deltachat developers. it is about as trustworthy as, say, matrix.org. the only better alternative would be self hosting. the question is not what is the best, most secure, most private, option, but what has the right balance between easy onboarding, ease of use, security and privacy. and maybe deltachat is not the best possible, but it is pretty good. remember, when security and privacy are to onerous then you don't have security or privacy because people will refuse to use the tool.
lxgr 1y ago
Nor does Delta. Nobody will “chat” with me via their Gmail email focused UI, so it’s effectively a separate network anyway. Using an email address as an identifier for IM is a great idea (I hate that everything uses phone numbers for this, which are not internationally portable and not possible to reasonably “self-custody” the way TLDs are). But using the actual email protocol as a backing protocol for instant messaging seems like a weird contortion and still makes this effectively a separate protocol, the split being servers that do and don’t support all necessary extensions. The overhead must also be staggering; just look at an email header to see how much is going on for each message these days.
- em-bee 1y ago
  you got a point with the overhead in email headers. also an email is sent not only for every message but also status updates. that adds up to a lot of emails.

maqp 1y ago

https://github.com/0xchat-app https://github.com/0xchat-app states it doesn't have desktop clients. Also, the direct messages have three types 1) NIP-04 DM: "Most widely used", but also, "not recommended". Reeks of Telegram that also has non-secret chats being the most popular option 2) Gift-Wrapped DM: Uses different encryption algorithm but no forward secrecy? Forward secrecy has been around for 20 years. 3) Secret DM: Can't be recovered on different devices. Why can't the backup be self-contained database like Signal has? Also "Secret chat requires consent from peer." Like what :D You have to wait for contact's approval to have a private conversation with them. Sounds like it incentivizes all chats to start with less secure protocols. The nice part about writing your own chat system is the security agility in that you can bump any security property without having to fight with protocol standardization bodies. Having three DM protocols inside the same app is wild.

heavyset_go 1y ago

Doesn't Nostr expose the fact that you sent messages to certain people via its blockchain?

unboxingelf 1y ago
Nostr doesn’t have a blockchain or token. Notes and Other Stuff Transmitted by Relays. It’s just signed json messages distributed by [websocket] relays.
- heavyset_go 1y ago
  I'm probably mixing up analogies with actual implementations, but I'm basing my question on sentiments like this[1]: > While nostr offers the ability to send encrypted DMs to user pubkeys, the metadata of these messages are broadcast publicly via relays. This is the same as a bitcoin transaction being viewable on the public ledger. The contents of the direct message will be encrypted, but other metadata like the sender and recipient can be viewed by anyone. [1] https://ron.stoner.com/nostr_Security_and_Privacy/ https://ron.stoner.com/nostr_Security_and_Privacy/
  - styanax 1y ago
    Your intuition is correct, Nostr objects are stored on relays and can be retrieved by any client with the proper private keypart. In my test runs of trying Nostr proper for a month or two, I had problems deleting objects (clients lack support for the NIP API calls was common) - and you can only delete your end of a DM, not the whole thing. (another frustration - your "chat" or "inbox" can never be cleaned or deleted of the other person's messages). Effectively nostr objects lay around on relays until they reach some server-side expiry policy and sometimes forever if one can't figure out how to delete them. Nostr clients (web and mobile) are the wild west of good luck with which features and NIPs they support (XMPP all over again). My experience here led to dissatisfaction as well. Relays are another wild west - it's choice paralysis and a helping of good luck with that. The real problem for IM: Nostr does not ensure all relays sync, instead a user chooses their preferred relays (some you pay for in crypto). It is entirely realistic (I experienced it) that you're on relays other people aren't and you can't share content. This is death for an IM app and just trying to use Nostr became frustrating. (not to mention it's flooded with porn and crypto shills) Edit: a nostr client has to keep open network connections to all these relays, as objects can be stored on multiple relays and it's up to the client - not the relays - to query all relays and then de-dupe the JSON responses. There are combobouncers in use (who will de-dupe) but they're not the default and tend to be read-only (because you can't choose which relays to post to when using a combobouncer).

emptysongglass 1y ago

Is it just me or does the website render poorly on mobile?