<div dir="ltr">Ricochet looks really cool and I've been following it from afar for a while.<div><br></div><div>I'm very excited about something similar to finally address the biggest single point of weakness/failure for XMPP, which is the fact that you're often still sending all your communications and contacts to 3rd party XMPP servers. Right now setting up your own server is reserved for people who can navigate a Linux command line, buy domain, buy SSL certs, secure the server, keep it updated, adjust arcane configuration files, etc. We can fix all that.<div><br></div><div>Host a minimal Prosody server inside an Android/Java Lua wrapper that runs behind a .onion to make it universally addressable (even when behind carrier-grade NAT). Allow easy automated setup / provisioning for client apps, and you've got something reasonably secure against many of the problems associated with running servers on 3rd party cloud providers. Would also be good to disable federation to reduce data leakage, and make sure users enable Android full disk encryption.</div><div><br></div><div><br></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Aug 6, 2015 at 10:51 AM, Nathan of Guardian <span dir="ltr"><<a href="mailto:nathan@guardianproject.info" target="_blank">nathan@guardianproject.info</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">If you haven't heard of Ricochet, it is a new-ish peer-to-peer messaging<br>
system that works over Tor Hidden Services. It is similar to TorChat,<br>
but seems to work better, is design better, and in general, the team<br>
behind it has done a better job engaging with the Tor community.<br>
<br>
<a href="https://ricochet.im/" rel="noreferrer" target="_blank">https://ricochet.im/</a><br>
<a href="https://github.com/ricochet-im/ricochet" rel="noreferrer" target="_blank">https://github.com/ricochet-im/ricochet</a><br>
<br>
Now, of course, I'm interested in bringing this service to Android, and<br>
there a few ways to do so. Here's the open issue on Github discussing<br>
this:<br>
<a href="https://github.com/ricochet-im/ricochet/issues/115" rel="noreferrer" target="_blank">https://github.com/ricochet-im/ricochet/issues/115</a><br>
<br>
The first is to use QT for Android, and cross-compile the entire<br>
codebase into an APK. I've started on this, and it is a bit of a chore,<br>
but it should work technically. I think what you'll end up with though<br>
is not a great user experience.<br>
<br>
The second option is for us to support Ricochet within ChatSecure. We<br>
have a highly extensible protocol plug-in layer that we have never<br>
really exploited properly, and I think we can easily plug the Ricochet<br>
protocol into that. You would even get OTR and OTRDATA running on top of<br>
it, which would be pretty cool.<br>
<br>
To do this, we either need the Ricochet C++ code to be turned into a JNI<br>
library, or we need someone to implement the Ricochet protocol in Java:<br>
<a href="https://github.com/ricochet-im/ricochet/blob/master/doc/protocol.md#contact-request-channel" rel="noreferrer" target="_blank">https://github.com/ricochet-im/ricochet/blob/master/doc/protocol.md#contact-request-channel</a><br>
<br>
This is really just an idea I am throwing out there, perhaps worthy of a<br>
hackathon effort, and I have no real idea where it could go. I am still<br>
a huge fan of XMPP+OTR+Tor (aka "XMPPSecure+Private") but I would also<br>
like to see the UI and Usability we have created with ChatSecure<br>
leverage into other great potential new protocols like Ricochet and Pond<br>
(oi, that is another project - PondLib Go-to-Android port!).<br>
<br>
Btw, if you want to reach me on Ricochet, I am at:<br>
ricochet:z3apuhaum7wxrpmw<br>
<span class="HOEnZb"><font color="#888888"><br>
<br>
--<br>
 Nathan of Guardian<br>
 <a href="mailto:nathan@guardianproject.info">nathan@guardianproject.info</a><br>
_______________________________________________<br>
List info: <a href="https://lists.mayfirst.org/mailman/listinfo/guardian-dev" rel="noreferrer" target="_blank">https://lists.mayfirst.org/mailman/listinfo/guardian-dev</a><br>
To unsubscribe, email:Â <a href="mailto:guardian-dev-unsubscribe@lists.mayfirst.org">guardian-dev-unsubscribe@lists.mayfirst.org</a><br>
</font></span></blockquote></div><br></div>