ricochet[1] is my preferred option for situations that would require something like tor messenger (which is very few situations, but I digress). I like that the UX has a built-in threat model (e.g. "do you really want to click on this?")
TAILS users can't use it because tor-over-tor is weird (ricochet uses its own tor process). but it looks like it's getting close.[2]
I wish the page had screenshots. That's usually a good measure of how the software is maintained. Currently the page mentions that it's "experimental".
As far as I can see currently the only widely used, secure protocols are Matrix and XMPP with OMEMO.
Well, that placeholder conversation in the screenshot sure made me cringe. That being said, I look forward to it being integrated and working with Tails.
Hi, I don't speak for @special, but I think some context might be useful.
There is currently a bunch of (official|unofficial) work going on in the wider ecosystem - most of it related to factoring out the base library[1] to go to make it more useful as well as porting the main client to go[2].
There are also a few experiments regarding running on mobile[3] and using ricochet and these other libraries for other things besides traditional IM[4].
Most of this wider work has been updated within the last couple of weeks, ricochet is still actively being worked on & used - just not in the most visible places right now.
Some of the features you have pointed to are sitting waiting for someone to come along and design/write them. For most there is a lot of UX work that needs to be done in order for these features (layered crypto, hidden service auth, multiple profiles etc.) to be secure & useable.
In many cases, adding them to the new Go code might be preferable in terms of ease of implementation. That is partly why work is being put into the libraries there, to make new changes to ricochet as easy and as useful as possible. These libraries are also in development right now, and it may take a little while before everything comes together.
So the best thing people can do right now if they want to move these things along is to contribute to the discussions on the feature threads if they have ideas about how those features could work & to submit code/pull requests to the various code bases.
The issue mentioned of reusing nodes doesn't seem like much of a concern considering how the onion routing works (even if the routes are all the same nodes).
this is interesting to ponder on, it is clearly over my head because I am not sure why this would cause an issue, even if they reused some of the same nodes. in theory if anything could be gained with tor over tor why would that same information not be attainable in a single tor instance? why is information considered exposed if any node is reused?
>It is not clear if this is safe. It has never been discussed.
TAILS users can't use it because tor-over-tor is weird (ricochet uses its own tor process). but it looks like it's getting close.[2]
1. https://ricochet.im/
2. https://labs.riseup.net/code/issues/8173