feature overlap with onionshare 2.3.2 ? #53

New Issue

icwtch · 2021-06-28T13:10:28Z

icwtch commented

2021-06-28 13:10:28 +00:00

Hi, was just wondering what more cwtch in its current status would offer over let's say latest version of onionshare, also using hidden services on Tor and having the ability to chat (the latter being fully cross-platform and also allowing for file-sharing though...)

sarah added the

question

label 2021-06-28 15:41:19 +00:00

sarah commented

2021-06-28 15:41:24 +00:00

The simplest answer is that Cwtch is designed to be a metadata resistant messaging platform (see the Risk Model section of the secure development handbook: https://docs.openprivacy.ca/cwtch-security-handbook/risk.html)

In Cwtch p2p chat is not only conducting over onion services those servers are also authenticate to each other, and from that they derive an ephemeral key that provides forward secrecy. As far as I am aware OnionShare has no equivilant to this with the same security properties.

For Group chat the routing server in Cwch is explictly untrusted, and (without collaberation of a group member) can learn nothing about who is participating in a given group, what groups the server is hosting or anything else to do with the contents of the chat.

OnionShare routes all messages plaintext via a (self-hosted)server, as such the server learns a lot about the chats it is hosting, and the identities on the server arebound to that server and cannot be used independently (unlike in Cwtch where you identity is a tor-compatible ed25519 key that can be used to host your own peer node and allow people to connect with you)

The simplest answer is that Cwtch is designed to be a metadata resistant messaging platform (see the Risk Model section of the secure development handbook: https://docs.openprivacy.ca/cwtch-security-handbook/risk.html) In Cwtch p2p chat is not only conducting over onion services those servers are also authenticate to each other, and from that they derive an ephemeral key that provides forward secrecy. As far as I am aware OnionShare has no equivilant to this with the same security properties. For Group chat the routing server in Cwch is explictly untrusted, and (without collaberation of a group member) can learn *nothing* about who is participating in a given group, what groups the server is hosting or anything else to do with the contents of the chat. OnionShare routes all messages plaintext via a (self-hosted)server, as such the server learns a lot about the chats it is hosting, and the identities on the server arebound to that server and cannot be used independently (unlike in Cwtch where you identity is a tor-compatible ed25519 key that can be used to host your own peer node and allow people to connect with you)