diff --git a/go.mod b/go.mod
index 7242b935..6e7a43c2 100644
--- a/go.mod
+++ b/go.mod
@@ -4,7 +4,7 @@ go 1.12
 
 require (
 	cwtch.im/cwtch v0.4.1
-	git.openprivacy.ca/openprivacy/connectivity v1.2.1
+	git.openprivacy.ca/openprivacy/connectivity v1.2.2
 	git.openprivacy.ca/openprivacy/log v1.0.1
 	github.com/gopherjs/gopherjs v0.0.0-20200209183636-89e6cbcd0b6d // indirect
 	github.com/therecipe/qt v0.0.0-20200126204426-5074eb6d8c41
diff --git a/go.sum b/go.sum
index f3b7ca5c..4c139a30 100644
--- a/go.sum
+++ b/go.sum
@@ -33,6 +33,8 @@ git.openprivacy.ca/openprivacy/connectivity v1.2.0 h1:dbZ5CRl11vg3BNHdzRKSlDP8OU
 git.openprivacy.ca/openprivacy/connectivity v1.2.0/go.mod h1:B7vzuVmChJtSKoh0ezph5vu6DQ0gIk0zHUNG6IgXCcA=
 git.openprivacy.ca/openprivacy/connectivity v1.2.1 h1:oRL56TR9ZQnKkGkTIQ9wYbJ2IkOOsi/zLYExYiAS+sE=
 git.openprivacy.ca/openprivacy/connectivity v1.2.1/go.mod h1:B7vzuVmChJtSKoh0ezph5vu6DQ0gIk0zHUNG6IgXCcA=
+git.openprivacy.ca/openprivacy/connectivity v1.2.2 h1:CeuZB469xHMHxygxZD559CkRUAGR7ct4oeSlsAHQmKo=
+git.openprivacy.ca/openprivacy/connectivity v1.2.2/go.mod h1:B7vzuVmChJtSKoh0ezph5vu6DQ0gIk0zHUNG6IgXCcA=
 git.openprivacy.ca/openprivacy/libricochet-go v1.0.11 h1:C7QFFzG0p5XKu0zcOIdLGwEpA9uU0BceBM7CfVK5D40=
 git.openprivacy.ca/openprivacy/libricochet-go v1.0.11/go.mod h1:yTMps/ZpYS+BNBBvANsNAft28FXrBvFHQauMYNWPrwE=
 git.openprivacy.ca/openprivacy/libricochet-go v1.0.13 h1:Z86uL9K47onznY1wP1P/wWfWMbbyvk6xnCp94R180os=
diff --git a/go/handlers/peerHandler.go b/go/handlers/peerHandler.go
index 30637f95..0c48162e 100644
--- a/go/handlers/peerHandler.go
+++ b/go/handlers/peerHandler.go
@@ -127,6 +127,7 @@ func PeerHandler(onion string, uiManager ui.Manager, subscribed chan bool) {
 					if state == connections.AUTHENTICATED {
 						loading = true
 					}
+					uiManager.UpdateContactStatus(groupID, int(state), loading)
 					uiManager.UpdateContactStatus(serverOnion, int(state), loading)
 				} else {
 					log.Errorf("found group that is nil :/")
diff --git a/main.go b/main.go
index 379cf270..e33ac373 100644
--- a/main.go
+++ b/main.go
@@ -1,14 +1,15 @@
 package main
 
 import (
+	"crypto/rand"
 	libapp "cwtch.im/cwtch/app"
 	"cwtch.im/cwtch/event/bridge"
 	"cwtch.im/ui/go/handlers"
 	"cwtch.im/ui/go/the"
 	"cwtch.im/ui/go/ui"
 	"cwtch.im/ui/go/ui/android"
+	"encoding/base64"
 	"flag"
-	"fmt"
 	"git.openprivacy.ca/openprivacy/connectivity/tor"
 	"git.openprivacy.ca/openprivacy/log"
 	"github.com/therecipe/qt/androidextras"
@@ -17,13 +18,13 @@ import (
 	"github.com/therecipe/qt/network"
 	"github.com/therecipe/qt/qml"
 	"github.com/therecipe/qt/quickcontrols2"
-	"io/ioutil"
-	"math/rand"
+	mrand "math/rand"
 	"os"
 	"os/user"
 	"path"
 	"path/filepath"
 	"runtime"
+	"time"
 )
 
 const androidBaseDir = "/data/data/ca.openprivacy.cwtch.ui/"
@@ -234,22 +235,28 @@ func loadACN() {
 			torpath = path.Join(dir, "tor")
 		}
 	}
-	var err error
-	the.ACN, err = tor.NewTorACN(the.CwtchDir, torpath)
 
-	if _, ok := err.(*tor.NoTorrcError); ok {
-		// Stopgap: just dump a basic torrc for now
-		port := rand.Intn(1000) + 9600
-		controlPort := port + 1
-		ioutil.WriteFile(path.Join(the.CwtchDir, "tor", "torrc"), []byte(fmt.Sprintf(`SOCKSPort %v \n ControlPort %v`, port, controlPort)), 0600)
-		the.ACN, err = tor.NewTorACNWithAuth(the.CwtchDir, torpath, controlPort, tor.NullAuthenticator{})
+	//  generate a random socks and control port (not real random...these are port numbers...)
+	mrand.Seed(int64(time.Now().Nanosecond()))
+	port := mrand.Intn(1000) + 9600
+	controlPort := port + 1
 
-		if err != nil {
-			// TODO: turn into UI error: status panel?
-			log.Errorf("Could not start Tor: %v", err)
-			os.Exit(1)
-		}
+	// generate a random password (actually random, stored in memory, for the control port)
+	key := make([]byte, 64)
+	_, err := rand.Read(key)
+	if err != nil {
+		panic(err)
+	}
 
+	// generate torrc on the fly
+	// TODO if we have been configured for it, use system tor (like orbot) - we need a way to config this in the UI first
+	tor.NewTorrc().WithSocksPort(port).WithOnionTrafficOnly().WithControlPort(controlPort).WithHashedPassword(base64.StdEncoding.EncodeToString(key)).Build(path.Join(the.CwtchDir, "tor", "torrc"))
+	the.ACN, err = tor.NewTorACNWithAuth(the.CwtchDir, torpath, controlPort, tor.HashedPasswordAuthenticator{base64.StdEncoding.EncodeToString(key)})
+
+	if err != nil {
+		// TODO: turn into UI error: status panel?
+		log.Errorf("Could not start Tor: %v", err)
+		os.Exit(1)
 	}
 }