Ricochet - a Tor chat client

Submit portable freeware that you find here. It helps if you include information like description, extraction instruction, Unicode support, whether it writes to the registry, and so on.
Message
Author
User avatar
smaragdus
Posts: 2120
Joined: Sat Jun 22, 2013 3:24 am
Location: Aeaea

Ricochet - a Tor chat client

#1 Post by smaragdus »

What is Ricochet:
Ricochet or Ricochet IM is an open source, multi-platform, instant messaging software project originally developed by John Brooks and later adopted as the official instant messaging client project of the Invisible.im group. A goal of the Invisible.im group is to help people maintain privacy by developing a "metadata free" instant messaging client.
Anonymous instant messaging for real privacy
Ricochet is a different approach to instant messaging that doesn’t trust anyone in protecting your privacy.
- Eliminate metadata. Nobody knows who you are, who you talk to, or what you say.
- Stay anonymous. Share what you want, without sharing your identity and location.
- Nobody in the middle. There are no servers to monitor, censor, or hack.
- Safe by default. Security isn’t secure until it’s automatic and easy to use.
Overview
Ricochet is a decentralized instant messenger, meaning there is no server to connect to and share metadata with. Further, using Tor (anonymity network), Ricochet starts a Tor hidden service locally on a person's computer and can only communicate with other Ricochet users who are also running their own Ricochet-created Tor hidden services. This way, Ricochet communication never leaves the Tor network. A user screen name (example: “ricochet:hslmfsg47dmcqctb“) is auto-generated upon first starting Ricochet; the first half of the screen name is the word "ricochet", with the second half being the address of the Tor hidden service. Before two Ricochet users can talk, at least one of them must privately or publicly share their unique screen name in some way.

Privacy benefits

- Ricochet users are not personally identifiable.
- Ricochet does not reveal user IP addresses or physical locations because of Tor.
- Message content is cryptographically authenticated and private.
- There is no need to register anywhere in order to use Ricochet, particularly with a fixed server.
- Contact list information is stored locally, and it would be very difficult for passive surveillance techniques to determine whom you're chatting with.
- Ricochet does not save chat history. When you close a conversation, the chat log is not recoverable.
- The use of Tor hidden services prevents network traffic from ever leaving the Tor network, thereby preserving anonymity and complicating passive network surveillance.
- Ricochet is a portable application, users do not need to install any software to use Ricochet. Ricochet connects to the Tor network automatically.

Security warnings

- Ricochet has not been subjected to an independent security audit.
- An already-compromised computer system will typically defeat the privacy protections that Ricochet offers, such as a keystroke logging malware.
- Even though Ricochet uses Tor, other applications will not be using Tor unless you've independently set up additional Tor services on your computer.
- Active and passive surveillance techniques can still tell if you're using the Internet, and when, but not necessarily what you're doing on the Internet.
- Since a Ricochet user does not register or log in anywhere to use Ricochet,[6] not even with a password, it is important to implement layered physical security, including disk encryption, to protect Ricochet.
- Tails Linux users, and other live operating systems users, can optionally backup Ricochet to zero-knowledge cloud services such as SpiderOak, or on a personally owned USB drive (ideally encrypted).
Ricochet links:

https://ricochet.im/ - Ricochet web-site
https://github.com/ricochet-im/ricochet - Ricochet project site
https://en.wikipedia.org/wiki/Ricochet_%28software%29 - Ricochet at Wikipedia

Srceen-shots:

- Main window -
Ricochet - 001 - 2015-11-03.png
Ricochet - 001 - 2015-11-03.png (4.05 KiB) Viewed 40931 times
- Settings window -
Ricochet - 002 - 2015-11-03.png
Ricochet - 002 - 2015-11-03.png (7.48 KiB) Viewed 40931 times
How to use Ricochet as a portable program:
- On installation choose 'Extract (Portable)'

Ricochet is quite similar to TorChat which is in the database but seems to be abandoned. Its main disadvantage is that Ricochet cannot be minimized to tray (in contrast with TorChat)- I suggested this feature but never got a response from the developer. Ricochet doesn't offer statuses and doesn't save chat history. Although abandoned I still find TorChat better than Ricochet.

User avatar
webfork
Posts: 10821
Joined: Wed Apr 11, 2007 8:06 pm
Location: US, Texas
Contact:

Re: Ricochet - a Tor chat client

#2 Post by webfork »

Ricochet has not been subjected to an independent security audit.
I love that more and more programs are listing this as part of either their todolist or disclaimer. I think that TrueCrypt audit set a great precedent.
Ricochet is quite similar to TorChat which is in the database but seems to be abandoned.
Good to have alternatives.

User avatar
smaragdus
Posts: 2120
Joined: Sat Jun 22, 2013 3:24 am
Location: Aeaea

Re: Ricochet - a Tor chat client

#3 Post by smaragdus »

Ricochet has been reviewed at Softpedia.

User avatar
smaragdus
Posts: 2120
Joined: Sat Jun 22, 2013 3:24 am
Location: Aeaea

Re: Ricochet - a Tor chat client

#4 Post by smaragdus »

Ricochet at version 1.1.2, what's new:
Ricochet 1.1.2 fixes a vulnerability which could lead to user-assisted network deanonymization, improves contact connection reliability, and fixes a common stability issue.

We're also proud to release the results of an audit by NCC Group through the Open Technology Fund. The report validates Ricochet's security and provides a great outline of areas to improve in the near future.

Security fixes

By sending a nickname with some HTML tags in a contact request, an attacker could cause Ricochet to make network requests without Tor after the request is accepted, which would reveal the user's IP address. The malicious nickname is clearly displayed, and no network activity takes place unless the request is accepted. We've addressed this vulnerability by sanitizing nicknames in all cases before display, rejecting contact requests with suspicious nicknames, and blocking any network requests at that layer.

Thanks to the incredible Sarah Jamie Lewis (@s-rah) for originally discovering this issue.

Changes

- Block all network requests to guard against potential deanonymization issues (#303)
- Reject contact requests with nicknames containing suspicious characters
- Sanitize nicknames before use in UI labels
- Fix a common crash when restarting an outbound connection attempt
- Fix a bug which caused connection attempts to contacts to stall until restarted (#295)
- Added translations for Hebrew, Slovenian, and Chinese
- Updated translations
- Updated to Qt 5.5.1, OpenSSL 1.0.1r, and Tor 0.2.7.6
- OS X builds now use AddressSanitizer for hardening
The program can be downloaded from Ricochet web-site and from GitHub project page.

In stead of running the installer, it can also be extracted, the program is inside the {app} folder, everything else can be deleted.

User avatar
tactictoe
Posts: 283
Joined: Thu Dec 10, 2015 10:56 am
Location: A galaxy far far downunder
Contact:

Re: Ricochet - a Tor chat client

#5 Post by tactictoe »

Ricochet has not been subjected to an independent security audit.
More as a disclaimer. BUT also to reassure people with no real FULL PUBLICATION of the independent audit. And one audit is certainly not the law when it come to security these days.
Commercial trick, that is what it is and a cover for eventual law suits. IMHO of course.
On the other hand, if it's done for security concern for a product (which is always limited to time as technologies advance so fast) it is a good move. Unfortunately, they are good move but never enough chance to make it law or just for a little period of time until... but I won't talk about the dark side here.

Anyway, nice catch. Always good to have more choice.

Have a nice day.

User avatar
webfork
Posts: 10821
Joined: Wed Apr 11, 2007 8:06 pm
Location: US, Texas
Contact:

Re: Ricochet - a Tor chat client

#6 Post by webfork »

tactictoe wrote:Commercial trick, that is what it is and a cover for eventual law suits.
I think it’s more a reference to how audits are increasingly important in security and messaging (e.g. the EFF Messaging Scorecard). The [very close to MIT] license already carries lawsuit protection:

https://github.com/ricochet-im/ricochet ... er/LICENSE

User avatar
smaragdus
Posts: 2120
Joined: Sat Jun 22, 2013 3:24 am
Location: Aeaea

Re: Ricochet - a Tor chat client

#7 Post by smaragdus »

Secure Messaging Scorecard doesn't include any Tox clients so far. RetroShare gets a good score but it is not very popular and I wonder why- it is relatively easy to configure in contrast with GoldBug Instant Messenger for example.

User avatar
tactictoe
Posts: 283
Joined: Thu Dec 10, 2015 10:56 am
Location: A galaxy far far downunder
Contact:

Re: Ricochet - a Tor chat client

#8 Post by tactictoe »

webfork
The [very close to MIT] license already carries lawsuit protection
True BUT since when a license stop potential Lawsuit when the license could be in debate in relation with the main complain about a software? At the end it depends the judge to pursue or not, isn't it?
They ARE precedents, e.g. Copyright violation even covered by the license is the one obvious that come to mind.

academic:
Read this article somehow related to my comment: https://opensource.com/law/14/7/lawsuit ... ing-issues
BTW MIT does NOT have a patent license, if the article is read you will know what I mean.

extract:
One inevitable question the district court's ruling raises is how, if at all, it relates to the Federal Circuit's ruling in Jacobsen v. Katzer. Jacobsen held that the breach of a free/open source software license was an infringement of the underlying copyrights if the breach was of a "condition," or a term that "limits the scope" of the license, rather than a "covenant," or a promise made in return for the license. The answer is very important for software producers: if a breach of the license is copyright infringement (i.e., because the provision breached was a condition), the copyright holder can sue in federal court, request an injunction preventing further distribution of the software, and seek statutory damages; if it's merely a breach of contract (i.e., because the relevant provision was a covenant), these remedies are not available to the copyright holder. Jacobsen held that the licensee's obligations in an open source license (specifically the Artistic License, used mainly by the Perl community) are conditions, in part because they are essential to preserving the essential purpose of the license, which is to secure the benefits of downstream development to the original developers.
Now replace copyright by DAMAGE covered by other MORAL law and you have a case open for debate in a court room. As such, if it is possible, two precautions (at the least) are better than just a license protection. It is to wonder how software company could be protected in term of lawsuit with just the license.
Metaphorically: Could a knight without armor but a shield win a melee or even a joust? He could but he will not most likely and it is not even taking in consideration the quality of both party equipment.

Scary facts. :roll:

However as I said,
On the other hand, if it's done for security concern for a product (which is always limited to time as technologies advance so fast) it is a good move.
it is a good move with good intention.

User avatar
webfork
Posts: 10821
Joined: Wed Apr 11, 2007 8:06 pm
Location: US, Texas
Contact:

Re: Ricochet - a Tor chat client

#9 Post by webfork »

smaragdus wrote:Secure Messaging Scorecard doesn't include any Tox clients so far.

I suspect we'll see it's addition in the next 6 to 12 months, especially if they figure out a way to get an iOS app.
smaragdus wrote:RetroShare gets a good score but it is not very popular and I wonder why
I really don't know. I've told a number of people about the tool and suggested getting something setup with that but I think part of it is that nobody I know really has a computer connected to the Internet 24/7 anymore, which is what people expect from a file server.
tactictoe wrote:At the end it depends the judge to pursue or not, isn't it?
Certainly copyright is a different matter but, as I read it in your entry, the lawsuit component was around the security audit. It would be very hard to bring a lawsuit surrounding a security failure with a notice like THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS".

User avatar
smaragdus
Posts: 2120
Joined: Sat Jun 22, 2013 3:24 am
Location: Aeaea

Re: Ricochet - a Tor chat client

#10 Post by smaragdus »

@webfork
I really don't know. I've told a number of people about the tool and suggested getting something setup with that but I think part of it is that nobody I know really has a computer connected to the Internet 24/7 anymore, which is what people expect from a file server.
RetroShare is not a file sharing server, it is a P2P private file sharing and communication program, such programs are usually called F2F- Friend-2-Friend- when you authorize friends they can see when you are online and share files and chat with you. RetroShare offers a lot more than file sharing- it can be used for messaging, private chat, chat rooms, channels, forums, etc. RetroShare is like a private Direct Connect program enhanced with additional features, but only the authorized friends can have access to the resource you have shared.

User avatar
smaragdus
Posts: 2120
Joined: Sat Jun 22, 2013 3:24 am
Location: Aeaea

Re: Ricochet - a Tor chat client

#11 Post by smaragdus »

Off-topic
My favourites for private communication:
Encrypted Web Mail- ProtonMail
Private Messaging- Bitmessage, discussed here in the forum.
Private Chat- a Tox client- either qTox, or Isotoxin (I prefer the latter).
Private File-Sharing - RetroShare (which offers a lot more).

User avatar
tactictoe
Posts: 283
Joined: Thu Dec 10, 2015 10:56 am
Location: A galaxy far far downunder
Contact:

Re: Ricochet - a Tor chat client

#12 Post by tactictoe »

@ webfork
Certainly copyright is a different matter but, as I read it in your entry, the lawsuit component was around the security audit. It would be very hard to bring a lawsuit surrounding a security failure with a notice like THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS".
Game over! you got me here. 8)

donald
Posts: 561
Joined: Wed Dec 19, 2007 4:14 am
Location: knoxville TN USA

Re: Ricochet - a Tor chat client

#13 Post by donald »

Ricochet has failed several times after a portable install using the installer.
Error message in what may be German followed by a short mention of visual runtimes
and shutdown in English.
2016-03-13_182459.jpg
2016-03-13_182552.jpg
OS Windows XP SP3

Checked website for OS support and requirements but did not find it.

User avatar
smaragdus
Posts: 2120
Joined: Sat Jun 22, 2013 3:24 am
Location: Aeaea

Re: Ricochet - a Tor chat client

#14 Post by smaragdus »

@donald
You can submit the problem here. On Windows 8 Ricochet runs just fine.

User avatar
tactictoe
Posts: 283
Joined: Thu Dec 10, 2015 10:56 am
Location: A galaxy far far downunder
Contact:

Re: Ricochet - a Tor chat client

#15 Post by tactictoe »

donald wrote:Ricochet has failed several times after a portable install using the installer.
Error message in what may be German followed by a short mention of visual runtimes
and shutdown in English.
2016-03-13_182459.jpg
2016-03-13_182552.jpg
OS Windows XP SP3

Checked website for OS support and requirements but did not find it.
This is visibly a problem of missing DLL or corrupted DLL. I thing the problem is on your PC. In both case the software calls DLL and cannot find the right entry point, so to speak. Therefore crashing the software. Visual C++ runtime library should be updated to the latest version for XP. Just google it and find the latest version for XP if it still exist. Not sure how to update the OpenGL library even it clearly scream for OpenGL version 2.0 version, same I guess here... google for it and install the version for XP (latest), it might indicate also a problem of display driver. Do not forget to create a system restore point BEFORE updating, this at the very least precaution... imaging the system would be ultimate protection.

Post Reply