Thanks, I made a thread asking about the Autodestruction features on SimpleX because it’s so confusing I made an actual entire post about it:
But does the other person need to install tor? If he is a casual Linux user (at least better than Windows) all he has to do is enable these settings within SimpleX and it will work or you need to actually install tor? (not Tor Browser which many people have, but the actual tor service). Im just trying to not scare people away that may have some casual interest on privacy but don’t go much beyond Signal.
About the 1 time link, if it’s shared on a clearnet email (im using always a privacy-friendly email provider and under Tails), im still not sure if that’s a cool idea, but I don’t see a way around this, as I don’t want to share a Signal contact or anything that requires a phone until later if needed. They use a professional looking email with their own domain but not sure what servers are hosting that. Apparently it’s an email only the person im talking to has access to but who knows. Just trying to find I could improve this step without complicating things much.
No they don’t. If they do it’ll benefit both of you as even colluding servers can’t tell who is talking to whom.
Installing Tor is about as easy as
sudo apt install tor -y
I get terminal is scary to newcomers but again it’s not mandatory under your threat model.
The one time link is basically your public key. If an attacker replaces it with their own during delivery, you might fall under MITM attack. So make sure to verify the end to end encryption works by checking the security code Privacy & security
Ideal way to verify it is face to face as you don’t have to trust any platform and nobody’s replacing your buddy with a synth for the meeting.
Since that’s the recommended way anyway with people you trust, I’d suggest adding the contact during the face to face meeting, that way you don’t have to second guess which platform is private enough for link sharing to hide that you both use SimpleX.
What do you do if you don’t know him enough to talk face to face? You contact someone on their email, share the link, then where and how would you check the Security code is the same?
Well you just use the best authenticated channel you both can. If you know their face or voice, a (video) call is ideal as it’s harder to spoof someone’s physical features than it is to spoof random textual string. If you can use opportunistic end-to-end encryption for the channel you use to verify it, even better. If the person has a long term online identity like website, a hard to index page robthelawyer.com/29812534986739583745,txt should work fine. PGP key signature works too but you’re also just moving the problem to how to deliver authentic PGP key. If you don’t have anything like that, you’re probably limited to less secure methods, and should self-censor accordingly: “Would I say this if the SimpleX link sent over unencrypted email was intercepted and replaced?” The nice part is you can verify the security code again and again over time to increase its trust. SMS + Email + Unauthenticated signal conversation is already pretty good as it requires the attacker to be everywhere. If all three of those are compromised you’re probably dealing with a nation state actor and SoL anyway. But again you’re probably not Edward Snowden so doing what you can is enough with overwhelming probability.