TorChat

~ the last words ~

TorChat had no accounts and no servers. The first time you started it, Tor generated a hidden service for you, and the address of that service was your identity: sixteen alphanumeric characters, which you gave to the person you wanted to talk to. When two clients spoke, each one connected to the other's onion address, so the traffic was encrypted end to end by the design of the network underneath and neither side learned where the other one was sitting.

The practical consequence that made people use it was duller than the cryptography. A hidden service accepts incoming connections even when the machine running it is behind a router doing network address translation, so TorChat worked from a dorm or an office without anyone touching a port forward. The Windows build came bundled with a preconfigured copy of Tor, which meant you could run the whole thing off a USB stick with nothing installed.

Bernd Kreuss, who signed his work prof7bit, published the first version in November 2007. It was Python and wxPython, which is why it ran on Linux as well as Windows, and it was GPL from the start.

~ the record ~

~ the stale copy of tor ~

The bundled Tor turned out to be the weak point. Between 2008 and 2010 no updated packages came out, and the copy of Tor inside the Windows build aged until it could no longer connect to the network at all. Forks appeared whose entire contribution was swapping in a current tor.exe. An official update finally shipped in December 2010 with a fresh one.

After that the project split. Kreuss started a rewrite from scratch in Free Pascal and Lazarus, called torchat2, and the original Python code moved to its own branch. The last preview of the rewrite, 2.0-alpha-14, is dated 22 July 2012. The Python branch took its final commit on 12 June 2013. The torchat2 branch took its final commit on 20 January 2014. There was no farewell post and no handover to another maintainer.

~ the audit ~

In 2015 somebody finally analyzed the protocol properly. The design of TorChat held up under the examination. The Python implementation came out with flaws that left users open to impersonation and to having a conversation confirmed by an observer. The caveat the paper allowed was narrow: using it might still be safe as long as your onion address never reached anyone motivated to attack you.

By then there was nobody left to act on any of it. The repository had been quiet for a year when the analysis came out, and it has stayed quiet in the decade since, with its thousand stars and its six abandoned branches still sitting there.

~ one year late ~

Tor became a normal topic of conversation in Turkey in 2014, the year Twitter was blocked in March and YouTube a week after it, and the year a lot of people here learned what a circumvention tool was for. TorChat's last commit is dated 20 January of that year, two months before any of that. The software that fit the moment had already stopped moving by the time the moment arrived, and what people reached for instead was a VPN or a changed DNS setting.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »