Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
users:sharing_ids [2015/09/11 07:09] – [Sharing Tox ID's] aklynusers:sharing_ids [2020/07/16 18:55] (current) – [Sharing Tox IDs] skeleton1
Line 1: Line 1:
-===== Sharing Tox ID's ===== +===== Sharing Tox IDs ===== 
-**WARNING:** If you are looking for shorter more memorable IDs, remember that the **relation between any kind of names and Tox IDs is neither protected nor ensured** by the Tox protocol. By the nature of name services (when you e.g. use a [[users:toxdns|ToxDNS]]) you put full trust into unverified third party data and also get that data over a different, insecure protocol. +**WARNING:** If you are looking for shorter and more memorable IDs, remember that the **relation between any kind of names and Tox IDs is neither protected nor ensured** by the Tox protocol. By the nature of name services you put full trust into unverified third party data and also get that data over a different, insecure protocol. The safest way to share your Tox ID is by giving your Tox ID directly over a secure channel. 
-__The only reliable registry with names of your contacts is your personal contact list__. (To make it safe you also __must set your own__ labels (names) on the entries in the list. __The automatic setting of the labels from remote parties is totally insecure__. At least some clients offer unsafe contact list as the default, this looks innocent but is a serious security flaw)+__The only reliable registry with names of your contacts is your personal contact list__. To make it safe you should also __set your own__ permanent labels (names/aliases) on the contacts in the list. In the absence of other, unchangeable means to identify the contact (e.g. [[toxid#public_key|public key]], identicon, chat history), the ability of contacts to freely change their display names in your contact list is __totally insecure__. Fortunately, most clients allow viewing a contact's public key, which cannot be fabricated, or have other means to identify the contact by.
  
-Below are some of the ways to share Tox ID's and their benefits and drawbacks. This is an attempt to address the different things that can come into play when initially authenticating a Tox user.+Below are some of the ways to share Tox IDs and their benefits and drawbacks. This is an attempt to address the different things that can come into play when initially authenticating a Tox user.
  
 ==== In Person, Manual Verification ==== ==== In Person, Manual Verification ====
-In this scenario, 2 people with Tox ID's meet in person, and exchange the ID's in front of each other, enter the ID's manually, and send a test message. This is equivalent to manually verifying a fingerprint in OTR.+In this scenario, 2 people with Tox IDs meet in person (or using any other secure channel), and exchange the IDs in front of each other, enter the IDs manually, and send a test message. This is equivalent to manually verifying a fingerprint in OTR.
  
-==== Using Tox: URI's to ease entering Tox ID's, Manual Out-Of-Channel Verification ==== +==== Using Tox URIs to ease entering Tox IDs, Manual Out-Of-Channel Verification ==== 
-In this scenario, a user creates a Tox: URI which is used to help fill out the Add Friend form. The security of this method depends on the security of the method used to transfer the Tox: URI. [[users:toxlinks| See Also]]. +In this scenario, a user creates a Tox URI which is used to help fill out the Add Friend form in a Tox client supporting Tox URI feature and registered in your system as Tox URI handler application. The security of this method depends on the security of the method used to transfer the Tox URI. [[users:toxlinks| See Also]].
- +
-==== Using ToxDNS Services to ease entering Tox ID's ==== +
-ToxDNS services provide an email-like username that can be looked up and will correspond with a Tox ID. These might be difficult to verify, but the meeting in person with the other party and sending a test message can show that messages are going to the intended recipient at that particular moment. [[users:toxdns| See Also]].+
  
 ==== Useful resources for verification of regular OTR Identities ==== ==== Useful resources for verification of regular OTR Identities ====
-I'm going to use this information to come up with the content of this page. The principles need to be adapted for Tox but some of them still apply, especially when using ToxDNS.+I'm going to use this information to come up with the content of this page. The principles need to be adapted for Tox but some of them still apply.
  
 [[https://ssd.eff.org/en/module/how-use-otr-windows| EFF's How To Use OTR on Window's Guide]] See sections "Chatting Securely" to "Working with Other Software." [[https://ssd.eff.org/en/module/how-use-otr-windows| EFF's How To Use OTR on Window's Guide]] See sections "Chatting Securely" to "Working with Other Software."

Trace:

Print/export