Over the past several years, there has been an evolution in end-to-end encryption (the acronym E2EE for short) messaging services. “WhatsApp”, undoubtably the most popular and most utilized E2EE service in the world (estimated 2 billion users), was acquired by Meta (Facebook) over 7 years ago. Second to “WhatsApp”, the E2EE messaging platform “Telegram” has over 800 million users. It would be safe to deduce that privacy oriented communication has become a staple for the world today. While the average user of these messaging services simply seek ways to circumvent long distance calling fees as well as roaming fees associated with their cellular service provider, there is a small percentage of those who utilize the E2EE apps as a means to mitigate the threat of law enforcement monitoring as well as seeking services who do not retain any user data to be compelled by law enforcement.
While “Telegram” remains the preferred method of communication for those involved in criminal activities from terrorism to fraud, there has been a paradigm shift in the messaging app of choice for those who operate on the colloquially known “dark web”. For the past several years, the E2EE service “WickrMe” had been the preferred app for those vending contraband on the “dark web”. Vendors often hosted their own chat groups on the service in tandem with answering clients directly.
The success of “WickrMe” as well as the paid service “WickrPro” did not go unnoticed, and in a fashion similar to Meta’s acquisition of “WhatsApp”, Amazon acquired the “Wickr” platform in 2021. This sent shockwaves through the “dark web” underworld, with both vendors and consumers concerned with the sanctity of the app.
In October 2021, Vice released an article covering a possible investment into the “Wickr” platform by both the CIA and Department of Defense. This was effectively the death blow for “Wickr” as the preferred app of the “dark web” underworld. Tweets from Edward Snowden and the chatter on Reddit threads became that “Wickr” was now controlled by the U.S. Government.
To fill the void left by “Wickr”, the service Tox Chat has become a tentative replacement. Conceived in 2013 by a small group of developers, Tox Chat has grown exponentially…now supported in various formats: uTox (Windows/Linux), qTox (Windows, Mac, Linux), aTox (Android), “Toxygen” (Python) and “Toxic” (Linux) with open source developer support through GitHub.
With the usage of aTox, users can communicate in a similar fashion as “Wickr”. As of December 2021, a recent update aTox (0.7.0) allowed the support of audio calling, as well as withstanding support for video/audio calling between qTox and uTox users. ToxChat states that it does not have centralized servers and provides a publicly available list of Tox Bootstrap Nodes
While the infrastructure of ToxChat offers protection for users due to non-centralized servers and decentralized hash table (DHT), the encryption protocols of the messages in transport employed by ToxChat ensure protection (NaCl, curve25519, xsalsa20, and poly1305). ToxChat also offers further protection for end-users, whereas a password can be required to decrypt the chats. This could be important in case an end-user loses physical control of their account.. Another heightened security feature is the users are only identified by the Tox ID, which is a string of alpha-numeric text versus @username. Since there is no centralized server, it is not uncommon for a subject to have multiple Tox IDs across the various versions of Tox offered. This is important for security as a user’s Tox ID is only available if it is shared versus searched.
Example: 56A1ADE4B65B86BCD51CC73E2CD4E542179F47959FE3E0E21B4B0ACDADE51855D34D34D37CB5
Secure E2EE platforms are definitely in high demand and a highly scrutinized topic for those that operate in the criminal underworld, specifically those who want to remain as anonymous as the dark web markets where they operate. While “Telegram” will likely remain most utilized and the archetype of E2EE apps, countries have called for “Telegram” to regulate its content and a recent critical study about “Telegram” governance published by Yale Law School have likely made the future of “Telegram” uncertain. It is quite possible that ToxChat may become the new preferred E2EE app of choice.
