Still no audit, right? Just “trust us, it's secure”. And afaik the authors don't have particular expertise in security.
Edit: also, “it's secure, we use Nacl”: https://github.com/irungentoo/toxcore/issues/121
In Tox: Decentralized and Encrypted Instant Messagingirungentoo
toxcore
C2013–2021
irungentoo / toxcore
toxcore
The future of online communications.
37Distinct people
43Mentions
0Explicit recommenders
8.7KGitHub stars
What to know before exploring
What it is
The future of online communications.
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- jfreegman/toxic · linked in 2 of the same discussions
- markwinter/antox · linked in 2 of the same discussions
- notsecure/utox · linked in 2 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year43 dated mentions
Observed mentions: 2013-07-08 16:51:17 UTC to 2021-10-05 16:39:09 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2013 | 2013-01-01 00:00:00 UTC | 2014-01-01 00:00:00 UTC | 11 | 3 | 8 |
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 13 | 2 | 11 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 10 | 1 | 9 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 1 | 0 | 1 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
With the rise of government surveillance programs, Tox, a FOSS initiative, aims to be an easy to use, all-in-one communication platform that ensures full privacy and secure message delivery.
Website | Wiki | Blog | FAQ | Binaries/Downloads | Clients | Compiling
IRC Channels: #tox@freenode, #tox-dev@freenode
The Complex Stuff:
UDP vs. TCP
Tox must use UDP simply because hole punching with TCP is not as reliable.
However, Tox does use TCP relays as a fallback if it encounters a firewall that prevents UDP hole punching.
Connecting & Communicating
Every peer is represented as a byte string (the public key [Tox ID] of the peer). By using torrent-style DHT, peers can find the IP of other peers by using their Tox ID. Once the IP is obtained, peers can initiate a secure connection with each other. Once the connection is made, peers can exchange messages, send files, start video chats, etc. using encrypted communications.
Current build status:
Q&A:
What are your goals with Tox?
We want Tox to be as simple as possible while remaining as secure as possible.
Why are you doing this? There are already a bunch of free Skype alternatives.
The goal of this project is to create a configuration-free P2P Skype replacement. “Configuration-free” means that the user will simply have to open the program and will be capable of adding people and communicating with them without having to set up an account. There are many so-called Skype replacements, but all of them are either hard to configure for the normal user or suffer from being way too centralized.
TODO:
TODO
Documentation:
Compiling
DHT Protocol
Crypto
Read the full README on GitHubWhat Hacker News says
43 sourcesthe main dev of tox is kinda toxic to it's own project with kneejerk responses like these: https://github.com/TokTok/c-toxcore/issues/426 and https://github.com/irungentoo/toxcore/issues/121 showing much more enthusiasm than competence when it comes to security and crypto. while the people behind briar i got to know as reasonable and deliberate people.
can't say much about ring, but a few years back i looked at the crypto and it was boring, which some people argue is good, i was not sure about that in this case. dunno how much they evolved since then.
In Briar ProjectRegarding the citation, it is just a matter of reading how the core devs reply to potential security issues. Sure, it has gotten better, but it is not too far from the good old https://github.com/irungentoo/toxcore/issues/121
The fact is we mostly know what kind of attacks are possible on signal. We know metadata is a potential problem. We know what kind of tradeoffs we get with a centralised architecture. We know how that works and how to mitigate some things. Openwhispersystems have been clear about what Signal provides and what it does not provide (even the wording around disappearing messages is well chosen not to confuse people ).
With tox there is a lot we don't know. Are the supernodes an attack vector? Why aren't the devs clear about using a less distributed architecture for mobile clients? Why don't they provide proper forward se
Read the rest
crecy yet they claim to do so? There might be lots of strange properties of doing crypto distributed.
I would not recommend it for secure communication until the amount of unknowns is smaller. It is really that simple.
You may be thinking of this thread:
https://github.com/irungentoo/toxcore/issues/121
I couldn't find any evidence of an audit.
There is an actively developed Rust implementation of the core library here:
https://github.com/tox-rs/tox
Of course, any flaw in the specification (for example with respect to key exchange) will still apply if they've faithfully implemented it.
In The Tox projectAnd they somehow actively push adoption in narrow circles. I often see “why xyz if you have tox” in local forums, from people who are otherwise professional in their areas, but believe in tox almost blindly. It also doesn’t implement any sort of push notifications for phones, rendered useless for battery-saving modes and vaguely competitioning xmpp-otr.
https://github.com/irungentoo/toxcore/issues/1398 - discussion on homepage claims
https://news.ycombinator.com/item?id=12657891 - past
In The Tox projectThere's a lot of shady stuff surrounding Tox though see:
https://github.com/irungentoo/toxcore/issues/1379
Also:
https://blog.tox.im/2016/04/01/litigation/
I rather support KeyBase or Wire (Open Source back-end exists and I think the clients are open source too!) as an alternative. I'm leaning cleanly toward Wire, though everyone I've suggested KeyBase to enjoys it. I like the free storage of KeyBase... sue me.
Edit:
Wire Github: https://github.com/wireapp
In Sunsetting Tor Messenger> Homebrew crypto written by 4chan.
Where did you get that from? Tox uses libsodium. [0]
[0] https://github.com/irungentoo/toxcore/blob/master/docs/updat...
In Russia threatens to block TelegramYes, Open Whisper Systems. Signal is open source and meant to be accessible. There's also ToxCore - https://github.com/irungentoo/toxcore - which I have no experience with and I've heard sometimes the community is a little trollish, but it has similar goals.
Remember, any privacy project could use this help. All of them want to be accessible to the end user, including old-school tools like GnuPG. Often times these security engineers aren't very UX oriented and we like our command lines. Build good interfaces on top of them. Although a shitty name, Felony looked good for this: https://github.com/henryboldi/felony
Someone else asked a similar question in another Ask HN earlier, and I replied with this:
> Welcome to the fray.
> First: decide what your skills are, and where you can contribute.
> Try the Tor Project first:
> https://www.torpro
Read the rest
ject.org/getinvolved/volunteer.html.en
> The community is great there and very accepting of newbies that have the skills.
> Signal / open whisper systems also are open source and accept pull requests:
> https://github.com/whispersystems/
> Read the anonbib:
> http://freehaven.net/anonbib/
> Also, there are other mixnet/darknet projects that could use help, such as i2p:
> https://geti2p.net/en/get-involved
> And if you want decentralized, mesh communications, cjdns and the Hyperboria experiment:
> https://hyperboria.net/
Get involved with any of it. Push for the user, fight for the user. Make it accessible and message the shit out of it. All of them have their merits and any work toward any of them is progress.
Be warned, Tox claims to protect users from "governments", which is a huge claim.
Yet, it's written in C, it hasn't had a security audit, it does not publish a list of security risks and mitigations, and, regarding its roots in 4chan, see for yourself: https://github.com/irungentoo/toxcore/issues/1186
In TOX – A New Kind of Instant MessagingReminds me a lot of the Tox project, a peer-to-peer encrypted skype/IRC/IM replacement: https://github.com/irungentoo/toxcore Tox optionally supports Tor: https://wiki.tox.im/Tox_over_Tor_%28ToT%29
In Ricochet: An encrypted, anonymous IM client built on Tor hidden serviceshttps://github.com/irungentoo/toxcore/issues/121#issuecommen...
Not as bad as I remembered, but still... meh.
In Facebook Messenger XMPP is going awayIf you use a secure crypto primitive, is it correct to say your program is secure?
I mean, can you be sure something is secure just because of the crypto lib?
I thought there had something to do with the implementation too?
I ask this because of Tox. The main developer claims Tox is secure because of the crypto library.
It sounds weird to me, so I decided to ask... After all, if it was this easy all programs would be secure, right? Just import a secure crypto lib and it's done? Sounds weird.
https://github.com/irungentoo/toxcore/issues/121#issuecommen...
In Toxic – A distributed, secure, command-line based instant messenging clientI think it's because of changing 'project' to 'Foundation': https://github.com/irungentoo/toxcore/pull/1219#commitcommen...
In Toxic – A distributed, secure, command-line based instant messenging clientShowing the 15 most recent of 43 sources. Enable JavaScript to search and browse every indexed mention.