HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
maqp
tfc
Python2015–2026
maqp / tfc

tfc

Tinfoil Chat - Onion-routed, endpoint secure messaging system

Security & PrivacyCommunication & Social
Explore on GitHubRead Hacker News discussions
17Distinct people
44Mentions
1Explicit recommenders
1.3KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Tinfoil Chat - Onion-routed, endpoint secure messaging system

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

Thanks to everyone, I have realized I need to be more specific. I'm setting up my personal website, at myname.url , and I want to have a way of letting people get in touch with…

imagineerschool used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year44 dated mentions

Observed mentions: 2015-02-08 14:32:51 UTC to 2026-06-04 03:16:13 UTC.

02462015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 1 mentions; 1 submissions, 0 comments20152016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 1 mentions; 1 submissions, 0 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 2 mentions; 1 submissions, 1 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 6 mentions; 2 submissions, 4 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 7 mentions; 0 submissions, 7 comments20202021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 5 mentions; 0 submissions, 5 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 5 mentions; 1 submissions, 4 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 7 mentions; 1 submissions, 6 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 5 mentions; 1 submissions, 4 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC110
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC110
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC211
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC000
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC624
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC707
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC505
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC514
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC303
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC716
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC514
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC202

What Hacker News says

44 sources
jazzyjackson·Jun 4, 2026
It's similar to the "Tin Foil Chat" [0] project for preventing exfiltration on a network connected device. You have 3 CPUs, one that's offline and accepts user input, has and creates encryption keys. When you want to send a message you create an encrypted blob and bitbang it over an optical diode (one way serial data flow) and the network connected CPU, which is untrusted and considered hostile, is simply asked to send the encrypted blob via tor hidden service so it knows neither content nor recipients. Messages are received as encrypted blobs and passed over a second one-way optical link to the third CPU, which is "offline" but also untrusted since it received arbitrary data from the network. It does at least have the keys from the upstream input device so it can verify the integrity of received messages and ignore any unsigned or unexpe
Read the rest
cted data. The trick there is, even though the 3rd CPU that does the decryption and can see plaintext secrets is vulnerable & untrusted, it has no network uplink so as long as no data is copy-pasted back to the upstream device, you can be assured no exfiltration. I toyed with the idea of having obtuse ways to bring data from the receiver back upstream to the sender (so that, for instance, I could forward attachments) but the whole point of the system is not to bring untrusted binaries into the first CPU which has both secrets and outbound network access. TL;DR I think you're on the right track, you might check out how Qubes handles clipboard access. [0] https://github.com/maqp/tfc
In The ways we contain Claude across products
maqp·Jan 31, 2026
>I don't really see how it's possible to mitigate client compromise. You could of course offload plaintext input and output along with cryptographic operations and key management to separate devices that interact with the networked device unidirectionally over hardware data diodes, that prevent malware from getting in or getting the keys out. Throw in some v3 Onion Services for p2p ciphertext routing, and decent ciphersuite and you've successfully made it to at least three watch lists just by reading this. Anyway, here's one I made earlier https://github.com/maqp/tfc
In US has investigated claims WhatsApp chats aren't private
maqp·Dec 15, 2025
Yup. As the guy who put together the most secure FOSS messaging system*, it's not "impossible to hack". It's a caveat ridden, inconvenient to use, tedious to setup, hardware-isolated, multinode application, with long must-read documentation, and that requires experience with electronics and soldering. * github.com/maqp/tfc
In “Super secure” messaging app leaks everyone's phone number
edgineer·Feb 20, 2025
I'll feel pessimistic like this, but then something like Tinfoil Chat [0] comes along and sparks my interest again. It's still all just theoretical to me, but at least I don't feel so bad about things. With a little bit of hardware you could get a lot of assurance back: "Optical repeater inside the optocouplers of the data diode enforce direction of data transmission with the fundamental laws of physics." [0] https://github.com/maqp/tfc
In Multiple Russia-aligned threat actors actively targeting Signal Messenger
maqp·Aug 26, 2024
You're missing Tor, and metadata reducing messaging like https://cwtch.im/ Also Mullvad Browser is a worthy addition given that its basically Tor Browser with the VPN instead of Tor-gateway. Same excellent metadata reduction tweaks, and you don't have to configure anything. Oh and since this is against APTs my work might be useful for messaging: https://github.com/maqp/tfc It's as close to NSA-proof you can get. Naturally, if the government parks their flower van across the street and grabs your keyboard cable's spurious radio waves* or installs a cam in your house you're SoL, but otherwise you should be pretty good. * https://en.wikipedia.org/wiki/Tempest_(codename)
In Essays: NSA Surveillance: A Guide to Staying Secure – Schneier on Security
maqp·Aug 25, 2024
I know a bit about this topic. For metadata you first want to remove the obvious identifiers, phone numbers, names. You'd want to use something like anonymous@jabbim.pl for your IM account. Next, you'd want to eliminate the IP-addresses from server, so you'd want to connect exclusively through Tor. So you'd set the IM client proxy settings to SOCKS5 localhost:9150 and run Tor client to force your client to connect that way. This is error-prone and stupid but let's roll with it for a second. Now jabbim.pl won't be able to know who you are, but unless you registered your XMPP account without Tor Browser, you're SoL, they already know your IP. A better strategy is to use a Tor Onion Service based XMPP server, say 4sci35xrhp2d45gbm3qpta7ogfedonuw2mucmc36jxemucd7fmgzj3ad.onion (not a real one), and you'd register to it via IM client. Now you c
Read the rest
an't connect to the domain without Tor, so misconfiguring can't really hurt. So that covers name and IP. We'll assume the content was already end-to-end encypted so that leaks no data. Next, we want to hide the social graph, and that requires getting rid of the server. After all, a server requires you to always route your messages through it and the service can see this account talks to this account, then to these ten accounts, and ten minutes later, those ten accounts talk to ten accounts. That sounds like a command structure. So for that you want to get rid of the server entirely, which means going peer-to-peer. Stuff like Tox isn't Tor-only so you shouldn't use them. For Tor-only p2p messaging, there's a few options https://cwtch.im/ by Sarah Jamie Lewis (great, really usable, beautiful) https://briarproject.org/ (almost as great, lots of interesting features like forums and blogs inside Tor) https://onionshare.org/ by Micah Lee. Also has chats between user and hoster https://github.com/maqp/tfc by yours truly, crude UX but the security is unparalleled. >On a side note, I was just recommending Telegram as alternative to WhatsApp Don't. Telegram and WhatsApp both leak meatadata, but WhatsApp is always end-to-end encrypted. Telegram is practically never end-to-end encrypted. I'd use WhatsApp over Telegram any day. But given that unlike WhatsApp, Signal is open source so you know the encryption works as advertised, it's the best everyday platform. The metadata free ones I listed above are for people in more precarious situations, but I'm sure a whistleblower is mostly safe when contacting journalists over Signal. Dissidents and activists might find Cwtch the best option however.
In Is Telegram really an encrypted messaging app?
maqp·Aug 25, 2024
>You can have your phone compromised (especially when I know your phone number, Signal I’m looking at you) or be subject to other means of attacks, exposing everything. Knowing someone's phone number doesn't automatically let you compromise their device. This is such a ridiculous argument. >I would rather know that this app is not secure so I don’t share anything important, while keeping secure communication to other means. This is nirvana fallacy. It's essentially saying "We should not talk about Telegram lying about its security, when in reality nothing is 100% secure". Yeah, nothing is, there's always an attack. That doesn't contribute anything of interest to the topic, it just tries to kill the criticism. And I'm saying this as someone who has worked on this exact topic for ten years: https://github.com/maqp/tfc
In Is Telegram really an encrypted messaging app?
jazzyjackson·Aug 6, 2023
The encryption protocols available haven't been the weak link for some time, no one cracks the messages in transit; you just go for the endpoint. If you can hack the OS and exfiltrate screenshots it doesn't matter how secure your app or network channel is. The only approach that's given me hope has been Tin Foil Chat, isolating the keychain from the network. Me and some fellow noisebridgers built a kind of cyberdeck prototype implementing this but couldn't find much interest in commercializing it. Since the input stage is isolated from output, you can't copy paste any public keys but have to enter them manually (448bits as 56 characters) and messages/attachments can't be forwarded. Juice wasn't worth the squeeze overall. We'll see if there's a milder approach here but I don't see anyway to get around the endpoint security. https://github.
Read the rest
com/maqp/tfc
In Cult of the Dead Cow wants to save internet privacy with new encryption protocol

Showing the 15 most recent of 44 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.