PHphilonoist·Feb 14, 2025Submission
Ricochet: Peer-to-peer instant messaging system built on Tor hidden services (2017)
117 points · Open discussionricochet-im
ricochet
C++2014–2025
ricochet-im / ricochet
ricochet
Anonymous peer-to-peer instant messaging
14Distinct people
17Mentions
0Explicit recommenders
3.9KGitHub stars
What to know before exploring
What it is
Anonymous peer-to-peer instant messaging
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year17 dated mentions
Observed mentions: 2014-06-05 14:38:29 UTC to 2025-02-14 08:34:31 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 3 | 2 | 1 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 3 | 1 | 2 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 1 | 1 | 0 |
What Hacker News says
17 sourcesThis sounds like a much more polished alternative to Ricochet: https://github.com/ricochet-im/ricochet
In Quiet – Encrypted P2P team chat with no servers, just TorI think something like Ricochet (if it were still actively maintained) could be a good solution.
https://github.com/ricochet-im/ricochet
Every user is their own Tor onion service, so you get E2E encryption and no centralized servers. The whole thing hinges on the security of Tor itself which is probably a safe enough bet.
In Code from the FBI’s Anom encrypted messaging appCheck out https://github.com/ricochet-im/ricochet/blob/master/doc/prot.... It is metadata-free. It does not require a centralized server. It uses Tor.
Goals of the project (solved):
Users aren't personally identifiable by contacts or their address
Communication is authenticated and private
No person or server can access contact lists, message history, or other metadata
Resist censorship and monitoring at the local network level
Resist blacklisting or denial of service against users
Accessible and understandable for non-technical users
Reliability and interactivity comparable with traditional IM services
OK, the accessibility part is not implemented, but that is besides the point. I am not arguing in favor of using Ricochet here, so it does not matter anyways. FWIW, it has been audited.
In How to build large-scale end-to-end encrypted group video callsI do not think that OP was referring to implementing it the same, or even in a similar way, but to use a username/password pair. OP is free to correct me if I am wrong though.
In any case, elimination of metadata done right is the way Ricochet[1] does it. The recipient can calculate the sender's contact ID based on the public key, and authenticate it by verifying the signature on the request. This proves that the sender can publish the hidden service represented by their contact ID. You can read more about it here: https://github.com/ricochet-im/ricochet/blob/master/doc/desi...!
[1] https://github.com/ricochet-im/ricochet (maintained fork: https://github.com/blueprint-freespeech/ricochet-refresh)
In How to build large-scale end-to-end encrypted group video callsThe design doc is here. https://github.com/ricochet-im/ricochet/blob/master/doc/desi...
It describes one of its goals as, "Resist blacklisting or denial of service against users."
Preventing both blacklisting and DoS seems contradictory to me in an anonymous messaging protocol. If an anonymous party wants to spam me to make the product effectively unusable, I either need to be able to blacklist them, or to whitelist known contacts, in which case none of them are anonymous.
In Ricochet-IM: Anonymous, decentralized, metadata-resistant instant messaging> P2P messaging apps have a hard time with group messages
Well https://tox.chat and https://ring.cx (now Jami) can do just that as well as https://briarproject.org.
So these do exist. Such a thing was also being proposed for Ricochet https://github.com/ricochet-im/ricochet/issues/54
In WhatsApp has an encrypted child porn problem> I wish the page had screenshots.
The Github page has one: https://github.com/ricochet-im/ricochet/
> As far as I can see currently the only widely used, secure protocols are Matrix and XMPP with OMEMO.
secure != metadata free
In Sunsetting Tor Messenger> That doesn't look very promising.
Please see this comment by Sarah, https://github.com/ricochet-im/ricochet/issues/555#issuecomm...
```
Hi, I don't speak for @special, but I think some context might be useful.
There is currently a bunch of (official|unofficial) work going on in the wider ecosystem - most of it related to factoring out the base library[1] to go to make it more useful as well as porting the main client to go[2].
There are also a few experiments regarding running on mobile[3] and using ricochet and these other libraries for other things besides traditional IM[4].
Most of this wider work has been updated within the last couple of weeks, ricochet is still actively being worked on & used - just not in the most visible places right now.
Some of the features you have pointed to are sitting waiting for someone to come along and
Read the rest
design/write them. For most there is a lot of UX work that needs to be done in order for these features (layered crypto, hidden service auth, multiple profiles etc.) to be secure & useable.
In many cases, adding them to the new Go code might be preferable in terms of ease of implementation. That is partly why work is being put into the libraries there, to make new changes to ricochet as easy and as useful as possible. These libraries are also in development right now, and it may take a little while before everything comes together.
So the best thing people can do right now if they want to move these things along is to contribute to the discussions on the feature threads if they have ideas about how those features could work & to submit code/pull requests to the various code bases.
```
(I've updated the parent about bypassing bgp/dns etc. before I saw your reply)
The nice thing about using the onion address (transport layer) is that you have mandatory e2e authentication with only one id that solves multiple real world problems with bgp/dns/tls.
How would you propose to go further from current state-of-the-art WhatsApp to stop leaking meta-data? I know Ricochet is open to use a stronger encryption layer on top of Tor †.
† https://github.com/ricochet-im/ricochet/issues/72
In WhatsApp's Signal Protocol integration is now completeHave you never been paid to 'audit' the code and/or architecture of a company's operations? It's not my forte, but I assumed some process of the sort was occurring.
Anyway, beyond OTF, do you have any opinion on Ricochet (the project theoretically under discussion), it seems to be a project with admirable goals and an interesting take (though I'm not interested in 'real-time' messaging):
https://github.com/ricochet-im/ricochet
In 'Ricochet', the Messenger That Beats Metadata, Passes Security AuditA downside with Ricochet is that it reveals when you are online to anyone who knows your id.
> Anyone with the onion address can still estimate availability by watching descriptors
https://github.com/ricochet-im/ricochet/issues/155
In Telegram stalkingAnonymous peer-to-peer instant messaging
1 points · Open discussionAlso in this space: https://github.com/ricochet-im/ricochet - seems to have some pretty notable people involved.
In Firestr: encrypted P2P chat and Lua application platformRicochet: Anonymous open-source P2P instant messaging
6 points · Open discussionShowing the 15 most recent of 17 sources. Enable JavaScript to search and browse every indexed mention.