TLDR; Combining TOR, WebRTC and Git into a Decentralized Signal-protocol encrypted P2P Messaging App

This is a fairly a unique stack and architecture in contrast to the traditional approach with mainstream messaging apps. To put it briefly, its a Rust-based frontend with a Git-server backend, which can be used to establish a E2EE Tor/WebRTC connection.

• Roadmap/FAQ: glitr.io/docs/technical/roadmap
• App: app.glitr.io

Features:

• No installation
• No registration
• PWA
• Android
• TUI
• WebRTC
• Tor routing
• TURN server
• Git-host backend
• Local-first
• Encrypted-at-rest
• Signal protocol
• PQC
• Calls
• File-transfer

IMPORTANT DISCLAIMER: While this is aiming to provide a secure experience, it's a work-in-progress and far from finished. It is unreviewed and unaudited. I'm sharing here for testing, feedback and demo purposes only. Pease use responsibly.

FAQ: https://glitr.io/docs/technical/roadmap/#faq

I found SunshineDE on daunt and wanted to know if any of you guys know if its a scam.

Aside from using Ahmia or accessing onion links, do y'all use TOR for a different purpose? like idk watching videos for example, is there anyone who doesn't use TOR for daily mondane activities?

I'm just posting for no reason cuz I'm bored

Researchers published a paper titled On the Effectiveness of NetFlow-Based Deanonymization of Tor Onion Services.

Their research demonstrates that attackers with access to certain network traffic records may be able to identify the network location of an onion service.

The researchers investigated three techniques, including one that exploits information exposed by Tor's proof-of-work denial-of-service defenses.

The concerning discovery: Some attacks worked using relatively coarse network measurements rather than detailed packet captures.

The researchers evaluated their techniques using data from the live Tor network.

Tor encrypts traffic and conceals network locations, but traffic analysis remains a potential weakness.

An attacker who can correlate traffic patterns may infer information without decrypting the underlying communications.

This research concerns onion-service anonymity. It does not establish that ordinary Tor Browser users can be routinely identified.

GoBalance Vulnerability Independently Analyzed — Dread Wasn't the Only Service Affected

Researchers at Searchlight Cyber published a detailed technical investigation into the GoBalance vulnerability connected to the recent Dread onion-address hijackings.

Their findings substantially strengthen the technical explanation previously attributed to Dread administrator Paris.

The researchers identified a specific cryptographic implementation error.

GoBalance incorrectly handles Tor-format Ed25519 private keys during descriptor signing, discarding secret material needed to generate unpredictable signatures.

An attacker can potentially recover an affected onion service's long-term signing secret from publicly available descriptor information.This does not require access to the service's actual servers.

The researchers also established an important distinction: the vulnerability affects GoBalance's handling of certain Tor-format keys, not the original Onionbalance implementation or Tor itself.

A separate researcher has published a proof of concept, although an official GoBalance fix was not available in the reporting reviewed on October 9.

Independent technical analysis supports the vulnerability. The precise circumstances of each reported hijacking and claims about stolen user databases remain unverified.

An attacker recovering an onion service's master signing secret can impersonate that address even if the legitimate service's servers remain secure.

Simply patching the vulnerable software does not make an already exposed identity key trustworthy again.

Affected operators need fresh identity keys and authenticated migration announcements.

whadefok bradar what is this

Is dread's third site down too? Or is it just... a regional thing?

Hello, I came here today because I have a few questions.

This may be a sudden question, but is Dread currently inaccessible?

I heard that its private key was leaked and abused by a third party, causing the old link to go offline. However, I can't access Dread through the forum I normally use. When I looked at other sites, some said the link was online, while others said it was offline, and some even said that the link was dead. I'm really confused about what is actually happening.

Could someone please explain what is going on?

I also came across this forum site while looking for a Dread link:

https://dread-forums.ne t/

The site also provides a Dread link. I'm not sure whether either of them is genuine, and personally, I find the site somewhat suspicious, so I came here to ask about it.

Even though I was already somewhat suspicious, I followed the link to Dread. The login page looked strange, and no matter whether I clicked Messages or Profile, I was always redirected back to the Home page. I also couldn't post any comments.

Unfortunately, I already tried logging in several times...

Is this forum site potentially dangerous, or is it actually legitimate?

If anyone knows more about this situation, I'd appreciate it if you could let me know.

I was logging in all day np. I refresh after a few hrs & it's conclave again.

Idm how deep this goes but we had a community & without hacing names & pgp for everyone and continuing ongoing ads/promos will be a fuckin PITA for tons of users & business ppl.

MF man.MF

Just curious, had a "friend" say its very common

I've recently discovered this thread and have been seeing people mention dread network or something. I'm just curious, what's that?

i accessed it yesterday and apparently this happened several days ago so i'm scratching my head.

Has anyone here been caught not from a technological standpoint or having a package intercepted, but just from running your mouth? Most people don’t believe me when I talk about how I ran my mouth about the oil I had back when I was 18 and people made noise to the point that I had a certain three-letter agency open an investigation into me, spanning over the course of two years.

The free Tor browser VPN used to hide my location, allowing me to access content unavailable in my country. I always use the Tor browser itself for this also.

However, since updating my iPhone, I have been blocked from this content even while the VPN is in effect, and my IP address has been changed. I have used data instead of WiFi and disabled location services, yet this issue persists.

Are there any solutions or VPNs which function to change this?

I’ve been interested in the dark web for a while—more for its atmosphere and culture than for the things usually associated with it (illegal marketplaces, etc.). I’ve just installed Tor and would like to do some real exploring, but while staying strictly within legal and safe boundaries.

What I’m looking for: .onion sites with a dark or mysterious aesthetic, but nothing illegal or dangerous—for example, digital libraries on esotericism or exorcism, showcases of "cursed" objects or oddities (just for viewing, not buying), archives, folklore, or things that are a bit gothic or offbeat.

If you have any reliable addresses or up-to-date directories to recommend (like Ahmia or others), I’d love to hear them. Thanks in advance!

I'm trying to buy stuff,

found a vendor that has good reputation, tried to purchase,

while trying to encrypt my message I noticed that the user IDs are revoked (but not the key itself)

what does that mean ?

should I worry ?

I am a teen and have been looking at ways to protect against government surveillance and just privacy from companies alike, any thoughts or suggestions?

Trying to access DH on Ornet app and just get this every time tired of this being the only site i can’t get into

Tor Browser 15.0.22 released today for high-severity Tor security issues

✅ Confirmed — official Tor Project release, September 9.

The Tor Project released Tor Browser 15.0.22 today, updating the bundled Tor daemon to 0.4.9.12. The underlying Tor release was issued last night specifically to address a series of high-severity security issues. The Tor Project is deliberately withholding most technical details for roughly a week to give users and operators time to patch.

More unusually, Tor says it is still working on additional important security issues and is moving C-tor to a two-week release cadence for now. The next planned release is around September 22, although that could change if another urgent fix is required.

Why it matters: Tor Browser users should update to 15.0.22 as soon as possible rather than waiting for disclosure of the vulnerabilities. Relay and onion-service operators running C-tor should update to 0.4.9.12 as well. The fact that Tor calls the issues high severity, recommends immediate updating, and says more security work is underway makes this especially significant.

https://blog.torproject.org/new-release-tor-browser-15022

Hey guys, I’ve been exploring the Tor network for a bit to understand how private systems operate. I’ve thoroughly checked out standard landing directories, but I feel like I've run out of clean, reputable index lists to look at.To give you an idea of my setup, I'm running Tails OS completely non-persistently on a standard, generic x86 laptop layout. For complete device isolation, the internal solid-state storage and internal wireless network cards have been physically extracted, and the system relies entirely on a hardwired network interface instead.I also practice strict browser hygiene by keeping the Tor Browser window at its default stock resolution to counter screen dimensions fingerprinting, and I browse exclusively with "Safest Mode" enabled to keep JavaScript completely disabled.Since I am purely researching and window-shopping, I want to keep things entirely secure, clean, and educational. Are there any other hardware-level or network safety measures you'd recommend adding to this type of layout? Also, what are your favorite reputable, well-known text-based hidden archives, open forums, or whistleblower platforms? Please only drop well-established, clean links so the moderators stay happy.

Thanks in advance!