Peer Group

The popular messaging application WhatsApp has recently alienated many users with its new terms of service and privacy policy. It's a situation that once again illustrates that when you put yourself in the hands of a proprietary service, you put yourself at the mercy of the operator. If you are dissatisfied with a change, either you grudgingly continue using the service, or you move to a different application with similar features.

In the case of WhatsApp, there are quite a few alternatives, and many were suddenly overrun with WhatsApp users looking for another option. This article looks at the different categories of messaging services, and then delves into one particular option – using peer-to-peer messaging apps based on the Tox protocol.

Open Source Clients

Signal [1], Threema [2], and Telegram [3] are widely regarded as good alternatives to WhatsApp, partly on the grounds that they operate more freely and openly than the Facebook service. This typically means releasing the app source code under open source licenses and disclosing the underlying protocol so that other app developers can develop alternative clients (see Table 1).

However, discussions of social media alternatives often leave out one very important component: the server. All providers keep a watchful eye on the server and therefore on the data. Telegram and Threema do not disclose the source code for the server. Signal does provide the source code for the server under a free license, so users could theoretically build their own Signal servers. However, the software is designed in such a way that the different instances cannot talk to each other. If the same principle applied to email, then users of one service (such as Yahoo Mail) would not be able to send messages to those of another service (e.g., Gmail).

Federated Systems

True freedom exists only if the service discloses the source code of the server and client(s) and the underlying protocols. In addition, the network systems must operate in a federated manner, that is, in a distributed manner (federation). However, this kind of freedom goes against the business interests of commercial providers. Therefore, none of the major providers offer this level of freedom. What remains are services and programs such as Dino [4] and Quicksy [5], which are based on the classic XMPP (formerly Jabber) [6], and applications such as Element, which is based on the Matrix [7] open communications protocol.

Peer-to-Peer Networks

Instant messengers can do without any kind of a central authority. They work in a similar way to file-sharing programs like eDonkey or BitTorrent. Messages or voice and video chats travel directly from computer to computer (peer-to-peer) over the network. The contacts are organized with the help of a distributed hash table (DHT). End-to-end encryption ensures that privacy is maintained and that only the sender and the recipient can read the messages.

In this category, the selection of programs is thinned out even further. The last tools standing are Briar [8], Jami [9], and Tox [10]. Briar is available exclusively for Android-based smartphones and tablets. I have already covered Jami in detail in a previous issue [11], so now it is time for a closer look at Tox.

Tox in Practice: qTox

Compared to the other two peer-to-peer messengers, the main advantage of Tox is that there are a number of different client programs, including at least two specifically for smartphones. These various options will be discussed later in the article, but to evaluate the practicality of Tox, we chose to test the default client qTox [12], which completely covers the functional range of Tox.

The current version, qTox 1.17.3, has not yet made it into the package sources of all common distributions. If you're using another version, make sure it's at least qTox 1.17.0, which saw many new features added and bugs fixed. You can use the package manager for the installation; the package name is usually qtox.

At first startup, create a new Tox profile with the New Profile tab. You are free to choose your username and password (Figure 1). A password is not mandatory; however, it ensures that qTox encrypts all your data such as your contact list and chat histories for storage on the hard disk. You can change your username later if necessary, but the actual identification in the Tox network is done by a 76-digit ID. After clicking Create Profile the program loads the actual application window (Figure 2).

Figure 1: Most Tox clients allow alternating different Tox IDs (quasi user accounts).

Figure 2: Incoming images, as shown in the example here, must first be accepted by the addressee.

When tested on Manjaro Linux, qTox had English as the default setting. If you prefer a different language, you can access the settings via the gear icon below the contact list. To open your profile, tap on the generic user picture or the username. You can customize your profile image (by clicking on it), the username, and your status (Figure 3) here.

Figure 3: On the Tox network, you are identified by a cryptic Tox ID. For contact requests, you need to know the Tox ID of your future Tox friends.

Below you will find the Tox ID associated with the profile. To communicate with a partner, you need to send this 76-character mess over a secure channel. For users of one of the smartphone apps, there is an option to save the ID in the form of a QR code. The image can then be scanned directly with a phone using a barcode scanner app, eliminating the need to type in the ID.

Setting Up Contacts

To create a new contact yourself, tap the plus icon below the contact list. Then enter the ID in the Add a friend tab, and if necessary add the message to the friend you want to invite. Optionally, in the Import contacts tab, you can import a whole bunch of friends in one go. For this qTox reads in a text file in which you list the contacts in the form of their Tox IDs line by line. Last but not least, in the Friend Requests tab, you will find all the contact requests that have not been answered yet (see the box, "Spambots," for dealing with suspect friend requests).

After sending a friend request, the user receives a notification. If the person has accepted your invitation, the contact automatically appears in the contact list with that person's username and picture. If you click on the entry, a message area typical for instant messengers opens. At the bottom of the text field, enter your message; next to it, you have the option to add emojis or send files.

Tox transmits text messages directly after clicking the speech bubble or pressing the Enter key. The recipient first has to accept the transmission of files such as images. A timestamp shows you when the message was sent. A rotating circle indicates that qTox still has to transmit the message. Tox does not have a comprehensive status display like WhatsApp (message not yet sent, transferred, or read).

Audio and Video Calls

Above the message history, next to the contact's profile picture, you will find the contact name. If you have trouble remembering which friend goes by which username, click on the entry, and you can give your contact a name you will recognize. Next to it are the switches for starting an audio or video call. You can set the devices used during calls and their properties (for example, the sound quality of the microphone or the resolution of the webcam) in the settings in the Audio/Video tab.

In our test with a second PC running qTox as well as a smartphone using a Tox client called Antox, phone calls worked very well and without much delay (Figure 4). Both via a broadband connection and the mobile network (4G), the sound quality was similar to a conventional phone call via landline or a WhatsApp call.

Figure 4: In addition to classic, text-based chats, many Tox clients also support audio and video calls.

For video chats, qTox can't quite keep pace with proprietary solutions. The video image is pixelated for a short while at first. After the connection is stabilized, the image fully composes itself. The picture also lost its cohesion for a short time during abrupt changes in the picture, such as fast pans, in our tests. However, these are minor issues; video calls basically work.

Additionally, qTox supports screen sharing, although that will require some setting changes, (see the "Setting Up Screen Sharing" box).

Group Chats

Modern messengers need to support conversations with multiple contacts in addition to communication between two people. qTox offers the possibility to set up group chats for this purpose. The initiator of the chat group must have all the desired members as friends in their contact list. Now, tap the group chat icon below the contact list and then select the option to create a new group. The default name of the chat is Group name #1; use the context menu to rename the group appropriately.

In order for your friends to join the group, you have to send them an invitation. To do this, right-click the desired contact and select Invite to Group from the context menu. You can either use one of the previously created groups or create a new one directly. Repeat this step with all the contacts that you want to join the group chat. qTox will now notify your friends about the invitation. Once they accept the request, they can chime in. There is no chat log: If one of the contacts switches off their computer and thus the Tox client, they miss all the group messages sent in between.

Besides the classic text-based group chat, qTox also supports telephone conferences. To do this, tap the green phone icon above the chat history. At first glance, nothing changes, but as soon as the contacts in the group chat have enabled the telephony function, you can hear each other. Only people who enable this on their phones can hear the conversation. An option for video calls in a group is not available for qTox so far. The button for the video function is grayed out in the current version.

Advanced Functions

Tox's operating principle currently requires that both contacts on a call be online at the same time. The online status is visualized by a filled green or empty red dot to the right of the username in the contact list. Offline messaging is not yet supported by Tox. One of the reasons for this is that there is simply no central server that temporarily stores messages that cannot be delivered at the moment and then delivers them as soon as the addressee gets back online.

However, Tox users do not have to do without offline messages entirely. As a workaround, most Tox clients (including qTox) support pseudo-offline messages [13]. Write a message to a contact currently displayed as offline, and then the client keeps the message in memory. As soon as the contact gets back online, the program sends the reset message. Until then, qTox shows a rotating circle next to the text, which signals that delivery is still pending. However, that requires you to stay online as well.

The integration of real offline messages is on the developers' to-do list, as well as the possibility to use a Tox profile on multiple devices at the same time – for example, with qTox on the PC and in parallel with Antox on the smartphone. Currently, a profile can be exported and transferred to another computer, but clients with a copied profile must not be online at the same time. If you try it, Tox gets confused: Contacts come online and go offline again permanently, or messages and data transfers are lost.

Other Tox Clients

The Tox project maintains a list of compatible clients [14] on its website. The open source protocol underlying Tox allows independent developers to program additional Tox clients, and users have the opportunity to select a client that optimally fits their requirements. However, it is important to be careful when testing: Not all of the alternative clients have the same functionality as qTox. Depending on the stage of development, they may only support a feature subset (see Table 2).

Here are a few other things to know about these clients. Both qTox and uTox are reference implementations of the Tox protocol [15], and both applications are available for Linux, FreeBSD, macOS, and Windows. uTox has fewer dependencies than qTox as it does without the Qt framework and is more frugal with resources.

The Venom [16] client is optimized for Gnome. Venom is currently available as version 0.5.5 and integrates cleanly into the Gnome desktop as a GTK3 application, but voice and video chat support is not planned until release 0.6. Overall, the program cuts a good figure despite its young age. It clearly organizes the contact list and chats and already implements group chats (Figure 5). In the default configuration, Venom does not save anything except for the contact list; even the chats disappear into a black hole after the program is closed. To prevent this, go to the settings and then in the General tab, move the slider next to the Save chat history option to the right.

Figure 5: Venom, which is still in development, offers many features, but support for audio and video calls is still missing.

Toxic [17] is a text-based console client that can be found in the package sources of all major distributions. After installing the package of the same name, call Toxic from a terminal window via toxic.

Toxic requires a little more explanation, because it's not immediately obvious how to access the different functions. An initial overview is provided by the help feature, which you call by typing /help. For example, you can invite contacts via /add <Tox-ID> "Message". You can discover your own ID using the /myid command. Ctrl+O and Ctrl+P let you switch between the status window, the contact list, and the individual chats, which are organized in tabs in Toxic.

Since Toxic does not necessarily require a graphical interface, Toxic can run on a server that is accessible via SSH, for example. You will always be online there and continuously reachable, so that you will never miss any group message. On a computer with a graphical interface, you do not have to do without audio and video chats despite working with a command-line program. /lsdev in and /lsvdev in, respectively, tell Toxic to list the input devices for image and sound that exist on the system. You can then use /sdev in <ID> and /svdev in <ID> to select the microphone and webcam.

You can then start a video call (with a picture) from an active chat with /call or /vcall. Toxic plays the corresponding videos in windows that pop up (Figure 6). In the default configuration, the program initially displays only the image of the other person; you need to explicitly enable your own camera with the /video command. Toxic uses the minimum resolution of the webcam. With a command like /res <800> <600> you can adjust the quality to utilize the available bandwidth and the technical limits of the webcam.

Figure 6: Toxic, intended for use in the terminal, supports pretty much everything. Launched on a system with a graphical desktop, the client even supports video calls.

Antox [18] and aTox are clients for Android smartphones. Antox copes well with phone calls and video calls, but does not yet support group chats (Figure 7). If you try to invite a contact to a group via qTox, which is connected to the Tox network via Antox, this fails. The corresponding menu item is grayed out in the dialog of the program. This smartphone app has the advantage of being virtually always online. The capability for pseudo-offline messages is therefore of little consequence here. However, Antox still has a few issues to work out. Sending and receiving messages worked reliably in our tests, but opening a sent picture always resulted in a crash.

Figure 7: The Antox Android client copes well with audio and video calls but does not yet have group chats.

The alternative aTox [19] proves to be more stable: Chats and sending pictures and data worked without complications with the Android app. However, it cannot handle audio and video chats, nor can it handle groups. aTox does not even tell you that it does not support these functions. In qTox, for example, the invitation function (as opposed to an Antox contact) remains enabled, but the invitation simply fails. Moreover, the program is not yet available from any app store, neither on Google Play nor on the open-source F-Droid marketplace. Installation therefore relies on the APK file provided on the project's GitHub page.

Conclusions

Many users have extremely high expectations of a potential WhatsApp alternative. It has to work as well and be as easy to use as the original, but has to do without companies and servers, as well as offer maximum control and give users all freedoms.

Reconciling all these conditions, however, is a difficult undertaking. It is the lack of a centrally organized user directory and switchboard that makes contact list maintenance more complicated for both developers and users. There are also restrictions when establishing a connection and sending data – as a user, you will notice this when establishing a video call or when you need to use pseudo-offline messages, for example.

Despite all this, Tox works and offers almost all the functions that WhatsApp and similar applications have in their repertoire. Only a few features are missing, such as viral message forwarding. However, if you consciously choose a P2P messenger like Tox, you will probably not have this on your list of requirements anyway.

One thing has to be said though: Tox does not explicitly guarantee the user's privacy. You are anonymous on the Tox network, and there is no mandatory registration. The messages are transmitted peer-to-peer and directly and encryption ensures that no one can sniff them. Nevertheless, the recipient sees your IP address, and the network operator could also track with whom (more precisely: with which IP) you are communicating on the Tox network. In the FAQ, the Tox developers are open about this issue [20]. They even provide instructions on how to route Tox through the Onion router Tor, if necessary [21].