Guide Tor and anonymity
Lire en français

Tor and anonymity

End-to-end encryption protects the content: images, sound, locations, session and contact names. It does not hide everything. This page states what the server sees.

What the server does not see

  • Your images, your sound, your photos.
  • Your locations.
  • The names of your sessions and your contacts, your profile.
  • Your passphrase, your recovery key, your contacts' key shares.
  • The QR's secret code: it is placed after the # in the address, a part that browsers never send to the server.

What the server sees

Data Why
Your identifier (7F3K·QM2D) and the account creation date To find your account when you sign in
The size and arrival time of each upload Unavoidable: this is what passes through
For each segment: type (video, audio, photo), format, quality, duration, phone time, hash For the timeline, the chain and the lock
The number of location points and their arrival time Not their content
Recording windows, lock durations, the sharing rule The server enforces them
Which accounts are contacts of which accounts, with which role To route key shares, session shares and alerts
The times of check-ins, alerts and duress For reminders, sharing and the log
The IP address of connections At the time of connection; see below

This metadata is enough to know that an account filmed on a given day, from one time to another, and at what bitrate. It does not say what or where. Cross-referenced with other sources (mobile operator, CCTV), it can help identify someone. Tor reduces this risk on the network side.

IP addresses

The web server logs keep no IP address, no record of the browser used and no URL parameters. The API uses the IP address in memory to limit sign-in attempts; its logs keep none beyond 24 hours. Your mobile operator, however, sees that your phone connects to our server.

A neutral address for the field phone

The field phone only displays oh.gy, a short name that says nothing. QR codes point to it. Nothing at this address mentions ripoux.fr: not the page title, not its icon, not the headers sent by the server.

This keeps a screen or a browser history from giving the tool away at first glance. Someone who knows that oh.gy and ripoux.fr share the same server makes the connection: their IP address is the same.

No third-party resources

The site loads nothing from another server, no fonts, no analytics, no trackers. The fonts are hosted by us.

There is one exception, on request: a session's map loads OpenStreetMap tiles when you click to display it. See Location.

Notifications go through your browser's notification service (Google, Apple or Mozilla, depending on the browser). Their content is encrypted for your browser; this service sees that a notification is addressed to you, and when.

Tor

Tor hides your IP address from the server, and hides from your operator the fact that you are connecting to ripoux.fr.

The account works with Tor Browser at the "Standard" security level. The "Safest" level disables JavaScript: encryption in the browser then cannot work.

Two .onion addresses exist, to stay entirely inside the Tor network, without an exit node or DNS:

  • the site and the account: http://ingatjl5dmeefk3lox6anel3epcthufx2tfjjcc2znfcuueklrpuulqd.onion/ (also shown at the top of the home page);
  • the field phone: http://7pryvimg6emr6sczssu6kzh33f62qctlp6nwu724lpfvkxmmw7ypmrad.onion/ (the neutral equivalent of oh.gy; type the short code there, since QR codes point to oh.gy).

In Tor Browser, the clear-web site ripoux.fr sends the Onion-Location header: the browser itself offers to switch to the .onion address. These addresses use plain HTTP, which is expected: Tor provides the encryption, and Tor Browser treats them as secure.

With the .onion, your ISP and the network you are on cannot see that you are talking to ripoux.fr. The server itself is the same, and everything under "What the server sees" still holds.

The field phone is not designed for Tor: video needs a bitrate that Tor rarely offers at a protest, and camera access varies from one browser to another. Prefer Tor for the account, and use audio only if you insist on routing the phone through Tor.

Good practices

  • Do not put your name in session names or in your profile, even though everything is encrypted.
  • View your account from a device that has not been used in the field.
  • Do not reuse your passphrase elsewhere.
  • On a shared computer, sign out and close the tab.