sarahjamielewis

> Do you know what's going on with their suggested spelling/pronunciation?

"Cwtch" was/is more common in casual conversation in South Wales (where fluent spoken Welsh is less common, but Welsh words are still used in both English and mixed language contexts). See: https://en.wikipedia.org/wiki/Cwtch for a summary of the cross-language context.

It is something we get asked about fairly frequently, its not a high priority for us right now as it requires some thought as to not break or undermine any existing cryptographic/privacy properties that Cwtch does have (see: https://git.openprivacy.ca/cwtch.im/cwtch-ui/issues/461#issu...) - but it's also not something that we have ruled out if the right combination of design/effort is available.

Cwtch requires setting up onion services, and the app currently does that automatically via establishing a control connection with a Tor process (either launched by Cwtch, or provided by the system).

Orbot can be configured to expose the same control port (or at least it could on Android when I last looked a few years back, I'm not sure about this capability on iOS), and Cwtch can be configured to use a custom control port connection - but that imposes much more work on the user, and is somewhat fragile.

That could likely be made to work on iOS in some factor, but the problem of the stability of the services themselves would remain. Its definitely something we'd like to explore.

There should be a link to the society website (https://openprivacy.ca/) on the Cwtch site, but I can see that there isn't - we will get that fixed.

Open Privacy Research Society is a Canadian non profit society, founded in 2018, you can find details of our members and operating structure on our website. Most of our funds come from individual donations.

Cwtch started as an extension to the Ricochet Tor messenger which I also contributed back in 2014/2015. Our main goal behind Cwtch was to establish that metadata resistant / p2p communication could be done in a similar form factor to traditional server based / non-metadata private protocols like Signal i.e. to try and push the privacy properties that people can wield beyond end to end encryption, in a way that is still usable.

SimpleX relies on out-of-band key material transfer between clients, in addition to the honesty of routing server to protect privacy and metadata.

Cwtch uses the existing infrastructure of Tor and v3 onion services to establish p2p chat sessions, thus relying on the underlying security of the Tor network. There is some nuances regarding how different kinds of groups work, we have a security handbook that goes into it a deeper: https://docs.cwtch.im/security/intro

It's definitely one of the bigger challenges. Currently we don't see a viable way to deploy something like Cwtch on iOS (both in due to how locked down the platform is in general, and the requirement to run a backing onion service for each profile making mobile a hassle in the general case) - we are somewhat hopeful that advances on the Tor front might make it possible one day.

Shwmae, Sarah ydw i. I co-founded the Cwtch project, and yes I was born in Wales, lived there for 20+ years, and as a result learned Welsh in school; and while I no longer live there, I still consider myself, at least in part, Welsh.

Hi! Sarah from the Open Privacy Research Society / Cwtch team here - happy to answer questions.

On Android we implement a background service that will wake up periodically and either use the active tor connection or start a new one if the kernel has stopped it for any reason - and also reconnects the UI. This makes Cwtch connections fairly stable on android devices - even for p2p.

However, it also means that Cwtch on Android is fairly battery intensive. We provide a way to easily shutdown Cwtch completely for this reason - and we are researching ways to minimize power consumption (both through tor optimizations and alternative anonymous communication networks)

Hi Sarah from Open Privacy / Cwtch team here - the main major difference is that Cwtch servers are completely untrusted under the risk model - they don't learn anything about the groups they are hosting, who is a member of which group, or who each message is for.

The design for groups is still in flux, and they are marked experimental but there are a few more details in our Secure Development Handbook https://docs.openprivacy.ca/cwtch-security-handbook/groups.h...

Metadata resistant group comms is still a fairly large open research problem, and we are also working on the research side to reduce some of the bandwidth requirements that are currently required by our group protocol: https://git.openprivacy.ca/openprivacy/niwl

There is no official way for 3rd parties to make breach reports to OIPC-BC (nor is there a legal requirement for VCH to report to them) - it was only after Francesca raised the issue during a meeting with the commissioner(regarding breaches in general) we were informed they would be interested in this, and were given an avenue to contact them in a way that an investigation might be authorized.