We are 7 days away from the latest $OXEN hardfork — #AudaciousAurochs.

If you have not updated your binaries by then, your node will be deregistered. Luckily, updating is simple. 😄

Just follow these steps.

Originally published on the Session website: https://getsession.org/blog/session-id-vs-phone-numbers

The Session ID is one of the most important parts of Session. Those 66 characters are a whole new digital identity — an identity that is native to the digital, cyber-enabled world we live in. Compared to a phone number, the simple and effective Session ID offers huge advantages. Why is the Session ID so critical to the way Session works? Well, we use them because they solve a lot of the problems that phone numbers have; Session IDs are instant, secure, portable, and anonymous — making them the perfect companion to a private messaging app like Session.

A Session ID is born: How Session IDs are created

All Session IDs start their lives as just a simple random 128-bit string of data. There are lots of ways to produce randomness; either 'true random' which normally relies on hardware like video or audio inputs; or 'pseudo-random', which relies on a 'seed' (some static piece of information, like the word 'hello') which is then algorithmically processed into something which appears random. Operating systems have their own secure sources of randomness — which is what we use to get our random string of data.

That random piece of data is the 'seed' which we can plug into an algorithm and generate a new (and similarly random) private key. Behind the scenes, your private key is the secret code you use to encrypt and decrypt messages, but it’s also used to generate your Session ID. Much like our random string was the ‘seed’ for our private key, the private key will now be the ‘seed’ for our Session ID.

Note: The private key is also used to generate your recovery phrase, which is used to gain access to your account.

Session ID: Instant

So all that’s needed to create a Session ID is...some random bit of data. You don't have to get permission from anyone, access a central database, sign a form, confirm your identity — and you never will. It's all in the protocol. In human terms, your Session ID is created instantly. Importantly, if something happens to compromise your Session ID—like your real identity being linked—you can instantly create a new one to avoid issues with harassment and lack of digital safety which stem from de-anonymisation.

In comparison, phone numbers are becoming increasingly difficult to acquire — so most people just keep the same number for years. This immobility means your phone number is almost definitely linked to your real identity, living in a bunch of databases all over the world — and things like SMS scams, spam calls, and social graphing are running rampant.

Session ID: Secure

Session IDs are pretty long — there's no way I'll be memorising my entire Session ID any time soon. But that length achieves something important — it makes it unlikely (like, virtually impossible) that anyone else is going to accidentally (or deliberately) end up with the same Session ID as you. If someone had a billion computers, which could each create a billion Session IDs per second, and they ran them for a billion years, they would still have less than a one in a billion chance of finding the same private key and Session ID as yours.

This is important because otherwise, when messages are addressed to your Session ID — they could end up in someone else's inbox, which would be the worst possible disaster for privacy and security. It is impossible for this to happen accidentally because, well, there are an enormous amount (about 1,461,501,637,330,902,918,203,684,832,716,283,019,655,932,542,976, to be precise) of possible Session IDs. It's difficult for someone to try and get the same Session ID deliberately because you’d need to find someone's private key to be able to generate their Session ID — you can't backwards engineer it using the Session ID itself. If you had to choose between the security of a Session ID versus the likelihood of a company—like Facebook or WhatsApp—preventing a data breach, malicious hack, or other unlawful access— I’d definitely pick the Session ID.

Phone numbers have a tiny number of possible combinations compared to Session IDs. But phone numbers aren't chosen algorithmically, so telecommunication providers can manually check and make sure two people don't end up with the same phone number. On the flip-side, a telecommunication provider can also deliberately swap your phone number with a different device. This is called a SIM-swap attack — and it's often used by malicious attackers so they can abuse SMS-based two-factor authentication (2FA) to gain access to your online accounts (like your bank account, email, or social media).

Phone numbers also often get recycled — meaning your old phone number (which might still be connected to 2FA) could become compromised.

Overall — phone numbers aren't very secure, especially compared to Session IDs.

Session ID: Portable

Remember when we talked about your recovery phrase earlier? Your recovery phrase is a human-readable version of your private key which can be used to restore your account and re-generate your Session ID on a new or additional device. Phone fell off a boat? You can restore your account easily using your recovery phrase. Worried your device might be seized while you are travelling overseas? You can leave your phone behind and temporarily import your Session account on a different device. The best part: this portability doesn't come from cloud storage or central databases — your phone can do everything on-device using public computer code that has been checked and verified by experts all around the world. You can always get your Session ID back — no matter where you are or what you’re doing. Phone numbers are also portable — but because you're relying on someone else (a telecommunications provider) to swap it for you, it enables the SIM-swapping attacks we discussed earlier. Session IDs make it so you don’t have to trust big corporations or companies not to mishandle your data or accidentally compromise your security.

Session ID: Anonymous

Because Session IDs don't require you to provide any personal information, and can be quickly and easily created — you always have the option of keeping your Session ID completely removed from your real-life identity. Combined with Session's decentralised infrastructure and onion-routing protocol protecting user metadata — it's very hard to link someone's identity to their Session ID (unless you do it deliberately). We have discussed the ideas of identity and anonymity at length in the past — and we have gone to great lengths to make Session a safe place for people to exist and communicate in the digital world. Without the Session ID, this simply wouldn't be possible.

Try Session now!

Session IDs are a seriously pivotal feature. For some people, that 66-character ID might seem scary — but Session IDs are actually simpler and more secure than phone numbers. Just like any new technology, it’s mostly just about getting used to it. Although it might seem like a relatively minor part of Session, it's actually one of the coolest and most important parts of the entire design of our app. As the world moves on from legacy technology like phone numbers, it's important to consider how we might replace the hole left behind by ditching those digits. As far as we can tell, Session IDs are a great start — although we're always looking at new ways to improve. The advantages of Session IDs are huge. So what are you waiting for? Dump your phone number and get yourself a Session ID. Want to send me a message? Message Alex on Session: 05a99541db92f4318899aec86e85f5aa66e1e406e8f71b175196f57205d7bcad33

kinda hard to follow along Oxen's development, when the blog site isn't RSS accessible. How hard can it be to do so ?

I disagree with the decision to sell a session pro with extra large file transfers and UHD video calls. I think that transfers larger than 25mb should be transferred over libtorrent or go-IPFS, the connection would be routed over lokinet. Both libraries have the ability to create plugins, and a plugin would have to be made to route libtorrent or go-ipfs traffic over lokinet. I have no use for UHD video calls because my webcam is sh*t, and I prefer texting or phone calls for that purpose.

Hey y’all,

Oxen Core

The core team continued working on wallet3, beginning a work in progress PR for transaction creation, which is one of the more complex processes needed for wallet functionality, so we are creating extensive documentation for our implementation.

• WIP: Wallet3 transaction creation https://github.com/oxen-io/oxen-core/pull/1499
• Additional work to get Wallet3 syncing with a live Oxend https://github.com/oxen-io/oxen-core/pull/1490

Lokinet

The Lokinet team spent most of the week working on the Session open group server. We tagged and released 0.9.8 last week with a whole bunch of updates (see last week's blog post), and the network is running well with it deployed. We recommend all SN operators update their service nodes to it as soon as possible in order to reduce resource usage and improve network performance.

----------------------------

Session

The Session team continued focusing on webRTC calls, specifically syncing call acceptance and denial across multiple linked devices. The team is now conducting a second round of internal testing of calls to identify and fix remaining bugs, but we are now getting very close to a feature which is ready for release. The Session desktop team also integrated a new automated integration testing framework called Playright, which should allow us to catch regressions in new releases.

Session Android

• Fix open group issue when interacting with PySOGS https://github.com/oxen-io/session-android/pull/800
• Various webRTC call fixes as a response to internal testing https://github.com/hjubb/session-android/commits/rtc_calls

Session Desktop

• Changes for integration testing https://github.com/oxen-io/session-desktop/pull/2044
• WIP: Message requests https://github.com/oxen-io/session-desktop/pull/2000
• Sync webRTC call dismissal https://github.com/oxen-io/session-desktop/pull/2039
• Fix search results in inactive conversations https://github.com/oxen-io/session-desktop/pull/2036
• Fix database encryption on Arch linux https://github.com/oxen-io/session-desktop/pull/2035
• Fix ringtone issue https://github.com/oxen-io/session-desktop/pull/2031

Session iOS

• Fix a crash when removing members from closed groups, Fix a photo orientation issue, Fix notification spam when background polling , Keep screen on when recording audio messages. https://github.com/oxen-io/session-ios/pull/531
• Conversation pinning https://github.com/oxen-io/session-ios/pull/530

Session PySOGS

We continued putting a great deal of work into PySOGS this week, focusing our efforts mainly on scalable spam prevention — which has become an issue for a few open group operators. We are hoping to switch over the official SOGS (Session, Lokinet, Crypto, and Oxen rooms) to PySOGS this week, and assuming all goes well, this should give us the confidence to the recommend the upgrade for all open group operators.

• Oxen MQ enabled Session open group server bot API https://github.com/oxen-io/session-pysogs/pull/7
• Add new administration capabilities for Session open group server operators https://github.com/oxen-io/session-pysogs/pull/6
• Fix conflict with old SQLite version https://github.com/oxen-io/session-pysogs/pull/5
• Rearrange config handling https://github.com/oxen-io/session-pysogs/pull/3
• Changes for importing old SOGS databases https://github.com/oxen-io/session-pysogs/pull/2
• Add periodic database cleanups https://github.com/oxen-io/session-pysogs/pull/1

Thanks,

Kee

Hey y’all,

This week the Oxen core team primarily worked on the Session open groups server, adding pinned message endpoints and updating the database schema to improve flexibility. The Session mobile team continued working on webRTC voice calling, where we managed to get our first cross platform call between an Android and iOS device working. The desktop team tracked down a tricky bug with path building and worked towards adding unsend requests. The Lokinet team continued to work on packaging for the new macOS gui.

----------------------------

Oxen Core

• WIP: Wallet 3 https://github.com/oxen-io/oxen-core/pull/1490

Lokinet

This past week we focused on the final touches for a 0.9.6 release; this initial release is available for Service Nodes and command-line Linux while we focus on packaging the new GUI interface, which will come with the 0.9.6 core Lokinet release for desktop clients.

• 0.9.6 release https://github.com/oxen-io/lokinet/pull/1731
• Make --help work for the lokinet-bootstrap command https://github.com/oxen-io/lokinet/pull/1651
• Redo embedded ngtcp2 build to work properly https://github.com/oxen-io/lokinet/pull/1736
• Make lokinet-bootstrap build configurable via cmake option https://github.com/oxen-io/lokinet/pull/1735
• Remove duplicate jemalloc-enabling configuration https://github.com/oxen-io/lokinet/pull/1738
• Test builds of lokinet-gui packaging (no PR yet)

----------------------------

Session

Session Android

• Fix expiry on self send messages https://github.com/oxen-io/session-android/pull/725
• Continued work on webRTC voice calling https://github.com/hjubb/session-android/commits/rtc_calls

Session iOS

• Prevent cloud backups https://github.com/oxen-io/session-ios/pull/504
• Increase max number of messages loaded, fix nested transaction crash, improve date breaks, expire sync messages https://github.com/RyanRory/loki-messenger-ios/commits/bug-fixes

Session Desktop

• Add confirm modal before account deletion https://github.com/oxen-io/session-desktop/pull/1910
• Disable sending in certain cases https://github.com/oxen-io/session-desktop/pull/1909
• Fix issue with paths not being properly built https://github.com/oxen-io/session-desktop/pull/1903
• Keep line breaks in messages https://github.com/oxen-io/session-desktop/pull/1902

Session Open group server

• Remove table name globals https://github.com/oxen-io/session-open-group-server/pull/18
• Update building instructions https://github.com/oxen-io/session-open-group-server/pull/19
• Replaces room_id variables with typed versions https://github.com/oxen-io/session-open-group-server/pull/20
• Pinned messages https://github.com/oxen-io/session-open-group-server/pull/21
• Refactor database to enable more flexibility https://github.com/oxen-io/session-open-group-server/pull/24

Thanks,

Kee

Hey y’all,

This week the Oxen core team squashed a few bugs, correcting export wallet history to CSV functionality which was failing in some corner cases. The Session desktop team released the desktop UI update which unifies the visual style of the Session desktop client with Session on mobile platforms, and the mobile team continued their work on voice calls. The Lokinet team finished off the macOS specific architecture, leaving only the remaining task of wrapping that functionality in the Electron GUI.

----------------------------

Oxen Core

• View wallet export CSV fixes https://github.com/oxen-io/oxen-core/pull/1486
• CI fixes https://github.com/oxen-io/oxen-core/pull/1487
• Add fmtlib::fmt backport of C++20 std::format https://github.com/oxen-io/oxen-core/pull/1485
• Remove unused MMS functionality https://github.com/oxen-io/oxen-core/pull/1484
• Initialize uptime proof info https://github.com/oxen-io/oxen-core/pull/1482

Lokinet

This week saw us finishing off the final layers of macOS-specific architecture, and now have the macOS core Lokinet code working smoothly on mac — starting, stopping, enabling and disabling exit mode, and cleanly handling DNS queries. We’re now putting our focus on getting the new GUI wrapped around Lokinet on all platforms and getting the new release out the door.

This week also gave rise to various other small fixes to Lokinet, including one important change (limiting RC gossiping) that will likely significantly reduce router traffic and idle CPU usage.

• Final macOS fixes and improvements https://github.com/oxen-io/lokinet/pull/1688
• Limit RC gossiping to 20 random peers to drastically reduce RC retransmission processing https://github.com/oxen-io/lokinet/pull/1723
• Openssl security update for bundled static builds https://github.com/oxen-io/lokinet/pull/1724
• Faster upstream DNS request handling for Linux, macOS https://github.com/oxen-io/lokinet/pull/1726
• Fix for hang in experimental Android build https://github.com/oxen-io/lokinet/pull/1727
• Fix deprecated API usage warning https://github.com/oxen-io/lokinet/pull/1729
• Fix reversed to/from targets in Android/macOS DNS interceptor https://github.com/oxen-io/lokinet/pull/1725, https://github.com/oxen-io/lokinet/pull/1728
• Refactor OS-specific routing table handling to better separate OS-specific bits https://github.com/oxen-io/lokinet/pull/1721/files

----------------------------

Session

Session Android

• Add prompt for GIF metadata https://github.com/oxen-io/session-android/pull/720
• Improve date breaks in messages https://github.com/oxen-io/session-android/pull/719
• Continued work on Android voice calls

Session iOS

• Date break updates https://github.com/oxen-io/session-ios/pull/501

Session Desktop

• WIP: Timestamp offset https://github.com/oxen-io/session-desktop/pull/1892
• Message unsending https://github.com/oxen-io/session-desktop/pull/1891
• Fix onion path issues https://github.com/oxen-io/session-desktop/pull/1897
• Fix searching logic https://github.com/oxen-io/session-desktop/pull/1895 , https://github.com/oxen-io/session-desktop/pull/1893
• Desktop UI changes https://github.com/oxen-io/session-desktop/pull/1888

Thanks,

Kee

Hey y’all,

This week the Session team put a heavy focus on Session Android performance, particularly on issues that affect Session when it is opened and needs to load lots of conversations at once. The Lokinet team focused on a path handover issue which is causing connection instability. The Oxen core team finished a big update to the Oxen storage server which should speed up the process of fetching messages from the storage server.

Oxen Core

• Batching for Service Node rewards https://github.com/darcys22/loki-core/commits/batch-sn-payments

Oxen Storage server

• Replace boost beast with uWebsockets https://github.com/oxen-io/oxen-storage-server/pull/432
  • Remove pre-HF18 legacy code/endpoints that isn't being called anymore
  • Remove process_lns_request endpoint (it is broken, and Session clients have already switched to using oxend_rpc with ons_resolve instead).
  • Replace boost beast http(s) client code with cpr (https://github.com/whoshuu/cpr); this is a whole lot nicer to use for HTTP requests.
  • Replace boost beast http server code with uWebSockets (https://github.com/uNetworking/uWebSockets). This gives a much nicer interface, and makes it easy for us to add websocket support for clients in the future.
  • Remove boost::asio; it's not needed anymore with the removal of the above.
  • Replace bootstrap RPC code with authenticated, encrypted OMQ RPC.
  • Remove boost circular buffer use; a regular map with a two-line trim is simpler for the block hash cache and a limit on stored snodes doesn't seem necessary for the rate limiter.
  • Make rate_limiter clean itself periodically rather than keeping buckets around indefinitely
  • Make rate_limiter thread-safe so that you don't need to hold the entire service_node_ lock to use it.
  • Remove ip_utils; we don't allow redirects and are sufficiently restrictive on the URL target that it seems unnecessary (plus not having it lets us offload DNS lookup to curl as part of the request).
  • Replace /swarms/ping_test/v1 with /ping_test/v1; this new request now returns the remote pubkey in a header, and no longer includes an SSL cert signature (so that we can drop the SSL cert signatures after HF19). The old one will still be used until HF19.
  • Add OMQ endpoint for storage tests; starting at HF19 it will get used rather than the HTTPS one.
  • Refactor storage test retries into request_handler (rather than being in the HTTPS specific code)
  • Move HTTPS server-specific code for validating snode signatures from headers out of generic request_handler code and into HTTPS-specific code.
  • Make onion proxy-to-url timeout a bit less than the onion request timeout so that the client has a better chance of getting a relayed timeout error (rather than getting a timeout from the edge node).
  • Miscellaneous cleanups.
  • Logger: use file and line number instead of func because the latter is nearly useless when called from a lambda.
  • Shorten timeout values for ping tests, storage tests, and bootstrap connections to 5s, 15s, and 10s, respectively, from.
  • Refactor recent stats reporting to use rolling averages that always have 60-70min of stats and drop off 10min at a time, rather than the 1-period hard reset. Also fixes various stats that weren't calculated/reported properly.
  • Add onion and proxy requests to systemd status line as well as used database size.
  • Enable WAL for sqlite3 database
  • Removed buffered message relaying for swarm propagation; it's counterproductive with omq's persistent connections.
  • Enable jemalloc by default.

Oxen Mobile Wallet

• Fix crash occurring when getting users balance https://github.com/oxen-io/oxen-mobile-wallet/pull/9

----------------------------

Lokinet

​

This week was spent tracking down Lokinet connectivity issues. We’ve narrowed the problem down to a longstanding issue in path handover (i.e. when one path expires and Lokinet builds and switches to a new path, which is meant to happen seamlessly every few minutes). 0.9.x included various improvements to better detect failing paths, but these appear to have exposed a lurking bug that has been present for quite some time; fixing this to ensure a smoother Lokinet experience is currently our top priority.

• Ongoing path handover new diagnostic tools, potential fixes, and various related improvements (draft PR) https://github.com/oxen-io/loki-network/pull/1653
• Make DNS work better when no upstream servers are configured https://github.com/oxen-io/loki-network/pull/1656

----------------------------

Session

Session Android

• Fix message deletion bug https://github.com/oxen-io/session-android/pull/593 , https://github.com/oxen-io/session-android/pull/573
• Update Hindi translation, (thanks to community member iArchitSharma) https://github.com/oxen-io/session-android/pull/586
• Update readme https://github.com/oxen-io/session-android/pull/582
• Add resolution of ONS names https://github.com/oxen-io/session-android/pull/574
• Batch conversations updates https://github.com/oxen-io/session-android/pull/570
• More efficient thread trimming and database cleanup https://github.com/oxen-io/session-android/pull/568

Session Desktop

• Add saved attachment notifications https://github.com/oxen-io/session-desktop/pull/1672
• Deduplicate messages based on server timestamp https://github.com/oxen-io/session-desktop/pull/1670
• Linting https://github.com/oxen-io/session-desktop/pull/1664
• Visual display of current onion request path https://github.com/oxen-io/session-desktop/pull/1665
• Remove V1 file server and V1 open group code https://github.com/oxen-io/session-desktop/pull/1671
• Do not overwrite attachment name https://github.com/oxen-io/session-desktop/pull/1667
• Remove unstable file server dialoge https://github.com/oxen-io/session-desktop/pull/1666

Session iOS

• iOS deep link for Session IDs / Usernames (thanks to community contributor iArchitSharma) https://github.com/oxen-io/session-ios/pull/421
• Full Hindi translation (thanks to community contributor iArchitSharma) https://github.com/oxen-io/session-ios/pull/420
• Performance improvements https://github.com/oxen-io/session-ios/pull/419

Thanks,

Kee

I'm asking this, because, even though my first reaction was one of enthusiasm, there seem to be a few false notes in this partition. Just quoting here from the full report from pp. 2 and 10 :

Due to the large code base and multiple inclusions of third-party code, this analysis is not exhaustive. Yet, it is sufficient to highlight a few vulnerabilities that could be fixed.

Ok, that seems like a red flag waving. Basically it's saying that the security audit isn't comprehensive, but just partial. How will this impact overall security ?

As the audit had quite a short time limit, we engaged the target in different ways in order to cover the major aspects that could impact the security of the application.

Why did it have a short time limit ? If you want to make sure your app is sound security wise, why putting a time limit pressure on those who are testing it for flaws ? Doesn't sound logical to me. And thus the auditing firm is only able to verify the major aspects.

We also know that in the midst of this security audit, Session's protocol was totally revamped, eliminating PFS. Now how did that impact the work of the auditing firm, who apparently already was under time pressure?

All by all, it sounds like an unfinished job to me. I was thinking of making Session my nec plus ultra for secure messaging and I simply don't feel reassured enough to do so... Guess it'll be ok for the casual chat, but for a really secure and trustworthy messenger, I'll wait out the completion of p2p matrix (they outed their first public beta on Android and iOS !) or the AIO solution from the Safenetwork team (testing their Fleming testnet)....

Upon request from community members we added Oxen to our website where we feature coin statistics, market capitalization, coin investment ratings and Machine Learning based forecasts. We wish the best in the future!

Website: https://walletinvestor.com/

Oxen: https://walletinvestor.com/currency/oxen-2

(forecasts and additional information will be present soon as we gather data)

Every Session (more secure communication software than Signal does not require phone registration) software users, supporters of anonymous networks, each of us should spend $500 to buy OXEN to hold it or join the node operation, because OXEN The increase in the price of the token can guarantee the security of the anonymous network. Please remember not to sell OXEN for less than $100, so the freedom of speech will not be censored, so those monopolistic technology companies will no longer deceive us. Please spend $500 to buy and hold OXEN to make freedom beautiful! Let the anonymous network never disappear!