spot-on

This site is open source and under a public domain license (alternatively a creative commons license), so the content (or parts of it) can be used in (or modified for) any other project or wiki. Website forked and summarized with more screenshots from: https://github.com/textbrowser/spot-on - URL of this Site: https://sammysupport.github.io/spot-on/

Spot-On Encryption Suite

Spot-On is an open-source Encrpytion Suite for secure Chat & E-Mail, File Transfer and also Websearch in a F2F distributed URL-Database.

Means: Spot-On is a Messaging and File-Transfer Application. With RSS you can import, read, search and distribute your feeds f2f to your friends over encrypted connections.
Enhanced encryption processes have been invented and improved for implementation in Spot-On: such as McEliece-Messaging (Linux), Cryptographic Calling, Zero-Knowledge-Proofs, AutoCrypt via REPLEO and EPKS, Fiasco Forwarding, POPTASTIC-Messaging over E-Mail-Servers, Chipher-Text conversion tools like Rosetta Crypto Pad, Socialist-Millionaire-Security and many more.

Spot-On utilized the Echo-Protocol for proxyfying and anonymizing the network, it provids end-to-end encryption (and therefore utilizes not a web-of-trust, which is only point-to-point encryption). Spot-On is in the groupchat and for servers compatible with Smoke Crypto Chat Messenger from F-Droid.org

Spot-On: 1:1-Chat-Window and “Chat-Tab” Spot-On_Chatwindows.png - Spot-On - 1:1-Chat-Window and "Chat-Tab"

Download & Install

Download from the Github-project-page:

Install the latest Linux or Mac Version (Tree Icon) or choose the older Win32-Version (Dolphin Icon):

Download Linux: https://github.com/textbrowser/spot-on/releases/download/2023.12.15/Spot-On-2023.12.15_amd64.deb

Download Win 32: https://github.com/textbrowser/spot-on/releases/download/2023.01.15/Spot-On.zip

Download Mac: https://github.com/textbrowser/spot-on/releases/download/2023.12.15/Spot-On-2023.12.15.d.dmg

Spot-On: Login-Page & Options: Minimal View - just a few buttons Spot-On_Minimal-View-Options.png - Spot-On: Login-Page & Options: Minimal View - just a few buttons

Application-Data:

Application-Name:     Spot-On (Encryption Suite)
Developer:            Textbrowser
Start of Development: 2010	
Initial Release:      2013
Actual Version:       Version 2023
Latest Release:       2023
Operating Systems:    Android, FreeBSD, Linux, MacOS, OS/2, OpenBSD, Windows and all systems cappable of Qt.
Coding Language:      C++, Qt 5.15 LTS or Qt 6.5 LTS is required for Linux.
                      All other operating systems require Qt 6.5 LTS.
Categories:           Chat, Instant Messenger, E-Mail, Newsgroups, Anonymous Filesharing, Social Network,
                      Internet Relay Chat, P2P, F2F, Websearch, Encryption, Cryptography, Echo-Application
License:              BSD (Free and Open Source Software)
Website:              https://textbrowser.github.io/spot-on/

Reviews of Download-Portals:

Specification-List in Detail

Please visit https://github.com/textbrowser/spot-on/tree/master/branches/trunk/Documentation for more information.

Screenshots

Spot-On: 1:1-Chat-Window and “Chat-Tab” Spot-On_Chatwindows

Spot-On: Group-Chat-Tab called “Buzz” Spot-On_Groupchat

Spot-On: Spot-On “Settings-Tab” to activate the kernel (must be done first) Spot-On_Settings_Kernel_Activation

Spot-On: “Neighbour-Tab” to add a connection to a server or node Spot-On_Neighbour

Spot-On: Login-Page & Options: Minimal View - just a few buttons (without search) Spot-On_Minimal-View-Options

Spot-On: Create a Server / Listener just with a few clicks Spot-On_Listener_Server

Spot-On: FileSharing with Magnet-Links - “StarBeam-Tab” or to be StarBeamed in the Chatwindow Spot-On_FileSharing_Torrent_Magnet

Spot-On: Websearch - here: Webinterface in a webbrowser Spot-On_Websearch_Webinterface

Spot-On: Websearch 2 - here: client-interface in a tab Spot-On_Websearch_Clientinterface

Bibliographic References, Literature, Papers & Articles:

Research-Article on Spot-On: Spot-On Encryption Suite: Features, Security, and Comparison

Main Features and Supported Encryption Methods: Spot-On is an open-source encryption suite designed for secure communication across multiple channels, including 1:1 and group chats, an email client, file transfers (via Magnet links similar to BitTorrent), and a decentralized web search based on a distributed Friend-to-Friend (F2F) database. All communication channels are end-to-end encrypted.

Spot-On supports a broad range of cryptographic methods, including classic public-key algorithms like RSA, DSA, and ElGamal, as well as modern elliptic curve methods such as ECDSA/EdDSA. Additionally, it incorporates as first desktop-chat-messenger post-quantum algorithms such as McEliece and NTRU. For symmetric encryption, Spot-On employs Threefish (a block cipher in CBC mode). It also supports authenticated encryption (ensuring data integrity) and optional SSL/TLS for secure connections.

Special features include the Socialist’s Millionaires Protocol (a zero-knowledge proof for key agreement), general Zero-Knowledge-Proofs, and a Rosetta Crypto Pad for offline encryption (also with GPG). This extensive range of encryption methods makes Spot-On one of the most functionally rich encryption suites available for communication security.

Supported Platforms: Spot-On is cross-platform and developed in C++ with Qt. It runs on operating systems that support Qt (version 5.15/6.5+), including Windows, macOS, Linux, and even niche systems like FreeBSD, OpenBSD, OS/2, and Qt-support for Android.

Precompiled binaries are available for Windows, macOS and Debian, while further Linux users can compile the source code. Spot-On supports various networking protocols (TCP, UDP, SCTP, Bluetooth), allowing it to function across different network environments, including local Bluetooth-based networks.

Use Cases and Applications: Spot-On is designed for secure peer-to-peer communication using an F2F topology. It is ideal for groups or communities that require confidential communication and file sharing without relying on centralized servers. This application with its features include:

Alternative to mainstream messaging & file-sharing platforms for groups of friends, work teams, or journalists needing privacy. End-to-end encrypted file transfers using the StarBeam feature, which operates similarly to torrents but within a fully encrypted group/network. Decentralized web search where participants contribute to and use a shared encrypted URL database via RSS feeds. POPTASTIC - Chat over E-Mail-Servers: The Poptastic function enables users to exchange encrypted messages via standard email servers (POP3/IMAP/SMTP), even in environments where P2P connections are blocked. High-privacy networks: Spot-On can be configured to operate entirely over Tor for additional anonymity. A practical example would be a private chat group using Spot-On to securely exchange information and files without exposing their metadata, unlike traditional platforms like IRC or FTP.

Security Features and Evaluation: Advanced Multi-Hop End-to-End Encryption - Unlike many traditional F2F networks that encrypt only between immediate neighbors (like e.g. RetroShare), Spot-On ensures end-to-end encryption even when data is relayed through multiple hops. This means no intermediary can decrypt or inspect messages.

Anonymizing Echo Protocol: Spot-On employs a unique Echo Protocol, which has no sender and receiver IP addresses information from transmitted data packets. Messages are forwarded through peers, with each relay re-encrypting the data, ensuring that even nodes acting as intermediaries cannot track the message source or destination.

Strong and Versatile Cryptography: Spot-On uses both classical and post-quantum algorithms, ensuring resistance to potential quantum computing attacks. The software also provides a customizable cipher/hash selection during setup. Additionally, it features a proprietary Echo Public Key Sharing (EPKS) system for secure key exchange within a community.

Open Source and Transparent Development: Spot-On is released under a BSD license and has been in development since 2010. The source code is publicly available, enabling external audits and community-driven improvements. Next to the option of formal security audits, the project’s commitment to open-source development suggests no hidden backdoors, as everything is open and proveable.

Reviews have praised Spot-On’s high cryptographic density and security, its learning model and content means it is best for general consumers wanting to deepen the tech-savvy knowledge.

Spot-On offers the most advanced encryption with multi-hop end-to-end protection and post-quantum cryptography, but is technically complex and requires manual setup. It is a user-friendly alternative for encrypted social networking (forums, chats, and file-sharing), and its encryption is not only hop-to-hop but rather provides full E2E multi-hop.

Availability and Maintenance: Spot-On is actively maintained and regularly updated. The software is available as an open-source project on GitHub, with binary releases for Windows, macOS, and Linux.

The project is developed by an individual known as “Textbrowser”, and the BSD licensing allows its code to be freely modified or incorporated into other projects. The Spot-On community is suppoting through available forums.

Spot-On provides an actively maintained project, with recent updates released at the end of the last year. Users looking for a high-security, decentralized communication suite with state-of-the-art encryption will find Spot-On a robust solution, no one should have missed to study and share the exploring with friends.

Semi-compatible Mobile Messenger with Spot-On: Smoke Crypto Chat Messenger: An additional Analysis

Smoke Crypto Chat is an open-source messenger focused on maximum security. It is regarded as the world’s first mobile messenger to use the post-quantum secure McEliece algorithm for encryption. The app enables end-to-end encrypted chats without requiring a phone number, supports self-hosted decentralized servers, and implemented cryptographic concepts for enhanced forward secrecy. Below, we examine its features, security, supported platforms, user experiences, origin, and parallels with other secure messengers based on the Echo-Protocol like the Desktop-Messenger Spot-On.

Features and Unique Aspects End-to-End Encrypted Chats: Smoke offers individual chats as well as a group chat in IRC style (“Fire” channels) with symmetric group key encryption. All conversations are end-to-end encrypted by default. Group-Chats (also 1:1-Fire-Chats) are compatible with Chats on Spot-On (for Desktop).

Messaging and Data Exchange: In addition to text messages, emojis and images can be sent. Received images are stored in an encrypted container on the smartphone and must first be decrypted before being exported for external use. It is also possible to send any type of file — even to recipients who do not have the Smoke client: Files can be encrypted and transferred via standard tools (e.g., to an SSH client). This is handled via the integrated “Steam” protocol, which ensures reliable file transfers (TCP over the Echo network).

No Phone Number Required: Users identify themselves via a random 32-character chat ID instead of a phone number. Automatic contact list uploads do not occur, providing a key privacy advantage (GDPR compliance) over messengers that scan address books. To simplify usage, each user can in addition define an alias (e.g., a term like “Berlin”) that the chat partner must also enter to establish a connection. Using this shared alias, the clients automatically exchange public keys and start the secure chat. This method replaces central key servers with an AutoCrypt-like mechanism (known from Spot-On as EPKS), making key exchange simpler.

Self-Hosted Servers & Decentralization: Smoke is based on the decentralized Echo protocol instead of centralized servers. Messages can run through the built-in SmokeStack server — a simple server app for Android. This allows users to set up easily a personal chat server on an old Android device at home, in a classroom, or in a small group. Alternatively, users can run their own server instances or use public Echo servers. This federated model allows schools, organizations, or municipalities to deploy their own private messenger server rather than relying on foreign cloud services.

Direct and Offline Communication: Smoke can theoretically function without an internet connection. Devices on the same local network (or via Bluetooth/TCP direct connection) can communicate directly since no registration or external infrastructure is required. For offline messages, Smoke uses Ozone mailboxes: If a message is sent while the recipient is offline, it is temporarily stored until the recipient accesses a shared Ozone mailbox (on one or more known SmokeStack servers) to retrieve it. This ensures that messages are not lost even when both devices are not online at the same time.

Multi-Media and Additional Features: The app provides additional functions, such as an app lock (password protection for the app), and modern key derivation algorithms (Argon2id, PBKDF2). Smoke also includes special modes like “Silent Mode” (no visible status metadata to outsiders) and the ability to relay messages through network neighbors. It even supports real-time file sharing to multiple recipients (“Steamrolling”) and integration with external tools (e.g., Netcat for file transfer).

Security & Encryption Technologies: Smoke was specifically developed to ensure maximum confidentiality, even in the age of quantum computers. The security architecture combines classical methods with advanced cryptographical implementations:

Post-Quantum Encryption (McEliece): The core encryption algorithm is McEliece, which has been known for over 40 years and is considered resistant to all known quantum computer attacks. Smoke is the first mobile messenger worldwide to use McEliece encryption. Each user account has a key pair (private and public key)—either based on McEliece (offering four different parameter/moduli sets) or alternatively RSA. Notably, Smoke enables chats between a McEliece user and an RSA user, ensuring backward compatibility while encouraging quantum-safe communication.

Symmetric Encryption and Forward Secrecy: For actual message transmission, Smoke uses authenticated encryption with changing session keys. Smoke implements a proprietary concept called “Fiasco Forwarding” (FF) to ensure perfect forward secrecy. Instead of deriving the key for each message from the previous one (as in Signal’s Double-Ratchet protocol), Smoke transmits a bundle of temporary keys (“Fiasco-Keys”) per message, which are stored in the recipient’s cache and used successively. This less deterministic, more volatile approach increases security: if a single session key is compromised, it does not allow decryption of all subsequent messages.

Password-Protected Chats (CSEK/JPAKE): In addition to public-key encryption, Smoke offers an option for user-defined passwords, called “Customer Supplied Encryption Key” (CSEK). Both chat partners can agree on a shared password beforehand, which they enter into the app. This enables a secure symmetric session key exchange, likely implemented via J-PAKE (Password-Authenticated Key Exchange). This provides an additional secured communication channel, even if the public-key infrastructure were compromised.

Further Cryptography & Techniques: Smoke integrates numerous additional security technologies. It minimizes metadata exposure, avoiding identifiable headers and using SipHash-128 for ID generation and automatic public-key exchange. Additionally, messages are double-encrypted: first end-to-end encrypted, and second, the transport to the SmokeStack server is always TLS-encrypted.

Comparison with Other Secure Messengers Smoke Crypto Chat competes with established secure messengers. Here’s how it compares:

💬 End-to-End Encryption: Messengers like Signal, Threema, WhatsApp, and Element/Matrix provide end-to-end encrypted chats like Smoke. However, they rely on Elliptic Curve Cryptography (Curve25519, Double Ratchet), which may not be quantum-safe. Smoke uses McEliece, ensuring future-proof encryption.

Forward Secrecy & Key Management: Standard messengers use a single new key per message (e.g., Signal’s Double-Ratchet). Smoke goes further, sending multiple keys per message (Fiasco Forwarding), increasing security but adding complexity.

Identification & Privacy: WhatsApp and Signal require a phone number, which reduces privacy. Threema and Smoke use random IDs, eliminating phone number dependency.

Centralization vs. Decentralization: Signal, WhatsApp, and Telegram use centralized servers. Matrix/XMPP allow federation but require complex server setup. Smoke simplifies self-hosting with an Android-based server (SmokeStack), making it easier to decentralize.

Advantages: ✔️ Post-Quantum Encryption ✔️ No phone number required ✔️ Self-hosted servers ✔️ Works offline/local network

Future & Community development: ❌ Technical UI, which could have a make-over in a community fork and: voice files can be transferred, live video calls need further implementation.

Conclusion: Smoke Crypto Chat Messenger is the worlds first mobile post-quantum secure messenger, setting and implementing the standards for encrypted communication. Smoke is best suited for general users who what to emerge with learnings and cryptographical explorings to a tech-savvy user status in cryptography and security research. It serves as an important platform, demonstrating what quantum-computer-proof secure messaging has to look like in today´s quantum era and secure messaging.

This site is open source. Improve this page.