Anonymous Secure Messaging Application

A fully functional anonymous messaging application built on the Tor network with end-to-end encryption, ephemeral chat rooms, and comprehensive admin controls.

🔒 Features

• Real-time multi-user chat rooms with WebSocket connections
• Single-use invite URLs that burn after one entry for maximum security
• Admin-controlled message persistence modes (ephemeral, temporary, client-side)
• End-to-end encryption using TweetNaCl cryptographic library
• Tor hidden service integration for complete anonymity
• User management system with live user lists and presence tracking
• Admin controls including user kick functionality and invite generation
• Rate limiting and DoS protection
• Cross-platform responsive web interface

🏗️ Architecture

tor-test/
├── server.js                 # Main application server
├── package.json              # Dependencies and scripts
├── torrc                     # Tor daemon configuration
├── lib/                      # Core backend components
│   ├── Room.js               # Room management and persistence
│   ├── User.js               # Anonymous user identity system
│   ├── InviteURL.js          # Single-use invite system
│   └── MessageHandler.js     # Message validation and routing
├── middleware/
│   └── security.js           # Rate limiting and security headers
├── services/
│   └── torService.js         # Tor hidden service management
├── utils/
│   └── crypto.js             # Server-side cryptographic utilities
├── public/                   # Frontend application
│   ├── index.html            # Main UI
│   ├── app.js                # Client-side application logic
│   ├── crypto.js             # Client-side encryption
│   └── style.css             # Responsive styling
├── config/                   # Configuration files
│   ├── security.json         # Security policies
│   └── torrc.template        # Tor configuration template
└── test/                     # Test suites
    ├── crypto.test.js        # Cryptographic function tests
    ├── room.test.js          # Room management tests
    └── double-ratchet.test.js # Double ratchet protocol tests

🚀 Quick Start

Prerequisites

• Node.js 18.0.0 or higher
• Tor daemon installed on your system
• Git (for cloning)

Installation

1. Clone the repository

   git clone <repository-url>
   cd tor-test

2. Install dependencies

   npm install

3. Run setup script (configures Tor and services)

   npm run setup

4. Start the application

   npm start

The application will be available at:

• Local: http://localhost:3000
• Tor Hidden Service: http://4gwm2yc276xo6gnmtisf5xumtmg6wk3cboq76azmv5z3h7657v7f3vqd.onion

📋 Available Scripts

npm start          # Start the production server
npm run dev        # Start development server with auto-restart
npm test           # Run comprehensive test suite
npm run test:ratchet # Run double ratchet protocol tests
npm run lint       # Lint code for security and style issues
npm run setup      # Configure Tor and initialize services

🎯 How to Use

Creating a Room

1. Navigate to the application
2. Click "Create New Room"
3. Choose a message persistence mode:
   • Ephemeral: Messages disappear immediately (maximum security)
   • Temporary: Messages stored encrypted for max 30 minutes
   • Client-Side: No server storage, users control local saving
4. Copy the generated invite URL to share with others

Joining a Room

1. Click on an invite URL or enter the invite code
2. You'll be assigned a random anonymous username (e.g., "SilentFox472")
3. Start chatting immediately - all messages are end-to-end encrypted

Admin Features

Admins can:

• Join rooms using admin tokens (preserving invite URLs for others)
• Generate new invite URLs when needed
• Kick disruptive users from rooms
• View which invite code each user used
• Monitor room activity and user count

🔧 API Endpoints

Room Management

• POST /api/room/create - Create new room with persistence mode
• POST /api/room/:roomId/invite - Generate new invite URL (admin only)
• DELETE /api/room/:roomId/user/:userId - Kick user (admin only)

Invite System

• GET /api/invite/:inviteCode/room - Get room ID from invite code
• GET /join/:inviteCode - Serve main page with invite code

Health Check

• GET /health - Application health status

📡 WebSocket Messages

Client → Server

// Join room with invite code (burns the invite)
{ type: 'join_room', inviteCode: 'abc123' }

// Admin join (preserves invites)
{ type: 'join_room_admin', roomId: 'room123', adminToken: 'token' }

// Send encrypted message
{ type: 'send_message', message: 'encrypted_content' }

// Leave room
{ type: 'leave_room' }

Server → Client

// Successful join response
{ type: 'room_joined', user: {...}, users: [...], room: {...} }

// User events
{ type: 'user_joined', user: {...} }
{ type: 'user_left', userId: 'user123' }
{ type: 'user_kicked', userId: 'user123', kickedBy: 'admin' }

// Messages
{ type: 'message', userId: 'user123', message: 'encrypted_content', timestamp: 1234567890 }

// Errors
{ type: 'error', message: 'Error description' }

🔐 Security Features

Encryption

• End-to-end encryption using TweetNaCl (NaCl cryptographic library)
• Perfect forward secrecy with new keys generated per session
• Double ratchet protocol for advanced message security
• Memory clearing of sensitive cryptographic material

Privacy & Anonymity

• Tor hidden service integration for IP anonymity
• No external resources - all assets self-hosted
• Anonymous usernames generated randomly per session
• Single-use invite URLs that burn after entry

Security Hardening

• Rate limiting on API calls, WebSocket connections, and messages
• Input sanitization to prevent XSS and injection attacks
• Security headers via Helmet.js (CSP, HSTS, etc.)
• DoS protection with connection and request limits

🧪 Testing

Run the comprehensive test suite:

# Run all tests
npm test

# Run specific test suites
npm run test:ratchet    # Double ratchet protocol tests
mocha test/crypto.test.js    # Cryptographic function tests
mocha test/room.test.js      # Room management tests

Test Coverage

• ✅ Cryptographic functions (encryption/decryption, key generation)
• ✅ Room management (creation, user join/leave, persistence modes)
• ✅ User systems (anonymous identity generation, admin controls)
• ✅ Invite system (single-use URL generation, expiration, burning)
• ✅ Double ratchet protocol implementation

🛡️ Security Considerations

For Administrators

• Keep admin tokens secure and rotate them regularly
• Monitor room activity for suspicious behavior
• Use the kick functionality responsibly
• Ensure Tor is properly configured and running

For Users

• Access the application only through Tor browser when using .onion URLs
• Use ephemeral mode for maximum security
• Never share invite URLs in insecure channels
• Be aware that admins can see which invite you used

For Deployment

• Run behind a reverse proxy with additional security headers
• Monitor system resources and implement additional rate limiting if needed
• Regularly update dependencies for security patches
• Consider running in a sandboxed environment

🚦 Message Persistence Modes

Mode	Server Storage	Auto-Deletion	Security Level	Use Case
Ephemeral	None	Immediate	Maximum	Highly sensitive communications
Temporary	Encrypted	30 minutes	High	General secure messaging
Client-Side	None	User controlled	High	User-managed message history

🔧 Configuration

Security Settings (config/security.json)

Configure rate limits, room constraints, and security policies.

Tor Configuration (torrc)

Customize hidden service settings, ports, and Tor daemon behavior.

📊 Monitoring

The application provides:

• Real-time user count and presence tracking
• Connection monitoring via WebSocket events
• Health check endpoint at /health
• Console logging for debugging (configure log levels as needed)

🤝 Contributing

1. Fork the repository
2. Create a feature branch
3. Make your changes
4. Run the test suite: npm test
5. Run linting: npm run lint
6. Submit a pull request

📄 License

MIT License - see LICENSE file for details.

⚠️ Disclaimer

This application is designed for legitimate privacy and security purposes. Users are responsible for complying with all applicable laws and regulations in their jurisdiction. The developers are not responsible for any misuse of this software.

---

Current Status: ✅ Fully operational with all features implemented and tested. Tor Hidden Service: 4gwm2yc276xo6gnmtisf5xumtmg6wk3cboq76azmv5z3h7657v7f3vqd.onion