🔒 Maxay Friendstime ilaaliyaa — maxayse aysan ilaalin?
Kuuma ballanqaadno “wax walba waa 100 % la sirayay” — taasi daacad ma noqon lahayn. Waxaan kuu sheegaynaa si sax ah xogta laga sirayay dhamaadka ilaa dhamaadka, tan server-ku akhrin karo, iyo waxa sirayntu farsamo ahaan qarin karin.
🛡️Maxaa la ilaaliyaa?
Guudmar kooban oo daacad ah. Faahfaahinta waxay ka hoosaysaa.
| Xog | Xaalad |
|---|---|
|
Qoraalka wadahadallada gaarka ah
Fariimaha qoraalka ah ee u dhexeeya laba akoon oo labaduba fure leh (ML-KEM-768 + AES-256-GCM); haddii qofka kale uusan fure lahayn, qoraalka waxaa la diraa isagoo aan la sireyn
|
✅ Dhamaad-ilaa-dhamaad |
|
Qoraalka wadahadallada kooxaha
Waxaa laga sirayay dhamaadka ilaa dhamaadka habka post-quantum ML-KEM-768, marka xubnaha oo dhan ay isticmaalaan app casri ah ama Web-Messenger — ilaa markaas lama sirayo
|
✅ shuruud ku xiran |
|
Fariimaha codka, sawirrada, fiidiyowyada, faylasha ku jira sheekooyinka 1:1
Si dhammaad-ilaa-dhammaad ah loo sireeyay (ML-KEM-768 + AES-256-GCM) marka labada akoon fure leeyihiin oo ay isticmaalaan abka cusub ama farriin-direeyaha webka. Serverku wuxuu arkaa diraha, qaataha, waqtiga, cabbirka iyo nooca, ma arko nuxurka. Sheekooyinka kooxaha ballan noocaas ah ma qaadno
|
✅ shuruud leh |
|
Wicitaanada (muuqaal iyo cod)
Wicitaanada hadda waxaa lagu sireeyaa gudbinta oo keliya (abka dhexdiisa sidoo kale). Abka wuxuu wicitaanada 1:1 horeba uga wada-xaajoodaa fure ML-KEM-768, laakiin wuxuu u isticmaalaa qoraalka hoose oo keliya. Sireynta dhammaad-ilaa-dhammaad ah ee sawirka iyo codka waa la dhisay waxayna ku jirtaa wejiga tijaabada. Baahinta tooska ah way ku sii jirtaa sireyn dhammaad-ilaa-dhammaad ah la'aan.
|
❌ gudbinta oo keliya |
|
Goobta tooska ah ee sheekooyinka 1:1
Goobaha waxaa loo sireeyaa si dhammaad-ilaa-dhammaad ah (ML-KEM-768 + AES-256-GCM) marka labada akoon fure leeyihiin; haddii kale waxaa serverka lagu kaydiyaa qoraal cad. Serverku wuxuu arkaa cidda la wadaagaysa cidda iyo goorta
|
✅ shuruud leh |
|
Faylasha khasnadda (xiriiriye)
Waxaa biraawsarka lagu sireeyaa AES-256-GCM; furaha wuxuu ku jiraa qaybta xiriiriyaha ee ka dambeysa #, oo biraawsarku uusan u dirin serverka. Qof kasta oo haysta xiriiriyaha oo dhammaystiran wuu furi karaa faylka
|
✅ dhammaad-ilaa-dhammaad |
|
Metadata
Yaa u qoraya yaa, goorma (waxaa loo baahan yahay gaarsiinta)
|
⚠️ server-ku wuu arkaa |
|
Nuxurka dadweynaha
Qoraallo, borofaylo, kooxo, faallooyin
|
❌ E2EE ma jirto |
|
Qoraallo gaar ah oo ku saabsan xiriirada
Waxaa serverka lagu kaydiyaa si la akhrin karo; waxaa keliya soo qaadan kara akoonkaaga
|
❌ E2EE ma jiro |
|
Cinwaanka IP
Marka lagu galo Tor (.onion) server-keenna ma ogaado — haddii kale wuu ogaadaa
|
✅ ikhtiyaari (Tor) |
|
Furayaasha sirta ah
Laguma kaydiyo qoraal cad, laakiin sida hash (Argon2id, qayb ahaan iyadoo lagu daray sir dheeraad ah oo dhanka serverka ah); hash-yada bcrypt ee hore waxaa la cusboonaysiiyaa gelitaanka xiga
|
✅ hash la sameeyay |
🔒 Wadahadallada gaarka ah — qoraalka laga sirayay dhamaadka ilaa dhamaadka
Qoraalka fariimahaaga gaarka ah waxaa lagu sirayaa qalabkaaga, mar kalena waxaa laga akhrin karaa qofka helaya; server-ku markaas wuxuu keydiyaa ciphertext oo kaliya. Furahaaga gaarka ah waxaa server-ka lagu keydiyaa isagoo la sirayay, waxaana qalabkaaga lagu furaa fure laga soo qaaday erayga sirta ah ee aad leedahay — sidaas darteed amniga wadahadalladaadu wuxuu ku xiran yahay xoogga erayga sirta ah. Haddii qofka kale uusan weli lahayn fure, ama sirayntu qalabka ku fashilanto, xitaa fariin qoraal ah waxay u baxdaa aan la sirayn.
Ogeysiiska fariin la sirayay ma ka kooban yahay qayb qoraalka ka mid ah, wuxuuse ka kooban yahay xusuusin oo kaliya sida 🔒 Fariin la sirayay — server-ku ma samayn karo qayb qoraal ah, maxaa yeelay wuxuu haystaa ciphertext oo kaliya.
Nuxurka waxaa lagu sireeyaa AES-256-GCM; furaha taas loogu talagalay waxaa lagu kala beddelaa habka post-quantum ee ML-KEM-768 — ama RSA-OAEP, haddii akoon uusan weli lahayn fure ML-KEM. Furuhu wuxuu leeyahay akoonkaaga, ma aha hal qalab: ka dib markaad ku gasho furahaaga sirta ah, mid kasta oo ka mid ah qalabkaaga wuu furi karaa sheekooyinkaaga. Qoraalka sheekooyinka kooxaha sidoo kale waxaa si dhammaad-ilaa-dhammaad ah loogu sireeyaa ML-KEM-768 isla marka xubnaha oo dhan isticmaalaan abka cusub ama farriin-direeyaha webka. Fariimaha codka, sawirrada, fiidiyowyada iyo faylasha sheekooyinka 1:1 sidoo kale waxaa loo sireeyaa si dhammaad-ilaa-dhammaad ah marka labada akoon fure leeyihiin. Wicitaanada hadda waxaa lagu sireeyaa gudbinta oo keliya; sireynta dhammaad-ilaa-dhammaad ah ee sawirka iyo codka waxay ku jirtaa wejiga tijaabada. Ilaa hadda ma jirin hanti-dhowr madax-bannaan oo sirinta ah.
🌐 Nuxurka dadweynaha — si ula kac ah E2EE ma aha
Qoraallada, borofaylada, kooxaha iyo faallooyinka waxaa loogu talagalay inay dadweyne yihiin, waxayna server-ka ku yaalaan si la akhriyi karo. Tani ma aha sirayn dhamaad-ilaa-dhamaad — sidaas daacadnimo ayaan u sheegnaa. Farsamo ahaan waa loo baahan yahay si Feed, raadin iyo dhexdhexaadin u shaqeeyaan.
Xeer-gacmeed: Haddii dadka kale ay arkaan, server-kuna wuu arki karaa. Waxa runtii gaar ahaan lahaa, waxaa u gaar ah qoraal ku jira wadahadal gaar ah oo laba qof ah.
🧾 Metadata — waxa E2EE aysan qarin
Sirayn dhamaadka ilaa dhamaadka waxay ilaaliyaa nuxurka, laakiin ma ilaalin metadata-ha marinka. Si fariin loo gaarsiiyo, server-ku waa inuu ogaadaa yaa la xiriiraya yaa iyo goorma. Macluumaadkan “yaa-yaa-goorma” farsamo ahaan lama dhaafi karo — ma qarinno.
Fariimaha laga sirayay dhamaadka ilaa dhamaadka, nuxurku wuxuu server-ka ku yaalaa ciphertext oo kaliya. Diraha, qofka helaya, waqtiga iyo nooca fariinta server-ku wuxuu u keydiyaa si la akhriyi karo.
🧅 Asturnaanta shabakadda — Tor (.onion)
Qof kasta oo rabo inuu isticmaalo, Friendstime waxaa sidoo kale lagu heli karaa adeeg Onion ee shabakadda Tor (.onion). Marka lagu galo cinwaanka Onion, Friendstime ma ogaado cinwaanka IP-gaaga, bixiyaha internetkaaguna ma arko bogga aad booqanayso. Qaar ka mid ah shaqooyinka waxay la xiriiraan server-yo kale — tusaale ahaan lacag-bixinta kaarka, muuqaallada la geliyay, wicitaannada iyo baahinta toos ah; isku xirkaas waxay ka baxaan adeegga Onion.
Tani waxay khusaysaa kaliya haddii aad Friendstime ka gasho Tor-Browser. Isku xir caadi ah, server-ku wuxuu yaqaan cinwaanka IP-gaaga — sida bog kasta. Tor wuxuu qariyaa meesha aad ka timid — ma qariyo qofka aad tahay, marka aad akoonkaaga ku gasho. App-ka Android qaab Tor ah oo ku dhex dhisan ma laha.
🐞Nuqsaan amni ma heshay?
Haddii aad ogaato nuqsaan ku jira Friendstime, fadlan si sir ah noogu soo sheeg foomka soo sheegista — xitaa akoon la'aan. Halkaas waxaa sidoo kale lagu sheegay sida aan ula macaamilno soo sheegisyada.
❓Frequently asked questions
Is Friendstime end-to-end encrypted?
In part, and this page says exactly what is. End-to-end encrypted: the text of private chats, plus voice messages, images, videos and files in one-to-one chats (each when both accounts have a key), the text of group chats (once all members use a current app or the web messenger). Not end-to-end encrypted: public content, metadata, calls (currently encrypted in transit only; end-to-end encryption for picture and sound is in a test phase) and live streams.
Which methods are used?
Key exchange uses ML-KEM-768 (NIST FIPS 203, a post-quantum method) and content is encrypted with AES-256-GCM. If an account has no ML-KEM key yet, RSA-OAEP is used.
Where are the servers?
According to the privacy policy, web hosting, database and e-mail are run by php-friends GmbH (Germany). The media, storage and routing server is operated by netcup GmbH in its Nuremberg data centre.
Has the encryption been audited independently?
No. There has been no independent audit of the encryption so far.
How are passwords stored?
Not in plain text but as a hash (Argon2id, partly with an additional secret server value). Older bcrypt hashes are converted at the next login.
How do I report a security vulnerability?
Via the form at https://friendsti.me/sicherheit-melden.php, no account needed.