Networked visited by University of Michigan


Recommended Posts

So, I recently setup an FTP Server on my home network. I'm doing some messing around with programming and working on a updater for a friends game server.

 

Well, this happened. Someone care to explain why the heck the University of Michigan is accessing my network?

 

Tracing route to researchscan336.eecs.umich.edu [141.212.122.81]
over a maximum of 30 hops:

  1    <1 ms    <1 ms    <1 ms  192.168.1.1
  2     1 ms    <1 ms    <1 ms  66.172.101.1.nwinternet.com [66.172.101.1]
  3     1 ms     1 ms     1 ms  206.130.130.236.nwinternet.com [206.130.130.236]
  4     1 ms     1 ms     1 ms  206.130.137.57.nwinternet.com [206.130.137.57]
  5     6 ms    18 ms     5 ms  78.152.42.114
  6    24 ms    25 ms    24 ms  ae02.edge01.sjo01.us.as5580.net [78.152.34.9]
  7    25 ms    25 ms    25 ms  paix0.tr-cps.internet2.edu [198.32.176.128]
  8    33 ms    33 ms    33 ms  xe-0-0-0.80.rtr.losa.net.internet2.edu [64.57.20.124]
  9    45 ms    45 ms    45 ms  ae-2.80.rtr.salt.net.internet2.edu [64.57.20.145]
 10    69 ms    69 ms    69 ms  ae-2.80.rtr.kans.net.internet2.edu [64.57.20.147]
 11    72 ms    69 ms    69 ms  ae-0.80.rtr.chic.net.internet2.edu [64.57.20.149]
 12    69 ms    70 ms    69 ms  ae-4.80.rtr.eqch.net.internet2.edu [64.57.20.151]
 13    91 ms    91 ms    91 ms  ae0x69.anar-um-arbl.mich.net [198.108.22.102]
 14    90 ms    93 ms    90 ms  l3-binarbl-merit-1.r-bin-arbl.umnet.umich.edu [192.12.80.66]

It died at the 15th hop mark, the rest were time outs.

 

I've editted out my IP Address / Login Credentials. But here's a log of it.

 

unauthorized_access_editted.thumb.png.d9

 

I'm way lost on this. Frankly, it bothers me a fair bit that it happened, I'm just not too sure how concerned I should be.

they are spamming the interwebs looking for ftp servers to bruteforce or try to login to.   You will get them from everywhere.

 

put that on an ip block list or secure your crap up some more. 

 

When I was hosting my own personal ftp, I would have them put on a block and ban list after 3 bad attempts. 

  • Like 2

Did you browse to that URL? It has the answers to your question:

 

http://researchscan336.eecs.umich.edu/

 

To be honest; the FQDN of the IP should of been a clue.

 

1 minute ago, sc302 said:

they are spamming the interwebs looking for ftp servers to bruteforce or try to login to.   You will get them from everywhere.

 

put that on an ip block list or secure your crap up some more. 

 

When I was hosting my own personal ftp, I would have them put on a block and ban list. 

Great. I'll end up doing that then. I was thinking I could just block all of their IPs, but I don't even know where to begin to get that info.

 

Well, I've enabled FTPS, now I'm looking into SFTP. I've got unencrypted ftp blocked. All passwords are 8+ Alphanumeric Special Character / Punctuation.

 

Whats their end goal? Just to find out what I've got on there?

The end goal of all of them, get into your stuff and exploit it by either downloading the contents or using it to host their own crap.   And sometimes it is just to say they did it. 

 

The end goal is really irrelevant.  You can group that all into normal internet chatter.

1 minute ago, c.grz said:

Did you browse to that URL? It has the answers to your question:

 

http://researchscan336.eecs.umich.edu/

 

No i didn't. I generally don't go to things I think might be bad.

 

Just now, sc302 said:

The end goal of all of them, get into your stuff and exploit it by either downloading the contents or using it to host their own crap. 

Figured as much. Well, I've changed ports. I'll have Windows Firewall deny that IP/block, I'll have my Router Firewall deny it. At that point I think I should be good.

Quote

Why am I receiving connection attempts from this machine?

These connections are part of an Internet-wide research study being conducted by computer scientists at the University of Michigan. The research involves making benign connection attempts to every public IP address. By measuring the entire public address space, we are able to analyze global patterns and trends in protocol deployment and security.

As part of this study, every public IP address receives a handful of packets per day on a selection of common ports. These consist of regular TCP connection attempts followed by RFC-compliant protocol handshakes with responsive hosts. We never attempt to exploit security problems, guess passwords, or change device configuration. We only receive data that is publicly visible to anyone who connects to a particular address and port.

Why are you collecting this data?

The data collected through these connections helps computer scientists study the deployment and configuration of network protocols and security technologies. For example, we use it to help web browser makers and other software developers understand the impact of proposed protocol changes and security improvements. In some cases, we are able to detect vulnerable systems and report the problems to the system operators. This data also powers real-time reports on the security of the web, such as the Heartbleed Bug Health Report.

This data has been the foundation of more than a dozen peer-reviewed research publications, including:

Can I request that my server be excluded?

To have your host or network excluded from future scans conducted by the University of Michigan, please contact [email protected] with your IP address or CIDR block. Alternatively, you can configure your firewall to drop traffic from the subnets we use for scanning: 141.212.121.0/24 and 141.212.122.0/24.

This is what I found by visiting the link from earlier in the thread.

  • Like 2

don't need to change the ports, just need to secure it better.  Perhaps something like only allowing a specific ip block instead of the entire internet instead of opening that port up, creating a vpn for them to use to be able to access your ftp.  There are a number of ways to do it where you don't obscure the ports...after all security through obscurity isn't really security.

2 minutes ago, Circaflex said:

This is what I found by visiting the link from earlier in the thread.

Yeah, I went to it after someone posted what it said. I make a habit of not clicking on things I don't know the source too. I ended up Googling it after I posted, which was about the same time they responded. Haha.

1 minute ago, sc302 said:

don't need to change the ports, just need to secure it better.  Perhaps something like only allowing a specific ip block instead of the entire internet instead of opening that port up, creating a vpn for them to use to be able to access your ftp.  There are a number of ways to do it where you don't obscure the ports...after all security through obscurity isn't really security.

Well, I've denied anyone without an account. No anonymous ftp, I've denied anything that isn't encrypted. I'll be setting up SFTP, if I can figure out how to do that. Last time I tried to setup SSH, I failed miserably, formatted and said screw it.

While the answer is pretty much explained above, let me go into this deeper...

 

This is simply the nature of IPv4 internet.  It was developed without security in mind, back in a day when it was never imagined on a global scale nor the vast amount of speed and computing power available today.  There are only 3,706,452,992 public addresses available in for the entire world (also in that same sense, universe).  

 

It does not take much to scan the entire internet, going from one IP address to the next.  This happens on a daily basis from countless sources.  This is how computer worms can spread through non firewalled and unpatched systems with no human interaction.  All it takes is one computer to scan and infect, multiply that exponentially as more and more machines get infected and proceed to scan / infect on their own, you can see where this is going...

 

Another scenario, a "script kiddie" scans random IP blocks from home (most likely from his parent's basement) looking for open ports to later investigate in an attempt to take control of or find something of interest.  

 

A few years ago (it may still be, I am not sure) the most common port that is port scanned is 21.  Why?  Many ftp servers are left wide open with anonymous login and full write privileges.  They then serve as a dumping ground for whatever illegal files they want stored somewhere, this could be anything from a cam version of Star Wars, to something far far worse, like child porn.

 

These types of traffic are basically background internet noise.  If you want, set your firewall to log all incoming unsolicited traffic and by the end of the week you will have a log file of several hundred megabytes (if not gigabytes) of drive by port scan traffic.

 

This problem is the main reason firewalls exist.    By running a server and allowing all traffic through, you are basically leaving your door wide open for anyone to come inside and take a look around.  There is and never will be a such thing as a 100% secure server, but there are many ways you can make it less appealing. 

 

  • Like 3

If your wanting to run some sort of backup for your buddy I would look down access to your ftp port to their IP, or their netblock.

 

You ask about how to get a netblock for a specific IP..  One simple way is to just do a whois on the IP that hit you, that should tell you what block that IP is in, be it a /24 or /16, etc..

 

So for example in the IP that hit you falls to this

 

NetRange:       141.212.122.0 - 141.212.122.255
CIDR:           141.212.122.0/24

NetName:        UMICH-21025

 

this moves to a bigger network

 

NetRange:       141.212.0.0 - 141.212.255.255
CIDR:           141.212.0.0/16
NetName:        UMICH-2

 

So could just block the whole /16, they might have more networks..  But you can for sure see from the whois that they do own the whole /16

 

As also mentioned your going to see lots of traffic to 21, 22 (ssh) and telnet (23) are other common ones.  So as you see lots noise.  Here just today for those 3 common ports I see 143 hits sofar today..  I snipped it, but you see from all over the place..  Just noise your firewall should just drop them.

noise.thumb.png.917143b62d18e340aabc6543

 

So when you open up a service like ftp that is so common, its best to filter who can hit it, since you have a known source - I would lock down the rule to your buddies IP.  Changing the ports not security, but could lower the log noise..  But lack of traffic in your logs might give you a false sense of security, as sc302 mentions obscurity is not security.  Depending on your firewall and ftp server software you can block IPs after so many failed attempts.

 

I don't allow anything into my network other than vpn, and serve up ntp to the pool.. But as you can see there are hits to my vpn port since I run it on 443 tcp so I know if there is internet where I am at I can get too it.  So you see firewall lets in all that traffic, but fails to work with vpn so they get nothing.  Openvpn doesn't even show any log in attempt so just someone look for a https server is all.  Noise ;)  The hit I highlighted that was allowed was me coming in from work.

 

vpn.thumb.png.2e83268930c966631620b5c478

 

If you run a service to the public there is going to be lots of noise, which is why you need to make sure what you allow the public to see is secured as best as possible.

 

 

 

 

 

  • Like 1
37 minutes ago, Jared- said:

Start wearing your tin foil hat. 

Already got it on.

 

@BudMan Thank you for that explanation and pictures. It helped quite a bit. I honestly, didn't think that my little ole FTP Box would be sniffed so fast. It kind of freaked me out a bit. Here's what I'll do...

 

1. Leave the ports the same.

2. I'll enable IP Blocking for their school under the /16.

3. I'll look into running SFTP even more, can't seem to find a decent tutorial on this one, but I'll keep searching.

 

As for the VPN setup you have, I'm not sure I would even know where to begin. I'm trying to keep this as low maintenance as possible, and less of a headache for myself and the people accessing it. I mean, it took me a few hours to figure out how to setup passive mode on FileZilla's server. Yes, I hate FileZilla. I haven't done FTP related things since I was in High School and looked for trouble. As for Firewalls, I'm running the router Firewall, which I don't think does diddly, and I've disabled the Windows Firewall right now because it was giving me major headaches. I'm going to re-enable it, and filter the ports through. I'm going to look into running pfSense as well, though I'm not 100% sure about it.

Not sure you need to block them, they are doing a service are they not.. Scanning stuff for research..

 

As to running sftp, what OS.. Linux its on any distro out of the box..  You would then lock that down to public key auth only vs password auth..

 

As to the vpn, its really clickity clickity if you run pfsense as your firewall.

 

If you want to use ssh and sftp on a windows machine - pretty simple since they started releasing openssh port for windows

Grab your 32 or 64 bit flavor here https://github.com/PowerShell/Win32-OpenSSH/releases

 

There somewhat of a guide for setting up sftp

https://winscp.net/eng/docs/guide_windows_openssh_server

 

or you could use this version http://www.mls-software.com/opensshd.html

 

If you have any issues - just let me know and can throw together a simple walk through, takes all of a couple of minutes to setup

sshtowindows.thumb.png.34154824a44f5d207

 

Here is a sftp transfer, etc..

 

sftp.thumb.png.be021f36e196788fb25c85443

 

I did have some problems with kitty (fork of putty) and using filezilla as sftp client didn't like something it would connect but directly listing was not full and transfers didn't work.  Most likely both getting confused with the server type being sent back, etc.  But the port comes with both a ssh and sftp cmd line client you could use on windows that works for sure..  And didn't have any problems with actual putty or winscp in the 5 minutes of testing I did..  I normally don't use windows for this sort of stuff.

cmdlineclients.thumb.png.5e4d496950fba8a

 

note: be careful with winscp installer might like to install opencandy, I just use the portable version when needed..

 

 

 

I've been getting some nasty lag and connectivity issues since I started this. Downloads are failing, disconnecting from services, can't even stream Netflix. Torrents refuse to connect. I have no idea what in the heck is going on. I'm rollin' a 100 up/down connection, and I can't even watch Netflix. I've contacted my ISP, and they've seen a massive amount of requests hit my line. I can host things because I'm on a business class fiber line, but they suggested I shut down any incoming/hosted products.

 

Even shutting down the server, didn't seem to do anything. =/

What is your connection speed?  I don't see how 100Kbps inbound would do anything.. Are you seeing 100KB or Kb ??  Even 100KB shouldn't be an issue unless you have a very small pipe.. Its possible your router doesn't like all the sessions, did you remove the forward or just shutdown the server?  You should remove the forward so your router just drops the traffic vs trying to do something with it.

 

Its quite possible your ftp server got compromised, what was the password you used?  Complex and long I would hope!!  Once it was compromised yeah they would most likely start serving stuff off of it that would create lots of traffic to it..

 

I just don't get why you would do this from your home connection?  Why don't you just use your dreamhost account to do ftp, or your seedbox??

 

Other than your own personal access to your stuff, serving up stuff out of your home connection never a good idea if you ask me.  Your just taking away your own bandwidth for the big one..  If you think it was slow now with 100KB(b) what do you think it would be when your buddy was moving files to and from it?  Now think of your buddy - he has to live with what kind of upload speed do you have?  I am guessing your power cycle this all the time for software updates?  Do you ever have power outages, internet outages?  Its just much better to serve up stuff to the public from a place and service designed to do so - don't you work in a DC.. I would think you would understand this better than most..

I have a 100Mbit up/down, 95/95 is my actual speeds.

 

I took the actual FTP Server offline, it's still running just no FTP Requests.

- I'll close the ports after my bosses leave for the day.

 

FTP Password is 10 Alphanumeric, special character. The user accounts on it are 8 minimum with Capitals/Lowercase, numbers, and punctuation.

 

The drives only have my data on them, About 1.5GB is used for the partitions, which was there before I even added the FTP. I added about 22GB of Video files to it.

 

The reason why I'm doing this from home, and not the seedbox, is because the seedbox doesn't have the space for it. I have 1.2TB of space on mine, however with all the video files I have, even SD I'm pushing 6TB. Well, the files I'm hosting will only have data pushed when I'm asleep, which is morning time for the British people.

 

I do understand fairly well, but you've gotta work with what you have. I've already spent a lot of personal money on it, so I'm not wanting to spend anything more specifically for this (i.e. memory upgrades). I don't power cycle it too often, unless i absolutely need too. As for outages, I haven't had one in quite some time, I think it's been over a year on internet, maybe 2, and it's been at least 2 years since power outage. Last time it was someone hitting a pole a block away.

 

I did use StableBit as well, by the way. Storage Spaces refused to accept my HDDs, so i said screw it. I didn't want to screw around with Storage Spaces and find out 3 days later it still wouldn't work. $55 for all 3 products, not sure if I'm going to enable duplication yet, I need to get the last 3 drives and I'll be solid with 27TB of space, and I can enable duplication.

so you got their cloud product too.. What do you think??  As to duplication - you going to turn it on for everything or just specific folders/files..

 

The scanner actually evacuated one of my drives for me recently, didn't loose a thing that I can tell.. Walked into my computer room and click click click.. Was like oh ###### what failed..  I didn't get any alerts or anything, until I popped the clicking disk.. Then my phone went off that one of my drives was missing ;)

 

I have to look closer into the alerts I have setup..  But was like ###### that sucks, but it was really old drive anyway..  Put it on a shelf, ordered a wd nas red 2tb to replace it - couple days later it showed up.  Popped it in added it to the pool.. The pool re-balanced.. Was like ok what did I loose..  I knew all my critical stuff (multiple backup even would of lost the whole pool) was there that was still there even after I pulled the disk since that was duplicated..  So I connected the old clicking drive to my pc if I could pull anything off of it..  It was toast, could read it.. Was showing up as 3.4GB or something..  But going through my library everything is there and fine..

 

I had seen it do this before,  But the drive didn't actually fail, and was like why was nothing on one of my disks in the pool.  But this time it seems it got the files off just before the failure.  Or maybe it had moved them off long time ago and I hadn't noticed?  But it doesn't seem to warn you if it does this??  Have to ask them about that.

evac.thumb.png.e299e2b3e8d5916acaf3f7028

 

Now that is what I call slick ;)  This software and support just rock!! And price is just fantastic to boot..  It just blows away spaces from every angle I can think of that is for sure..

 

If you have any questions on its use - just ask, happy to help been using it for few years now.. (Order date: May 23, 2012 6:52 AM CDT)  make sure you setup the alerting and the scanner!!  Keep meaning to play with the cloud piece, and thinking about adding a SSD to the pool as write cache to play with.  But I know that will just get me wanting to move to 10gig because the gig network is the bottleneck then.

 

 

i love stablebit, it has paid for itself a few times already on my server. cool thing about duplication is you dont need to do it for all folders, if there is data there you dont necessarily care about you can exclude it from duplication. This can help save you some storage space.

In the future, just bare in mind that if you operate ANY server connected to the internet, people will try and scan it for vulnerabilities, it's inevitable.

Secure your server properly, always keep your software up to date, use strong passwords, and ensure that full write access is not available to anyone without passworded access. It's nothing to worry about as long as you take steps to keep yourself secure.

1 hour ago, BudMan said:

so you got their cloud product too.. What do you think??  As to duplication - you going to turn it on for everything or just specific folders/files..

 

The scanner actually evacuated one of my drives for me recently, didn't loose a thing that I can tell.. Walked into my computer room and click click click.. Was like oh ###### what failed..  I didn't get any alerts or anything, until I popped the clicking disk.. Then my phone went off that one of my drives was missing ;)

 

I have to look closer into the alerts I have setup..  But was like ###### that sucks, but it was really old drive anyway..  Put it on a shelf, ordered a wd nas red 2tb to replace it - couple days later it showed up.  Popped it in added it to the pool.. The pool re-balanced.. Was like ok what did I loose..  I knew all my critical stuff (multiple backup even would of lost the whole pool) was there that was still there even after I pulled the disk since that was duplicated..  So I connected the old clicking drive to my pc if I could pull anything off of it..  It was toast, could read it.. Was showing up as 3.4GB or something..  But going through my library everything is there and fine..

 

I had seen it do this before,  But the drive didn't actually fail, and was like why was nothing on one of my disks in the pool.  But this time it seems it got the files off just before the failure.  Or maybe it had moved them off long time ago and I hadn't noticed?  But it doesn't seem to warn you if it does this??  Have to ask them about that.

evac.thumb.png.e299e2b3e8d5916acaf3f7028

 

Now that is what I call slick ;)  This software and support just rock!! And price is just fantastic to boot..  It just blows away spaces from every angle I can think of that is for sure..

 

If you have any questions on its use - just ask, happy to help been using it for few years now.. (Order date: May 23, 2012 6:52 AM CDT)  make sure you setup the alerting and the scanner!!  Keep meaning to play with the cloud piece, and thinking about adding a SSD to the pool as write cache to play with.  But I know that will just get me wanting to move to 10gig because the gig network is the bottleneck then.

 

 

I don't like the Cloud Product. You're quite limited on what you can do. I have the Amazon Cloud Service, which I can't use with it. AWS is something I'd have to purchase separately. So, instead, I'm going to write a nifty script to move any new files I add to the Pool, to the ACS. That'll fix the duplication process.

 

I had wondered about RAID, and what redundancy it offered. What version do you have 2.x.x or 1.x.x? You have options in yours that I haven't seen, must be looking in the wrong section.

20 minutes ago, Circaflex said:

i love stablebit, it has paid for itself a few times already on my server. cool thing about duplication is you dont need to do it for all folders, if there is data there you dont necessarily care about you can exclude it from duplication. This can help save you some storage space.

Storage Space was what I was hoping for, it's like a cheap, ghetto redneck version of Stablebit. Being able to use however many drives as "spares" was nice. I'm glad I spent the money on Stablebit, I just wish I got a few serial keys, instead of just 1. $55 / key is insane =/

14 minutes ago, Javik said:

In the future, just bare in mind that if you operate ANY server connected to the internet, people will try and scan it for vulnerabilities, it's inevitable.

Secure your server properly, always keep your software up to date, use strong passwords, and ensure that full write access is not available to anyone without passworded access. It's nothing to worry about as long as you take steps to keep yourself secure.

Yeah, I knew i'd eventually be port scanned, however I wasn't expecting to be hit from tons of addresses. Since I posted this, I've had nearly 100 hits from different IPs, the Michigan one has hit me, even though I blocked the parent /16 address, including the two it lists on its site. BudMan and I are discussing firewall options, as well as a switch upgrade.

 

Also, you guys asked why I needed a ridiculous amount of space, well here's another reason, my garage was broken into again. Third time within 9 months. Air Compressor, 4 Ton Jack, 4x 6 Ton Axle Stands, bunch of tools, they even took my snow blower, lawn mower, rototiller, and a bunch of other stuff. They backed a truck down our drive way, loaded it up, and took off. Around $5,000 or so gone.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • NetSpeedTray 1.3.3 by Razvan Serea NetSpeedTray is a lightweight, open-source Windows network monitor that shows live upload and download speeds directly on the Taskbar. Designed for efficiency, it quietly sits in the system tray, conserving CPU and battery with dynamic updates. It blends seamlessly with Windows 10/11, adapts to light/dark themes, and auto-positions to avoid overlaps. Features include accurate interface detection, customizable display, optional mini-graph, color coding, granular font and unit control, detailed per-interface history graphs, safe data management, and easy CSV export—bringing the network monitoring Windows forgot. NetSpeedTray key features: Lightweight & Efficient Runs quietly in your system tray without consuming resources. Features a "Dynamic Update Rate" that lowers refresh frequency when the network is idle to save CPU and battery life. Native Look & Feel Blends seamlessly with Windows 10/11 UI. Smart detection for light and dark taskbar themes ensures text is always visible. Intelligent & Adaptive Positioning Automatically finds empty space next to your system tray and shifts to make room for new icons, preventing overlaps. Seamless OS Integration Behaves like a native Windows component. Hides instantly with auto-hiding taskbar Hides when a fullscreen app is active Smart Network Monitoring Accurate by Default: Auto mode identifies your main internet connection and ignores noise from VPNs or virtual adapters. Easy Interface Selection: Switch effortlessly between Auto, All, or Selected network interfaces via intuitive radio buttons. Total Visual Customization Free Move Mode: Unlock and place the widget anywhere on your screen. Optional Mini-Graph: Real-time graph of recent network activity with adjustable opacity. Color Coding: Customize colors and speed thresholds to quickly see network status. Granular Display Control Text & Font: Adjust font family, size, weight, and alignment. Units: Automatic (B/s, KB/s, MB/s) or fixed Mbps display. Precision: Set decimal places and always show them for uniform appearance. Detailed & Intelligent History Graph Smart Scale: Logarithmic scale shows low-level traffic and large spikes clearly. Per-Interface Filtering: View speed history for specific adapters (Wi-Fi, Ethernet, VPN). Safe & Efficient Data Management: Adjustable retention, automatic cleanup, optimized database. Easy Data Export: Export raw data to .csv or save high-quality graphs for reports. NetSpeedTray v1.3.3: The Updater Fix A stabilization release that repairs a critical regression in v1.3.2: the app shipped without OpenSSL, which silently broke every HTTPS request — including the built-in update checker (the "Could not check for updates" error many of you hit). This release restores it, hardens the build so it can't happen again, and fixes a startup crash plus four other reported bugs. Changes: Fixed update checking — Resolved a critical issue that prevented the app from checking for updates ("Could not check for updates"). Fixed startup crash with Auto-Cycling — The app no longer crashes on launch after enabling Cycle display mode. Fixed incorrect network speeds on 10GbE adapters — Multi-gigabit network cards now display speeds correctly instead of being stuck at 0. Improved color coding — Default color is shown when idle, and color/threshold changes now apply immediately without restarting. Fullscreen visibility fix — The widget now correctly stays visible over fullscreen apps when Keep Visible is enabled. Improved AMD Ryzen temperature detection — More reliable CPU temperature monitoring for Ryzen processors. Cleaner upgrades — Installer now removes outdated application files during upgrades, preventing DLL/version conflicts while preserving user settings. Improved stability — Fixed potential DLL loading issues by excluding critical OpenSSL and NumPy components from UPX compression. Better settings window — Scrollbars removed and layout improved for a cleaner experience. Localization improvements — Updated translations and completed missing UI text across all supported languages. More reliable releases — Added regression tests covering recent critical fixes, bringing the test suite to 196 passing tests. [full release notes] Download: NetSpeedTray 1.3.3 | 87.9 MB (Open Source) Download: NetSpeedTray Portable | 101.0 MB View: NetSpeedTray Home Page | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • Why Delta Chat is the best decentralized messenger you have probably never tried by Paul Hill There is no shortage of messaging apps out there; we have WhatsApp, Messenger, and Telegram, just to name a few. While Meta has taken steps to incorporate encryption into Messenger and WhatsApp, they still leave a lot to be desired. If you are in the market for a messaging app that promotes security, privacy, and optional anonymity, you'll want to read what I have to say about Delta Chat. For those not familiar with Delta Chat, rather than relying on centralized servers as you do with Facebook Messenger, it relies on email. Essentially, it is a chat interface that feels like a messaging app, but secretly in the background, it is firing off emails. In the past, you used to have to sign in with your email account. When you sent messages to people, it would just be sending encrypted messages to their inbox, which their Delta Chat client would decrypt. When I first learned about Delta Chat, it required users to sign in with an email account, but I was pleasantly surprised upon trying it in 2026 that this is no longer a requirement, or the preferred method was to use the app. Recently, I’ve tried UAD-ng on my old Nokia 3.4 to disable most of the Google apps because the bootloader is locked, and this is the next best option. While finding replacement apps in F-Droid, I came across Delta Chat again, and it has undergone quite a big change since I last used it, with its new chatmail relays, which no longer require you to sign in to your own email account, providing anonymity, and they offer greater security. Android and Desktop Delta Chat apps. Not only does it run on my de-googled phone, but it also works on desktop computers and iOS, making it truly ubiquitous. For me, Delta Chat is a wonderful alternative messenger because it gives you more control. It supports switching between different profiles, which you can set up super quickly; you don’t register a username, you don’t register a password. The only thing you do have is a random string email address on a chatmail relay (which you don’t have to memorize). To maintain access to your profile, you just need to add a second device to your account via QR code or make a backup of your account, which you can restore later. Fail to do these, your account is gone - as it should be if you don’t want to leave accounts that could get hacked later on. My decision to block Google stuff on my Nokia was done for practical reasons; the device sucked when it launched, and it sucks even more now. The nice thing about F-Droid and the apps within is that they’re usually lightweight, free of bloat, and work well on that device. What was inconvenient for me was that it was hard to send messages from that device, say if I wanted to copy a code over to my main phone or send family members a link from that device. That’s when I decided to look at the available chat apps and saw Delta Chat. Another nice thing about Delta Chat is its notifications. Some messaging apps rely on Google’s ecosystem for notification transport on Android; however, with Delta Chat, it can use Google’s solutions if you have Play Services or MicroG installed. Otherwise, it is able to keep a background connection to the chatmail relay server so that you can get notified when you receive a message. As free software, the code of Delta Chat is open for all who want to take it and build upon it. In the future, if the developers of Delta Chat make a catastrophically bad decision and take the app in an undesirable direction, users can take the code and fork the project. This contrasts with closed-source apps from corporations that can take their products in any direction they like. By relying on free software instead of closed-source programs, you actually control your computing. I’ve spoken at length about how running this type of software is like owning your own home rather than renting it. The same applies here; if you use Delta Chat, you don’t need to worry about it going away in the future. Whether it is Telegram, WhatsApp, or Messenger, you are required to register a username and password to use these services. A major flaw in this design is that anyone can try various passwords and potentially break into your account with your complete chat history intact. Sure, there is encryption in Messenger, where you need a second PIN and two-factor authentication in Telegram, but breaches happen all the time. Unlike before, when you used to sign in to your email account to send and receive messages, the primary way to do it now is to create an account on a chatmail relay. The resulting email address is a random string followed by the name of the relay you pick. This means you can start and begin adding contacts Without a username and password, you either need to ensure you have a backup or at least one device running your Delta Chat profile. The primary way to log in on another device is to go to the settings and add a second device. Then, you’ll just scan a QR code with your new device, and it’ll log in to your account and sync all your chat history and contacts. To end users, Delta Chat just looks like any instant messenger; however, it is really sending your messages as encrypted emails to your contact. This is pretty cool from a censorship perspective, as it makes the service more difficult to block. Previously, the main way to use the app was by logging in with email, but nowadays, it’s recommended that you use chatmail relays. Chatmail relays temporarily hold messages in case your device is offline. They are cheap, simple servers that don’t store data as group states. Other information, like your name and avatar, only exists on your device and the devices of those you share your contact information with. The relays are also decentralized and operated by various groups and individuals. It is even possible to set up your own chatmail relay, but most people will want to use one hosted elsewhere. To keep your messages secure, Delta Chat uses a secure subset of the OpenPGP standard that gives you automatic end-to-end encryption. It also uses Secure-Join to exchange encryption setup information through QR-code scanning or invite links. Autocrypt is also used to automatically establish end-to-end encryption between contacts and all members of group chat, but sometime this year Autocrypt v2 will be rolled out, bringing post-quantum resistant encryption and forward secrecy. The Delta Chat FAQ is an interesting read that explains many more details about the app. Credit: Pexels Delta Chat is unique among messaging apps because it is built on email, a technology that’s decades old and isn’t going anywhere soon. What’s more is that email is not centralized either, so it’s far more difficult for any authoritarian regime to disrupt the Delta Chat app. I haven’t spoken too much about features yet, so I will do that now. Delta Chat allows you to do one-on-one chats, group chats, and create channels. It also supports file sharing and making audio and video calls when chatting one-to-one, but it’s not available for group chats right now. At the time of writing, the calling functionality is disabled and can be enabled in Settings > Advanced > Debug Calls. I have used the video calling feature, and the quality is excellent. It works over WebRTC, another open standard. The app also lets you send voice notes, enables disappearing messages, and has its own app ecosystem. I did try playing chess one time there, but it was a bit spotty; though, we did manage to complete the game with a victory for me. To add people to Delta Chat, you can either give them your Delta Chat link or your QR code to scan. These are the only ways to add users, so you won't have any spam bots bothering you. If the people you want to chat with don't have the app yet, just send them your link, and it will take them to a webpage where they can install the app and then add you. It's really quick for them to install it and get started, which is nice. Credit: Microsoft. The Majorana 2 quantum chip unveiled in 2026. I do not think quantum computers are too far out now, and I do hope that Delta Chat is able to push out Autocrypt v2 sooner, rather than later, so bad actors do not attempt to collect encrypted communications and then decrypt them in the future using quantum computers. By getting people’s messages post-quantum-safe now, users won’t have to worry when quantum computers start cracking legacy encryption. Overall, I would recommend this app to people who are already past WhatsApp and Messenger and have perhaps begun using apps like Telegram or Session. It shares a lot of characteristics with these apps and goes a lot further than Telegram in terms of security. By being based on email, it is also resistant to censorship, and the lack of a username and password makes you anonymous (if you want to be) and safe from brute force password cracking attempts. Let me know in the comments if you’ve tried Delta Chat recently. Do you think it's a good bulwark against governments that are tightening their grip on the internet?
  • Recent Achievements

    • One Year In
      bernmeister earned a badge
      One Year In
    • Week One Done
      Scoobystu earned a badge
      Week One Done
    • Week One Done
      tuben earned a badge
      Week One Done
    • First Post
      OffsetAbs earned a badge
      First Post
    • Reacting Well
      OffsetAbs earned a badge
      Reacting Well
  • Popular Contributors

    1. 1
      +primortal
      471
    2. 2
      +Edouard
      217
    3. 3
      PsYcHoKiLLa
      156
    4. 4
      Steven P.
      73
    5. 5
      FloatingFatMan
      71
  • Tell a friend

    Love Neowin? Tell a friend!