This is an automated archive made by the Lemmit Bot.
The original was posted on /r/opensource by /u/scotti_dev on 2025-06-20 17:54:46+00:00.
Hello all, I would love to get your feedback on a project I've just completed. I was fed up of email spam (as is everyone!) and decided to create Openmsg.
Its an open, cross-platform, decentralized messaging protocol that anyone can implement. I've uploaded it to github, but also created a website with documentation / setup guides etc.
The protocol is designed from the start to be spam-free. One user can't connect with another without explicit permission. For example, if "User A" wants to connect with "User B", they need to know not only User B's Openmsg address but also possess a one-time pass code that was issued by User B.
Without a valid passcode, any connection attempt will fail—user B won’t even be notified. Which means there's no spam messages, not even any spam requests.
An Openmsg addresses is in the following format:
01234567*domain.com
The first part is the user's numeric ID, the second is the domain of the server node (ie the service provider).
A pass code is only needed on the first interaction.
With a valid pass code and address for User A, User B can initiate a handshake with with User A's server node. During a successful handshake, private auth-codes and encryption keys are exchanged. User A and User B can then message each other, using the shared auth code to verify each other.
When User B then wants to message User A, a message package is sent to User A consisting of:
-The encrypted message
-The encryption nonce
-The unix timestamp
-A hash is then created from the private auth code and the 3 above componants and a salt. The auth code is not sent as both parties should have matching auth codes and encryption keys from the initial handshake.
When User A's server node receives the message package, it verifies that the message is genuinely from User B, and that it is a recent message. It does this by recreating the hash using the message, nonce and timestamp it was sent by User B, AND the auth code it possesses.
If the hash from User B matches the hash that User A just re-created, it proves the following:
-That the auth codes match (validating the sender has the auth code)
-That the message timestamp is genuine (only messages that were created in the last 60 seconds will be accepted by the server) preventing an old hash from being used,
-And that the message hasn't been altered from when the hash was created. This prevents spoofing a message with an old hash.
Server A will send a cURL request to server B (the domain in the users address that was stored during the handshake) with the message hash to check that it did just send a message matching that hash. When server B confirms that it did, then Server A accepts the message on behalf of User A.
This prevents leaked auth codes from being used to send messages to someone from a different server, as the receiving node always checks with the server it was expecting to receive the message from.
The main part consists of just a few scripts that can be copied and uploaded to your own server. There is a setup.php that sets up the database tables, a settings file, and then a couple of files that handles the rest.
Let me know your thoughts, if you have any ideas or suggestions (I have a roadmap of features I would like to introduce)
https://github.com/Openmsg-io/version_1.0
https://www.openmsg.io/