SimpleX SMP Server : OpSec | Torhoo darknet markets
yooo just started using simplex, got a quick question for you guys. Is hosting my own SMP relay actually good for opsec? do i need to run one to have optimal opsec setup?
It's straight forward to install SMP server, but you need to consider why you do it and what you wish to achieve.
If you for instance want to avoid using specific servers, or you want to be in control of your SMP server communication, etc. you could motivate this. On the other hand, you will be exposed to many attack vectors.
You need to consider the benefits with the concerns before just doing it.
Right. Self hosting SMP gives you control true. But control without compartmentalization becomes a risk multiplier.
If your goal is to reduce metadata exposure, then it might be worth it. But that assumes you already solved:
payment (anon)
hosting (non-traceable VPS or local box behind decoyed relay)
endpoint hygiene (no leaks, no DNS, no WebRTC, hardened OS)
physical risk (no tie to your identity/location)
Otherwise, you shift trust from third-party infra → to yourself without being more secure.
Also consider: SMP is async, no push notifications unless you build polling or push mechanisms, which introduces side-channels. Hosting also requires uptime, maintenance, patching against 0-days.
My take: unless you operate at vendor level opsec or above, you gain more by using vetted infra behind layered anonymity (VPN→Tor→client). Hosting should be a last step, not the first.
Normally you don't need to use your own servers, if your SimpleX is set properly. But it depends on your threat model. The servers in SimpleX case know more-less nothing about you.
it's fine, personally i recommend setting up onion-only simplex servers, it doesnt isolate you either to go onion-only because the official simplex servers have tor connectivity, and with their 2 hop private routing mechanism regular users can still contact you anyway
http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/opsec/anonsimplex-server/
If you for instance want to avoid using specific servers, or you want to be in control of your SMP server communication, etc. you could motivate this. On the other hand, you will be exposed to many attack vectors.
You need to consider the benefits with the concerns before just doing it.
If your goal is to reduce metadata exposure, then it might be worth it. But that assumes you already solved:
payment (anon)
hosting (non-traceable VPS or local box behind decoyed relay)
endpoint hygiene (no leaks, no DNS, no WebRTC, hardened OS)
physical risk (no tie to your identity/location)
Otherwise, you shift trust from third-party infra → to yourself without being more secure.
Also consider: SMP is async, no push notifications unless you build polling or push mechanisms, which introduces side-channels. Hosting also requires uptime, maintenance, patching against 0-days.
My take: unless you operate at vendor level opsec or above, you gain more by using vetted infra behind layered anonymity (VPN→Tor→client). Hosting should be a last step, not the first.