One non-fatal point but something to be aware of with this approach; the list of hidden service addresses isn't itself hidden, and these servers are easy to fingerprint. So it's trivial to discover the list of all Ricochet identities, and also know when they are online (so over time perhaps who is talking to who).<p>Also, Tor hidden services are not necessarily designed for the case of a single address coming online and offline repeatedly. I don't think there are specific known exploits for that case other than the timing issues, but the other thing that comes to mind is cycling through too many guard nodes over time.