16 ms·

Messenger systems compared by security, privacy, compatibility, and features

300 points by lrvick 8y ago

tooker 8y ago
https://forsta.io https://forsta.io is missing.
proaralyst 8y ago
I would like to use Riot/Matrix but its UI (at least on Android) is terrible. I can't convince non-technical friends & family to switch. Part of the problem is the inability to assign nicknames to contacts, so you have to remember everyone's Matrix ID.
- secfirstmd 8y ago
  Yes. I think it's brilliant but the UI/UX needs a big update. Also from a techie point of view it's cool but from a normal user, there are too many options in group chats. Esp when people change phones etc.
- giancarlostoro 8y ago
  Not just the UI but it's still rough around the edges in some cases. I ran into a couple bugs, I realize now I shoulda reported / researched further into, but my use for it is minimalist.
- electrograv 8y ago
  For me, the problem is how incredibly slow Riot is (and every other client I've tried has almost unusable bad UI, sometimes in combination with being slow). IMO: Text chat with a few emojis and images here and there should not ever be among the things that slows your computer to a crawl. EDIT: I'm speaking of the UI, not the network connection; the latter is sometimes slow too, but that's understandable
  - ATsch 8y ago
    It's very likely that what was slow there was not riot, but the server. The Matrix.org homeserver is notoriously overloaded.
    - matoro 8y ago
      Agreed, I set one up and tried to convince people to switch but the latency made it just unusable. It worked fine with a channel or two but if someone tried to join a federated channel it would bring the whole thing to its knees for hours at a time, knocking out the local channels with it.
    - seba_dos1 8y ago
      Matrix.org is so slow it's borderline unusable, that's right. However, while switching to another homeserver (and avoiding federating with big rooms like Matrix HQ) helps a lot, Riot isn't exactly a lightweight client as well.
  - lucideer 8y ago
    If you want to experience full speed Riot, you can choose a different server. This basically comes down to client UX: if server choice were more discoverable or if it at least didn't always default to the same one, then everyone wouldn't end up on a single overloaded server.
    - electrograv 8y ago
      I was primarily talking about UI lag, not network speed. Network speed was slow at times, but the worst above all was how laggy every keystroke is, every UI click, etc. and how much CPU it burns (heating up my laptop whenever it's open). Native IRC clients for example have no such problem, and consume ~0% CPU at all times.
      - lucideer 8y ago
        > heating up my laptop Aha, I was thinking of the mobile client, which is fine perf-wise imo. But yes, the Desktop/web client is very Slack-esque. Not in a good way.
- mxuribe 8y ago
  I won't argue any of your UI opinions other than to say that riot - which is only one of the many possible clients [1] over the matrix protocol - is still in early days, and is getting better with each version. That being said, as far as having to remember everyone's matrix id, I'm sure users had similar complaints back when email addresses were still novel. I'm sure conceptual address books will be a thing in future matrix clients - both riot as well as others. Failing that, you can always submit a feature request! [2] [1] https://matrix.org/docs/projects/clients-matrix https://matrix.org/docs/projects/clients-matrix [2] https://github.com/vector-im/riot-web https://github.com/vector-im/riot-web
- mahemm 8y ago
  Why not use Signal? Better privacy guarantees and the same underlying protocol.
  - proaralyst 8y ago
    Had the same UI problems. Also Signal isn't federated and doesn't use the Matrix protocol.
pricechild 8y ago
IRC is listed as "E2E Private" true?
- geoah 8y ago
  I assume it depends on the client?
  - pricechild 8y ago
    If you can communicate random text, you can layer E2E encryption over almost any communication medium. OTR is a great example of this. But it isn't a feature of the protocol. Many irc servers listen on an ssl port, but this then only encrypts data between client and server. The data is decrypted on the server and sent to other clients. (Maybe encrypted) Some ircd's support "encrypted only channels" where if you're not connected via ssl, you can't /join
- giancarlostoro 8y ago
  You can use Pidgin as an IRC client and I'm sure with the OTR plugin you could have some E2E convo with someone else.
geoah 8y ago
This is great thank you!! Would love if the decentralised/federated were two distinct columns. :D
Peskier 8y ago
Maybe we could add a section regarding Api's, developer features or available authentication methods?
fyfy18 8y ago
Are there any good XMPP clients that provide a "modern" messenger experience? For example seamlessly switching between online/offline mode, built in audio and video calls, sharing photos/videos.
- Zash 8y ago
  These ones perhaps? https://conversations.im/ https://conversations.im/ https://conversejs.org/ https://conversejs.org/ https://dino.im/ https://dino.im/
  - vader1 8y ago
    Yes, Conversations (Android) and ConverseJS (web) are on par with - or better than - the commercial apps like Whatsapp. On ios, Chatsecure is pretty close.
    - fyfy18 8y ago
      Didn't realise there were so many, I guess XMPP isn't dead after all. Also worth mentioning Zom is a fork of the Chatsecure (on iOS) and Conversations (on Android) with a more UX focussed interface. https://zom.im https://zom.im
- pmlnr 8y ago
  Cross platform, closed source, including Jingle (audio/video): http://astrachat.com/ http://astrachat.com/ Android (no audio/video): https://conversations.im/ https://conversations.im/ Web: https://conversejs.org/ https://conversejs.org/ Web with extras: https://movim.eu/ https://movim.eu/ Desktop (Mac): https://adium.im/ https://adium.im/ Desktop (Win): https://gajim.org/ https://gajim.org/ (not sure about this) Desktop (Linux): http://pidgin.im/ http://pidgin.im/ (needs extras: https://petermolnar.net/instant-messenger-hell/#extra-plugins-for-pidgin https://petermolnar.net/instant-messenger-hell/#extra-plugin... )
  - vader1 8y ago
    Pidgin is barely maintained for the last couple of years and doesn't support most modern XMPP extensions. I'd definitely recommend Gajim on both Windows and Linux, which supports everything you need out of the box.
singhrac 8y ago
Does anyone know what supports E2E encrypted video? (Great doc btw)
- CodeArtisan 8y ago
  Wire https://wire.com/ https://wire.com/
  - datamoshr 8y ago
    Wire comes with a short-fall by virtue of the fact they store a lot of metadata about you.[1] Obviously your threat model informs this. [1]: https://twitter.com/tqbf/status/862394778331361281 https://twitter.com/tqbf/status/862394778331361281
- crtasm 8y ago
  I believe video calls on Signal are?
  - lozf 8y ago
    Yes, but like most of these, that's really to do with the fact that E2E is part of the WebRTC spec, so anything built on it is safe for audio & video... the main advantage of Signal here is not leaking all your metadata.
- enitihas 8y ago
  WhatsApp does, atleast their doc says so. https://faq.whatsapp.com/en/android/28030015/ https://faq.whatsapp.com/en/android/28030015/ ( So as we’ve introduced more features – like video calling and Status – we’ve extended end-to-end encryption to these features as well.)
- pmlnr 8y ago
  Nextcloud Talk does that, 2nd on the list.
nolok 8y ago
There are two "Line" listed, is it a mistake or are there really two of the same name ? Because LINE claims to support E2E by default ("Letter Sealing"), but only one of those two listing says "claimed" (the other say false).
lucaspottersky 8y ago
look at that, XMPP is the future! /sarcasm
otabdeveloper1 8y ago
Where's the "don't allocate 8 gigabytes and crash the system" feature? (Yeah Slack, I'm looking at you.)
- toxik 8y ago
  Indeed, and for "compatibility" it doesn't really say anything about the quality of the software for that system. Signal, for example, doesn't have a native iOS app and it shows.
  - chrisballinger 8y ago
    Yes it does? https://github.com/signalapp/Signal-iOS https://github.com/signalapp/Signal-iOS
  - Daneel_ 8y ago
    It definitely does - I use it daily. Searching for ‘Signal’ on the App Store brings it back as the first result.
  - Infernal 8y ago
    Maybe you meant that it doesn’t have a native macOS app? It is indeed an Electron app on macOS.
- rvanmil 8y ago
  Funny how that works isn't it. Let's start out with Electron so we can get our new app on all platforms quickly, we'll build a proper native UX when we can afford to >> company grows and grows >> yeah, so screw UX, where are our customers going to go instead? Hipchat? lol, let's buy them instead.
swiftcoder 8y ago
What is the data source for all of these? I'm particularly curious about a number of the "claimed" entries.
- ub 8y ago
  +1 It seems like someone just created a spreadsheet with no description of what methodology was used to test the assertions.
  - lrvick 8y ago
    If you click the cells you will see the rationale for columns or what "claimed" means etc.
kilare 8y ago
No mention of Semaphor by SpiderOak?
- lrvick 8y ago
  looking into it and adding it.
momentito 8y ago
Have your tried Grape (chatgrape.com)? On-Premises and Eurocloud, used by banks, telco providers, city departments, energy providers etc. in Europe
John_KZ 8y ago
There still isn't a popular messaging and voice call platform that supports private end-to-end encryption by default. How terrible is this? I mean it would be so trivial to establish a secure and private communications standard. Europe and North America has a population of almost a billion people combined. If 500 millions of those live in first-world conditions and only 1% cares about privacy, with $1/year worth of giving a fuck we could have a budget of $5M/year, or close to 50 top notch developers to pull this off. Obviously a lot more could be spend, but even with this minuscule spending we could still have a viable, standardized alternative to Facebook and Google. We literally had better privacy when we had analog phone lines that anyone could tap into. That's just terrible.
- enitihas 8y ago
  Doesn't WhatsApp do that? (https://faq.whatsapp.com/en/android/28030015/ https://faq.whatsapp.com/en/android/28030015/)
  - codemusings 8y ago
    If I recall correctly Facebook has plans to end E2E encryption in order to serve personalized ads.
    - enitihas 8y ago
      Maybe, but at least currently it does support E2E.
    - fwn 8y ago
      Would be very interesting to read more about it. Do you recall where you've learned about it?
    - lozf 8y ago
      Even before then it's highly likely that they're gathering as much metadata as possible:- * who's chatting with whom, * via what means (text, audio, video), * conversation time and duration, * location of participants, * how much data transferred etc. There's a lot they can gather and imply from all that when WA users phone numbers will be known to FB, so they can graph connections via others' who run the FB app or previously shared their contact info. Also those who are perhaps logged in on, or simply visiting other sites they track via like/share buttons etc. Whilst what you say is encrypted, the circumstances around that conversation can be used, at least to advertise to you.
mirap 8y ago
Why is Signal scoring so bad?
- lucideer 8y ago
  The scoring seems arbitrary/subjective.
- fiter 8y ago
  I stopped using Signal due to being bitten by the the issue where a friend uninstalled Signal without going through a special process and then I couldn't send messages to them without changing my message type from encrypted to unencrypted every time. See report/references here[0]. [0] https://github.com/signalapp/Signal-Android/issues/8181 https://github.com/signalapp/Signal-Android/issues/8181
- seba_dos1 8y ago
  It's just a yet another closed silo. Its score seems about right relative to other listed networks.
turdnagel 8y ago
Surprised public API availability is not listed.
- mappu 8y ago
  This is a pretty important category for me. Users are actually pretty happy to migrate to new chat systems (with clear benefits) if you can pull off a gradual migration with seamless chat linking. I did a gradual migration of our group chat from $LEGACY_CHAT_SYSTEM to Telegram because at the time, all the options with better crypto stories fell down; WhatsApp is very anti-bot, Wire's API was unusable on free accounts, Signal's group chats work differently / would've needed O(n) phone numbers, Rocketchat's IRC integration was incompatible, Matrix couldn't be simplified to hide the federation for standalone, etc etc.
CiPHPerCoder 8y ago
> Signal --- Introduced: 2017 What https://signal.org/blog/the-new-textsecure/ https://signal.org/blog/the-new-textsecure/
lucideer 8y ago
As there's pretty obvious bias showing in the values, some methodology would be good to accompany this sheet. e.g. - Telegram: E2E Private: TRUE - WhatsApp: E2E Private: CLAIMED These are either both "true", or both "claimed". Pick one. In particular, what's the definition of the "Open Spec" column? Signal's GPL spec gets a FALSE here so I'm presuming the definition is something along the lines of "Spec produced by one ofa group of arbitrarily approved bodies of which Open Whisper is not a member"
- cbg0 8y ago
  The comments specify what "claimed" means: > Not possible to verify as application is closed source. Maintainer could compromise security at any time without detection. I think it's useful to have this differentiation, even though technically you could say E2E is TRUE for both of these.
  - lucideer 8y ago
    Ah, thanks, I didn't see those comments. That makes some sense for the E2E actually. That's a very reasonable distinction. Technically one could still argue the same for Telegram unless you're self-building given their source-release delays but that might be nitpick too far.
    - dijit 8y ago
      However; compiled versions and binary distributed versions would not suppport E2E chats together if there were any significant difference.
      - lucideer 8y ago
        This isn't true. A trivial example of a significant difference in which they would still interoperate would be a binary distributed version which phones home the shared key.
        8y ago
p4bl0 8y ago
Nice. It's missing RetroShare (which is not only a messenger system but can be used as one) :).
arendtio 8y ago
Well, that is a protocol comparison. A client comparison would be much closer to the real world user experience. Don't get me wrong, I am a huge fan (and daily user) of XMPP, but the best protocol will not be of any use if the clients are too complicated or buggy to use. So yes, XMPP supports audio and video calls but finding two different clients which work on the first try together can be a challenge. Sometimes I wish there would be some compatibility XEP which defines a common set of supported XEPs including a test suite to run it against.
- giancarlostoro 8y ago
  Sounds like you may want to consider writing the spec for such a XEP?
- ge0rg 8y ago
  We have the XMPP Compliance Suites 2018[0] providing an overview of protocol-level specifications that a modern client or server should implement, and there was recently a nice article[1] for some example use cases. What is still missing is everything above the wire protocol level. The XSF, being the XMPP Standards Foundation, is guarding the protocols, and things like UX and client interoperability are considered as off-scope. However, there are people interested in these topics as well looking for fresh collaborators. [0] https://xmpp.org/extensions/xep-0387.html https://xmpp.org/extensions/xep-0387.html [1] https://www.erlang-solutions.com/blog/21-xmpp-use-cases-and-the-best-ways-to-achieve-them.html https://www.erlang-solutions.com/blog/21-xmpp-use-cases-and-...
  - arendtio 8y ago
    That looks pretty cool. Maybe I should ask SamWhited why they didn't include OMEMO, Audio and Video Calls as features as he is writing in this thread too :D
- pmlnr 8y ago
  > real world user experience I'm getting so tired of this. Real world user experience is that the constantly changing interfaces are driving everyone mad. Stick to a thing and let people learn it.
lvh 8y ago
This is neat but it has plenty of flaws. I wish the definitions were spelled out. It says Signal isn't "anonymous", which I assume means "uses a phone number to find peers". And it has the usual feature matrix problem: sure XMPP "does E2E". But what does that mean? It supports S/MIME. Do you want S/MIME? (You don't.) It supports OTR, TS and SCIMP too: but you need to be an expert in messaging schemes to understand how those are different. None of them implement double ratchets. None of them implement even close to the privacy features Signal has implemented. But on this diagram it is clearly better because there is more green and less red. Another example: "open server" and "on-premise" says nothing about whether or not you really want to run one of those instances. It just says that hypothetically one could. In terms of errors: the linked "E2E audit" for Telegram did not audit E2E at all, and in fact only cites sources saying that it's probably fucked. Wire has a real audit that isn't listed. WhatsApp uses Signal, just with fewer of the. Use WhatsApp to talk to normal people. Use Signal for nerds, and... probably Matrix for group collab? Or maybe stop caring about secure messages for group collab so much :-)
- arendtio 8y ago
  Your points are valid but you didn't mention that OMEMO [1] implements Double Ratchet for XMPP. You can find a list of clients which support OMEMO on https://omemo.top https://omemo.top [1] https://en.wikipedia.org/wiki/OMEMO https://en.wikipedia.org/wiki/OMEMO
  - lvh 8y ago
    That's a fair point, but the fact that there's yet another protocol, not mentioned on the XMPP E2E wiki, kinda plays into the point itself: XMPP has E2E maybe with a bunch of random protocols and the stars (and the people you talk with) need to align _just right_ for all of it to work. I think it would be fair to say that everyone uses WhatsApp and I know what they get, and at this point only XMPP people use XMPP (explicitly) and maybe they get some kind of E2E but who knows which one and what properties that has.
    - vader1 8y ago
mxuribe 8y ago
So, riot/matrix, nextcloud/talk, briar, and xmpp should merge together into a super-mega-awesome-protocol and transform into mega-message! ;-)
deleted 8y ago
[deleted]
pmontra 8y ago
A missing column among the Features is if a system allows automation (chatbots or other). Notable examples: Telegram and FB Messenger do, WhatsApp doesn't (there are workarounds but they're mostly against the Terms of Service.)
- lrvick 8y ago
  Great suggestion. Will add this.
bootlooped 8y ago
Kakao Talk has claimed to have E2E Encrypted chat at least since 2014; it is not on by default. https://www.pcworld.com/article/2856452/kakao-talk-adds-secret-chat-feature-amid-privacy-worries.html https://www.pcworld.com/article/2856452/kakao-talk-adds-secr... https://techcrunch.com/2014/12/07/chat-app-kakao-talk-begins-offering-opt-in-encryption-following-recent-privacy-storm/ https://techcrunch.com/2014/12/07/chat-app-kakao-talk-begins...
- daurnimator 8y ago
  Amended.
bkfh 8y ago
I came across Tungsten Messenger the other day and it's supporting even multiple personas (public, private) and runs traffic via Tor. Pretty neat UI and the team is throwing out new features regularly: http://tungstenapp.com/ http://tungstenapp.com/ (Edit: typo)
akareilly 8y ago
Here's another scorecard: https://www.securemessagingapps.com/ https://www.securemessagingapps.com/ The EFF doesn't do recommendations for all users - whether a messenger works for someone depends on their threat model. https://www.eff.org/deeplinks/2018/03/why-we-cant-give-you-recommendation https://www.eff.org/deeplinks/2018/03/why-we-cant-give-you-r...
deleted 8y ago
[deleted]
LinuxBender 8y ago
There is no mention of Mumble (client) or Murmur (server). [1] From a privacy perspective, I find it superior to everything else. End-to-end voice encryption with PFS. As much or little server logging as you wish. Super easy to set up and scales to large numbers of people. I have a few of them running on VM's with 1GB ram. Only downside for me: It is not as happy-clicky (frictionless) as discord, yet. Authentication can be tied into 3rd party apps (LDAP, phpBB, etc) but I have not tested this yet. [2] If you try it, use their latest snapshot for server and client. Incredible sound quality. Nice UI/UX experience. Decent support for game overlays. Very low CPU usage. [1] - https://wiki.mumble.info/wiki/Main_Page https://wiki.mumble.info/wiki/Main_Page [2] - https://wiki.mumble.info/wiki/3rd_Party_Applications#Authenticators https://wiki.mumble.info/wiki/3rd_Party_Applications#Authent...
- lrvick 8y ago
  Added!
OnlyRepliesToBS 8y ago
the wrong lessons were learned a decade ago
rdtsc 8y ago
It's funny and sad that XMPP hits almost all of the points, has been around since 1999 and yet every year someone reinvents the wheel and makes another messenger system. There are what, about 60+ by now. Granted XMPP is not a messenger it's a protocol and a bunch of standards but still it's hard not to laugh.
- gaff33 8y ago
  XMPP has a terrible user experience, which is why it's never caught on.
  - saagarjha 8y ago
    XMPP is a protocol; it doesn't have a user experience. Sure, it may have been difficult to adapt for mobile, but that doesn't mean it inherently has a poor experience.
    - lvh 8y ago
      This is silly hair-splitting. If it's "hard to adapt" to mobile then it's the protocol implying poor UX. Fortunately, in XMPP country, we're always just a XEP away! </s>
      - SamWhited 8y ago
        It's actually pretty easy to adapt to mobile, it may have been hard in 1998 when it was released, but these days with stream management (session resumption and TLS like packet counting) and message archive management (history and catchup) it's pretty great on mobile. The round trips to log in have also been significantly reduced (you'll incur a few more if you use SCRAM based auth, but there's always a trade off for security), though there are still a few of them for the most basic login. If you ignore TLS (which can come first so you don't have to do STARTTLS anymore) and do PLAIN auth (over TLS so it's fine) I think you have 3 round trips to login. That can be improved in the future with pipelining which has some experimental specs out. See also: https://xmpp.org/extensions/xep-0286.html https://xmpp.org/extensions/xep-0286.html
amckinlay 8y ago
Is there any messenger that does end-to-end encryption with reliable, in-order delivery with decentralized group chat and conversation history syncing? Been looking for years but so far the double-ratchet is inadequate.
- LinuxBender 8y ago
  Mumble / Murmur are close to this, but without chat history syncing. End-To-End PFS encryption though. Very decentralized, but you can tie it into ldap and other authentication systems. I linked in another part of this thread.
c8g 8y ago
nextcloud talk looks good. btw, telegram web has mobile support.
- eeetzatrap 8y ago
  Just installed the Nextcloud Talk App. I'm toes deep, but it looks pretty neat so far.
clofresh 8y ago
Needs to be updated to show which of my friends use which system
crunchiebones 8y ago
I can't see Jitsi there
- crunchiebones 8y ago
  also, what about 'blockchain messaging' apps like Dust, Echo etc. ?
  - lvh 8y ago
    Dust is woefully underspecified and uses an ancient design with no forward secrecy and no (specified) message or sender authentication of any kind. Blockchain, as usual, purports to solve a problem nobody had. Dust doesn't try to address the simplest, best-understood problems we have for reputation systems on chained blocks.
saagarjha 8y ago
iMessage is technically phoneless; you can sign up with your Apple ID on macOS.
jstanley 8y ago
What does "E2E Audit" mean? Or, why does Ricochet have a "false"? The Ricochet codebase has been audited, if that's what it's supposed to mean.
- jhammons 8y ago
  I think it means two parties can verify their public encryption keys with one another.
  - jstanley 8y ago
    E.g. by comparing them in person? Ricochet can do that. The "Ricochet ID" is just a hash of the public key, so if you meet up in person and verify that you have added the correct ID for your counterparty, that sounds like you've verified the public keys, no?
- lvh 8y ago
  Since the author added a link to the Wire audit after I pointed out it existed, I think it means "third party has audited it and verified claims". On the other hand, they also still claim Telegram has been audited in this sense, which I have also pointed out and they have not resolved.
SamWhited 8y ago
XMPP is a protocol meant for building chat services; some of these others are chat services themselves so eg. it doesn't make sense to say that XMPP is not e2e by default (of course it's not, it's a protocol which may or may not be used to build an e2e encrypted chat service). Maybe that should be changed to "Jabber" which is what a lot of people call the public, federated network of servers built on XMPP these days? (The term has all sorts of other historical baggage and some people use XMPP/Jabber as synonyms, but mostly I think people use Jabber to refer to the public network these days and XMPP to the protocol, rather like email and SMTP).
gyvastis 8y ago
Would be nice to show some numbers as well, how much are these platforms used.
unsignedint 8y ago
LINE E2E are "Partial Claimed" their E2E encryption only encrypts text and GPS location and other are not encrypted.[0] [0]: https://engineering.linecorp.com/en/blog/detail/65 https://engineering.linecorp.com/en/blog/detail/65
mo3gut 8y ago
It's amusing that this is hosted by a spyware vendor.
ac4tw 8y ago
Interesting comparison Irvick. Enjoying the resuling conversation too. More detail on meanings and methodology would be helpful as some other HN folks suggest. Stealthy.im isn't mentioned (I develop that presently). Stealthy makes use of decentralized identity in the blockchain and a decentralized storage system called GAIA. Regular chat is E2E encrypted using ECIES. Currently released for Android and iOS.
- deleted 8y ago
  [deleted]
oropolo 8y ago
With categories emphasizing security, open standards, and audited code, I'm surprised SpiderOak's Semaphor isn't on this list: https://spideroak.com/semaphor/ https://spideroak.com/semaphor/
paxy 8y ago
What's the difference behind TLS "true" or "claimed"? It's pretty straightforward to verify all outgoing requests the client is making without looking at source code.
egypturnash 8y ago
So many competing, incompatible protocols. So, so many. Also this is lacking a column for "stickers". Seriously they are one of the things that has my and my crowd using Telegram, especially since it's really easy to make your own custom sets instead of relying on whatever they pay someone to draw for you.
codedokode 8y ago
I think Tox should be higher than Jabber. With Tox, there are no servers and contact list is stored on your device. With Jabber, it is stored on the server (and will be happily provided to NSA when needed). So unless you deploy your own Jabber server, it provides less privacy. Regarding Wire, is not contact list stored on Wire's server? Then it is even less private than Jabber.
tanderson92 8y ago
The spreadsheet seems to be missing e-mail.
jplayer01 8y ago
A flawed document like this does far more harm than it does good. I'd implore the author to take it down before they mislead people into drawing the wrong conclusions.
touristtam 8y ago
No hipchat from atlassian ?

300 points by lrvick 8y ago

https://forsta.io https://forsta.io is missing.

I would like to use Riot/Matrix but its UI (at least on Android) is terrible. I can't convince non-technical friends & family to switch. Part of the problem is the inability to assign nicknames to contacts, so you have to remember everyone's Matrix ID.

secfirstmd 8y ago
Yes. I think it's brilliant but the UI/UX needs a big update. Also from a techie point of view it's cool but from a normal user, there are too many options in group chats. Esp when people change phones etc.
giancarlostoro 8y ago
Not just the UI but it's still rough around the edges in some cases. I ran into a couple bugs, I realize now I shoulda reported / researched further into, but my use for it is minimalist.
electrograv 8y ago
For me, the problem is how incredibly slow Riot is (and every other client I've tried has almost unusable bad UI, sometimes in combination with being slow). IMO: Text chat with a few emojis and images here and there should not ever be among the things that slows your computer to a crawl. EDIT: I'm speaking of the UI, not the network connection; the latter is sometimes slow too, but that's understandable
- ATsch 8y ago
  It's very likely that what was slow there was not riot, but the server. The Matrix.org homeserver is notoriously overloaded.
  - matoro 8y ago
    Agreed, I set one up and tried to convince people to switch but the latency made it just unusable. It worked fine with a channel or two but if someone tried to join a federated channel it would bring the whole thing to its knees for hours at a time, knocking out the local channels with it.
  - seba_dos1 8y ago
    Matrix.org is so slow it's borderline unusable, that's right. However, while switching to another homeserver (and avoiding federating with big rooms like Matrix HQ) helps a lot, Riot isn't exactly a lightweight client as well.
- lucideer 8y ago
  If you want to experience full speed Riot, you can choose a different server. This basically comes down to client UX: if server choice were more discoverable or if it at least didn't always default to the same one, then everyone wouldn't end up on a single overloaded server.
  - electrograv 8y ago
    I was primarily talking about UI lag, not network speed. Network speed was slow at times, but the worst above all was how laggy every keystroke is, every UI click, etc. and how much CPU it burns (heating up my laptop whenever it's open). Native IRC clients for example have no such problem, and consume ~0% CPU at all times.
    - lucideer 8y ago
      > heating up my laptop Aha, I was thinking of the mobile client, which is fine perf-wise imo. But yes, the Desktop/web client is very Slack-esque. Not in a good way.
mxuribe 8y ago
I won't argue any of your UI opinions other than to say that riot - which is only one of the many possible clients [1] over the matrix protocol - is still in early days, and is getting better with each version. That being said, as far as having to remember everyone's matrix id, I'm sure users had similar complaints back when email addresses were still novel. I'm sure conceptual address books will be a thing in future matrix clients - both riot as well as others. Failing that, you can always submit a feature request! [2] [1] https://matrix.org/docs/projects/clients-matrix https://matrix.org/docs/projects/clients-matrix [2] https://github.com/vector-im/riot-web https://github.com/vector-im/riot-web
mahemm 8y ago
Why not use Signal? Better privacy guarantees and the same underlying protocol.
- proaralyst 8y ago
  Had the same UI problems. Also Signal isn't federated and doesn't use the Matrix protocol.

pricechild 8y ago

IRC is listed as "E2E Private" true?

geoah 8y ago
I assume it depends on the client?
- pricechild 8y ago
  If you can communicate random text, you can layer E2E encryption over almost any communication medium. OTR is a great example of this. But it isn't a feature of the protocol. Many irc servers listen on an ssl port, but this then only encrypts data between client and server. The data is decrypted on the server and sent to other clients. (Maybe encrypted) Some ircd's support "encrypted only channels" where if you're not connected via ssl, you can't /join
giancarlostoro 8y ago
You can use Pidgin as an IRC client and I'm sure with the OTR plugin you could have some E2E convo with someone else.

geoah 8y ago

This is great thank you!! Would love if the decentralised/federated were two distinct columns. :D

Peskier 8y ago

Maybe we could add a section regarding Api's, developer features or available authentication methods?

fyfy18 8y ago

Are there any good XMPP clients that provide a "modern" messenger experience? For example seamlessly switching between online/offline mode, built in audio and video calls, sharing photos/videos.

Zash 8y ago
These ones perhaps? https://conversations.im/ https://conversations.im/ https://conversejs.org/ https://conversejs.org/ https://dino.im/ https://dino.im/
- vader1 8y ago
  Yes, Conversations (Android) and ConverseJS (web) are on par with - or better than - the commercial apps like Whatsapp. On ios, Chatsecure is pretty close.
  - fyfy18 8y ago
    Didn't realise there were so many, I guess XMPP isn't dead after all. Also worth mentioning Zom is a fork of the Chatsecure (on iOS) and Conversations (on Android) with a more UX focussed interface. https://zom.im https://zom.im
pmlnr 8y ago
Cross platform, closed source, including Jingle (audio/video): http://astrachat.com/ http://astrachat.com/ Android (no audio/video): https://conversations.im/ https://conversations.im/ Web: https://conversejs.org/ https://conversejs.org/ Web with extras: https://movim.eu/ https://movim.eu/ Desktop (Mac): https://adium.im/ https://adium.im/ Desktop (Win): https://gajim.org/ https://gajim.org/ (not sure about this) Desktop (Linux): http://pidgin.im/ http://pidgin.im/ (needs extras: https://petermolnar.net/instant-messenger-hell/#extra-plugins-for-pidgin https://petermolnar.net/instant-messenger-hell/#extra-plugin... )
- vader1 8y ago
  Pidgin is barely maintained for the last couple of years and doesn't support most modern XMPP extensions. I'd definitely recommend Gajim on both Windows and Linux, which supports everything you need out of the box.

singhrac 8y ago

Does anyone know what supports E2E encrypted video? (Great doc btw)

CodeArtisan 8y ago
Wire https://wire.com/ https://wire.com/
- datamoshr 8y ago
  Wire comes with a short-fall by virtue of the fact they store a lot of metadata about you.[1] Obviously your threat model informs this. [1]: https://twitter.com/tqbf/status/862394778331361281 https://twitter.com/tqbf/status/862394778331361281
crtasm 8y ago
I believe video calls on Signal are?
- lozf 8y ago
  Yes, but like most of these, that's really to do with the fact that E2E is part of the WebRTC spec, so anything built on it is safe for audio & video... the main advantage of Signal here is not leaking all your metadata.
enitihas 8y ago
WhatsApp does, atleast their doc says so. https://faq.whatsapp.com/en/android/28030015/ https://faq.whatsapp.com/en/android/28030015/ ( So as we’ve introduced more features – like video calling and Status – we’ve extended end-to-end encryption to these features as well.)
pmlnr 8y ago
Nextcloud Talk does that, 2nd on the list.

nolok 8y ago

There are two "Line" listed, is it a mistake or are there really two of the same name ? Because LINE claims to support E2E by default ("Letter Sealing"), but only one of those two listing says "claimed" (the other say false).

lucaspottersky 8y ago

look at that, XMPP is the future! /sarcasm

otabdeveloper1 8y ago

Where's the "don't allocate 8 gigabytes and crash the system" feature? (Yeah Slack, I'm looking at you.)

toxik 8y ago
Indeed, and for "compatibility" it doesn't really say anything about the quality of the software for that system. Signal, for example, doesn't have a native iOS app and it shows.
- chrisballinger 8y ago
  Yes it does? https://github.com/signalapp/Signal-iOS https://github.com/signalapp/Signal-iOS
- Daneel_ 8y ago
  It definitely does - I use it daily. Searching for ‘Signal’ on the App Store brings it back as the first result.
- Infernal 8y ago
  Maybe you meant that it doesn’t have a native macOS app? It is indeed an Electron app on macOS.
rvanmil 8y ago
Funny how that works isn't it. Let's start out with Electron so we can get our new app on all platforms quickly, we'll build a proper native UX when we can afford to >> company grows and grows >> yeah, so screw UX, where are our customers going to go instead? Hipchat? lol, let's buy them instead.

swiftcoder 8y ago

What is the data source for all of these? I'm particularly curious about a number of the "claimed" entries.

ub 8y ago
+1 It seems like someone just created a spreadsheet with no description of what methodology was used to test the assertions.
- lrvick 8y ago
  If you click the cells you will see the rationale for columns or what "claimed" means etc.

kilare 8y ago

No mention of Semaphor by SpiderOak?

lrvick 8y ago
looking into it and adding it.

momentito 8y ago

Have your tried Grape (chatgrape.com)? On-Premises and Eurocloud, used by banks, telco providers, city departments, energy providers etc. in Europe

John_KZ 8y ago

There still isn't a popular messaging and voice call platform that supports private end-to-end encryption by default. How terrible is this? I mean it would be so trivial to establish a secure and private communications standard. Europe and North America has a population of almost a billion people combined. If 500 millions of those live in first-world conditions and only 1% cares about privacy, with $1/year worth of giving a fuck we could have a budget of $5M/year, or close to 50 top notch developers to pull this off. Obviously a lot more could be spend, but even with this minuscule spending we could still have a viable, standardized alternative to Facebook and Google. We literally had better privacy when we had analog phone lines that anyone could tap into. That's just terrible.

enitihas 8y ago
Doesn't WhatsApp do that? (https://faq.whatsapp.com/en/android/28030015/ https://faq.whatsapp.com/en/android/28030015/)
- codemusings 8y ago
  If I recall correctly Facebook has plans to end E2E encryption in order to serve personalized ads.
  - enitihas 8y ago
    Maybe, but at least currently it does support E2E.
  - fwn 8y ago
    Would be very interesting to read more about it. Do you recall where you've learned about it?
  - lozf 8y ago
    Even before then it's highly likely that they're gathering as much metadata as possible:- * who's chatting with whom, * via what means (text, audio, video), * conversation time and duration, * location of participants, * how much data transferred etc. There's a lot they can gather and imply from all that when WA users phone numbers will be known to FB, so they can graph connections via others' who run the FB app or previously shared their contact info. Also those who are perhaps logged in on, or simply visiting other sites they track via like/share buttons etc. Whilst what you say is encrypted, the circumstances around that conversation can be used, at least to advertise to you.

mirap 8y ago

Why is Signal scoring so bad?

lucideer 8y ago
The scoring seems arbitrary/subjective.
fiter 8y ago
I stopped using Signal due to being bitten by the the issue where a friend uninstalled Signal without going through a special process and then I couldn't send messages to them without changing my message type from encrypted to unencrypted every time. See report/references here[0]. [0] https://github.com/signalapp/Signal-Android/issues/8181 https://github.com/signalapp/Signal-Android/issues/8181
seba_dos1 8y ago
It's just a yet another closed silo. Its score seems about right relative to other listed networks.

turdnagel 8y ago

Surprised public API availability is not listed.

mappu 8y ago
This is a pretty important category for me. Users are actually pretty happy to migrate to new chat systems (with clear benefits) if you can pull off a gradual migration with seamless chat linking. I did a gradual migration of our group chat from $LEGACY_CHAT_SYSTEM to Telegram because at the time, all the options with better crypto stories fell down; WhatsApp is very anti-bot, Wire's API was unusable on free accounts, Signal's group chats work differently / would've needed O(n) phone numbers, Rocketchat's IRC integration was incompatible, Matrix couldn't be simplified to hide the federation for standalone, etc etc.

CiPHPerCoder 8y ago

> Signal --- Introduced: 2017 What https://signal.org/blog/the-new-textsecure/ https://signal.org/blog/the-new-textsecure/

lucideer 8y ago

As there's pretty obvious bias showing in the values, some methodology would be good to accompany this sheet. e.g. - Telegram: E2E Private: TRUE - WhatsApp: E2E Private: CLAIMED These are either both "true", or both "claimed". Pick one. In particular, what's the definition of the "Open Spec" column? Signal's GPL spec gets a FALSE here so I'm presuming the definition is something along the lines of "Spec produced by one ofa group of arbitrarily approved bodies of which Open Whisper is not a member"

cbg0 8y ago
The comments specify what "claimed" means: > Not possible to verify as application is closed source. Maintainer could compromise security at any time without detection. I think it's useful to have this differentiation, even though technically you could say E2E is TRUE for both of these.
- lucideer 8y ago
  Ah, thanks, I didn't see those comments. That makes some sense for the E2E actually. That's a very reasonable distinction. Technically one could still argue the same for Telegram unless you're self-building given their source-release delays but that might be nitpick too far.
  - dijit 8y ago
    However; compiled versions and binary distributed versions would not suppport E2E chats together if there were any significant difference.
    - lucideer 8y ago
      This isn't true. A trivial example of a significant difference in which they would still interoperate would be a binary distributed version which phones home the shared key.
      - 8y ago

p4bl0 8y ago

Nice. It's missing RetroShare (which is not only a messenger system but can be used as one) :).

arendtio 8y ago

Well, that is a protocol comparison. A client comparison would be much closer to the real world user experience. Don't get me wrong, I am a huge fan (and daily user) of XMPP, but the best protocol will not be of any use if the clients are too complicated or buggy to use. So yes, XMPP supports audio and video calls but finding two different clients which work on the first try together can be a challenge. Sometimes I wish there would be some compatibility XEP which defines a common set of supported XEPs including a test suite to run it against.

giancarlostoro 8y ago
Sounds like you may want to consider writing the spec for such a XEP?
ge0rg 8y ago
We have the XMPP Compliance Suites 2018[0] providing an overview of protocol-level specifications that a modern client or server should implement, and there was recently a nice article[1] for some example use cases. What is still missing is everything above the wire protocol level. The XSF, being the XMPP Standards Foundation, is guarding the protocols, and things like UX and client interoperability are considered as off-scope. However, there are people interested in these topics as well looking for fresh collaborators. [0] https://xmpp.org/extensions/xep-0387.html https://xmpp.org/extensions/xep-0387.html [1] https://www.erlang-solutions.com/blog/21-xmpp-use-cases-and-the-best-ways-to-achieve-them.html https://www.erlang-solutions.com/blog/21-xmpp-use-cases-and-...
- arendtio 8y ago
  That looks pretty cool. Maybe I should ask SamWhited why they didn't include OMEMO, Audio and Video Calls as features as he is writing in this thread too :D
pmlnr 8y ago
> real world user experience I'm getting so tired of this. Real world user experience is that the constantly changing interfaces are driving everyone mad. Stick to a thing and let people learn it.

lvh 8y ago

This is neat but it has plenty of flaws. I wish the definitions were spelled out. It says Signal isn't "anonymous", which I assume means "uses a phone number to find peers". And it has the usual feature matrix problem: sure XMPP "does E2E". But what does that mean? It supports S/MIME. Do you want S/MIME? (You don't.) It supports OTR, TS and SCIMP too: but you need to be an expert in messaging schemes to understand how those are different. None of them implement double ratchets. None of them implement even close to the privacy features Signal has implemented. But on this diagram it is clearly better because there is more green and less red. Another example: "open server" and "on-premise" says nothing about whether or not you really want to run one of those instances. It just says that hypothetically one could. In terms of errors: the linked "E2E audit" for Telegram did not audit E2E at all, and in fact only cites sources saying that it's probably fucked. Wire has a real audit that isn't listed. WhatsApp uses Signal, just with fewer of the. Use WhatsApp to talk to normal people. Use Signal for nerds, and... probably Matrix for group collab? Or maybe stop caring about secure messages for group collab so much :-)

arendtio 8y ago
Your points are valid but you didn't mention that OMEMO [1] implements Double Ratchet for XMPP. You can find a list of clients which support OMEMO on https://omemo.top https://omemo.top [1] https://en.wikipedia.org/wiki/OMEMO https://en.wikipedia.org/wiki/OMEMO
- lvh 8y ago
  That's a fair point, but the fact that there's yet another protocol, not mentioned on the XMPP E2E wiki, kinda plays into the point itself: XMPP has E2E maybe with a bunch of random protocols and the stars (and the people you talk with) need to align _just right_ for all of it to work. I think it would be fair to say that everyone uses WhatsApp and I know what they get, and at this point only XMPP people use XMPP (explicitly) and maybe they get some kind of E2E but who knows which one and what properties that has.
  - vader1 8y ago

mxuribe 8y ago

So, riot/matrix, nextcloud/talk, briar, and xmpp should merge together into a super-mega-awesome-protocol and transform into mega-message! ;-)

deleted 8y ago

[deleted]

pmontra 8y ago

A missing column among the Features is if a system allows automation (chatbots or other). Notable examples: Telegram and FB Messenger do, WhatsApp doesn't (there are workarounds but they're mostly against the Terms of Service.)

lrvick 8y ago
Great suggestion. Will add this.

bootlooped 8y ago

Kakao Talk has claimed to have E2E Encrypted chat at least since 2014; it is not on by default. https://www.pcworld.com/article/2856452/kakao-talk-adds-secret-chat-feature-amid-privacy-worries.html https://www.pcworld.com/article/2856452/kakao-talk-adds-secr... https://techcrunch.com/2014/12/07/chat-app-kakao-talk-begins-offering-opt-in-encryption-following-recent-privacy-storm/ https://techcrunch.com/2014/12/07/chat-app-kakao-talk-begins...

daurnimator 8y ago
Amended.

bkfh 8y ago

I came across Tungsten Messenger the other day and it's supporting even multiple personas (public, private) and runs traffic via Tor. Pretty neat UI and the team is throwing out new features regularly: http://tungstenapp.com/ http://tungstenapp.com/ (Edit: typo)

akareilly 8y ago

Here's another scorecard: https://www.securemessagingapps.com/ https://www.securemessagingapps.com/ The EFF doesn't do recommendations for all users - whether a messenger works for someone depends on their threat model. https://www.eff.org/deeplinks/2018/03/why-we-cant-give-you-recommendation https://www.eff.org/deeplinks/2018/03/why-we-cant-give-you-r...

deleted 8y ago

[deleted]

LinuxBender 8y ago

There is no mention of Mumble (client) or Murmur (server). [1] From a privacy perspective, I find it superior to everything else. End-to-end voice encryption with PFS. As much or little server logging as you wish. Super easy to set up and scales to large numbers of people. I have a few of them running on VM's with 1GB ram. Only downside for me: It is not as happy-clicky (frictionless) as discord, yet. Authentication can be tied into 3rd party apps (LDAP, phpBB, etc) but I have not tested this yet. [2] If you try it, use their latest snapshot for server and client. Incredible sound quality. Nice UI/UX experience. Decent support for game overlays. Very low CPU usage. [1] - https://wiki.mumble.info/wiki/Main_Page https://wiki.mumble.info/wiki/Main_Page [2] - https://wiki.mumble.info/wiki/3rd_Party_Applications#Authenticators https://wiki.mumble.info/wiki/3rd_Party_Applications#Authent...

lrvick 8y ago
Added!

OnlyRepliesToBS 8y ago

the wrong lessons were learned a decade ago

rdtsc 8y ago

It's funny and sad that XMPP hits almost all of the points, has been around since 1999 and yet every year someone reinvents the wheel and makes another messenger system. There are what, about 60+ by now. Granted XMPP is not a messenger it's a protocol and a bunch of standards but still it's hard not to laugh.

gaff33 8y ago
XMPP has a terrible user experience, which is why it's never caught on.
- saagarjha 8y ago
  XMPP is a protocol; it doesn't have a user experience. Sure, it may have been difficult to adapt for mobile, but that doesn't mean it inherently has a poor experience.
  - lvh 8y ago
    This is silly hair-splitting. If it's "hard to adapt" to mobile then it's the protocol implying poor UX. Fortunately, in XMPP country, we're always just a XEP away! </s>
    - SamWhited 8y ago
      It's actually pretty easy to adapt to mobile, it may have been hard in 1998 when it was released, but these days with stream management (session resumption and TLS like packet counting) and message archive management (history and catchup) it's pretty great on mobile. The round trips to log in have also been significantly reduced (you'll incur a few more if you use SCRAM based auth, but there's always a trade off for security), though there are still a few of them for the most basic login. If you ignore TLS (which can come first so you don't have to do STARTTLS anymore) and do PLAIN auth (over TLS so it's fine) I think you have 3 round trips to login. That can be improved in the future with pipelining which has some experimental specs out. See also: https://xmpp.org/extensions/xep-0286.html https://xmpp.org/extensions/xep-0286.html

amckinlay 8y ago

Is there any messenger that does end-to-end encryption with reliable, in-order delivery with decentralized group chat and conversation history syncing? Been looking for years but so far the double-ratchet is inadequate.

LinuxBender 8y ago
Mumble / Murmur are close to this, but without chat history syncing. End-To-End PFS encryption though. Very decentralized, but you can tie it into ldap and other authentication systems. I linked in another part of this thread.

c8g 8y ago

nextcloud talk looks good. btw, telegram web has mobile support.

eeetzatrap 8y ago
Just installed the Nextcloud Talk App. I'm toes deep, but it looks pretty neat so far.

clofresh 8y ago

Needs to be updated to show which of my friends use which system

crunchiebones 8y ago

I can't see Jitsi there

crunchiebones 8y ago
also, what about 'blockchain messaging' apps like Dust, Echo etc. ?
- lvh 8y ago
  Dust is woefully underspecified and uses an ancient design with no forward secrecy and no (specified) message or sender authentication of any kind. Blockchain, as usual, purports to solve a problem nobody had. Dust doesn't try to address the simplest, best-understood problems we have for reputation systems on chained blocks.

saagarjha 8y ago

iMessage is technically phoneless; you can sign up with your Apple ID on macOS.

jstanley 8y ago

What does "E2E Audit" mean? Or, why does Ricochet have a "false"? The Ricochet codebase has been audited, if that's what it's supposed to mean.

jhammons 8y ago
I think it means two parties can verify their public encryption keys with one another.
- jstanley 8y ago
  E.g. by comparing them in person? Ricochet can do that. The "Ricochet ID" is just a hash of the public key, so if you meet up in person and verify that you have added the correct ID for your counterparty, that sounds like you've verified the public keys, no?
lvh 8y ago
Since the author added a link to the Wire audit after I pointed out it existed, I think it means "third party has audited it and verified claims". On the other hand, they also still claim Telegram has been audited in this sense, which I have also pointed out and they have not resolved.

SamWhited 8y ago

XMPP is a protocol meant for building chat services; some of these others are chat services themselves so eg. it doesn't make sense to say that XMPP is not e2e by default (of course it's not, it's a protocol which may or may not be used to build an e2e encrypted chat service). Maybe that should be changed to "Jabber" which is what a lot of people call the public, federated network of servers built on XMPP these days? (The term has all sorts of other historical baggage and some people use XMPP/Jabber as synonyms, but mostly I think people use Jabber to refer to the public network these days and XMPP to the protocol, rather like email and SMTP).

gyvastis 8y ago

Would be nice to show some numbers as well, how much are these platforms used.

unsignedint 8y ago

LINE E2E are "Partial Claimed" their E2E encryption only encrypts text and GPS location and other are not encrypted.[0] [0]: https://engineering.linecorp.com/en/blog/detail/65 https://engineering.linecorp.com/en/blog/detail/65

mo3gut 8y ago

It's amusing that this is hosted by a spyware vendor.

ac4tw 8y ago

Interesting comparison Irvick. Enjoying the resuling conversation too. More detail on meanings and methodology would be helpful as some other HN folks suggest. Stealthy.im isn't mentioned (I develop that presently). Stealthy makes use of decentralized identity in the blockchain and a decentralized storage system called GAIA. Regular chat is E2E encrypted using ECIES. Currently released for Android and iOS.

deleted 8y ago
[deleted]

oropolo 8y ago

With categories emphasizing security, open standards, and audited code, I'm surprised SpiderOak's Semaphor isn't on this list: https://spideroak.com/semaphor/ https://spideroak.com/semaphor/

paxy 8y ago

What's the difference behind TLS "true" or "claimed"? It's pretty straightforward to verify all outgoing requests the client is making without looking at source code.

egypturnash 8y ago

So many competing, incompatible protocols. So, so many. Also this is lacking a column for "stickers". Seriously they are one of the things that has my and my crowd using Telegram, especially since it's really easy to make your own custom sets instead of relying on whatever they pay someone to draw for you.

codedokode 8y ago

I think Tox should be higher than Jabber. With Tox, there are no servers and contact list is stored on your device. With Jabber, it is stored on the server (and will be happily provided to NSA when needed). So unless you deploy your own Jabber server, it provides less privacy. Regarding Wire, is not contact list stored on Wire's server? Then it is even less private than Jabber.

tanderson92 8y ago

The spreadsheet seems to be missing e-mail.

jplayer01 8y ago

A flawed document like this does far more harm than it does good. I'd implore the author to take it down before they mislead people into drawing the wrong conclusions.

touristtam 8y ago

No hipchat from atlassian ?