4 ms·

At the end, the author recommends Signal (https://signal.org/ https://signal.org/) and Threema ((https://threema.ch/en https://threema.ch/en). I've never heard

At the end, the author recommends Signal (https://signal.org/ https://signal.org/) and Threema ((https://threema.ch/en https://threema.ch/en). I've never heard of Threema before, but having more viable options in this space is definitely a good thing.

johnisgood 8y ago
How about Wire as an alternative? I'm curious.
- svalorzen 8y ago
  I've started using Wire recently, and while it has some minor warts, call quality has always been excellent. In addition I really love being able to use it on my computer without having to check whether my phone has connectivity or not. I hate having to babysit my phone all the time and Wire is just wonderful for that, kind of brings me back to MSN days. This chart [1] compares several messaging apps' security standards; I'm not sure how accurate it is but maybe it can help you. [1]: https://www.securemessagingapps.com/ https://www.securemessagingapps.com/
  - iagovar 8y ago
    I thought the best jurisdiction for privacy was Iceland? The solutions provided by your link are all USA/Switzerland/Germany.
    - lucb1e 8y ago
      Meh, jurisdiction is one thing, but if the trust model does not include the server (a e2e encrypted chat app does not require a trusted server by definition), it doesn't really matter that much. Most they can do is social network analysis (as in, who talks to whom), against which the only solution is using an anonymisation network like Tor (no jurisdiction is going to disallow their intelligence services to see to whom an alleged terrorist is talking).
- lucb1e 8y ago
  We use Wire at work. It's sometimes a little buggy, but given the advantages (see my other comment in this thread: https://news.ycombinator.com/item?id=18838010 https://news.ycombinator.com/item?id=18838010), it's a definite recommendation. Full disclosure: my company is one of the independent auditors of Wire (though they did so before I joined them).
polskibus 8y ago
Signal requires phone number just like Telegram does. Does it mean it is susceptible to the same attack that Telegram is?
- gsich 8y ago
  Yes. But you don't get message history.
  - kiriakasis 8y ago
    I thought that you can get message history but it is not automatic.
- BoumTAC 8y ago
  Yes
- xashor 8y ago
  With Signal, if a the numbers registers a new account like in this attack scenario, 1. the attacker cannot access old/pending messages (as they are always encrypted), and 2. the person on the other side of the conversation gets a warning that the keys have changed, thus need new verification before continuing the conversation. So, Signal is more secure on that front.
  - Maakuth 8y ago
    Also, there's a PIN code you can use to protect from transferring your number to another device. This is periodically asked by the client app so that you'll remember it.
  - mesaframe 8y ago
    Telegram got two factor support which a user can enable anytime for security.
Semaphor 8y ago
I think Threema is more well known in Germany.
qznc 8y ago
I believe Threema is more focused on business messaging these days. My employer recently qualified it as our official mobile messenger. Providing an Open Source client seems no goal anymore. What all the other messengers should copy is their poll feature [0]. It can basically act as an integrated Doodle. [0] https://threema.ch/en/blog/posts/threema-poll-feature https://threema.ch/en/blog/posts/threema-poll-feature
- dbrgn 8y ago
  Threema puts more focus on business customers than in the past (as it's more sustainable than one-time payments, there are no external investors). But the business app is still fundamentally the same as the "private" app, just with management/configuration features added. Private users are not second class citizens. Regarding open source, the app isn't unfortunately. But the crypto (based on NaCl by djb) is documented[1], has been audited[2], has been reverse engineered twice[3][4] and there is an alternative client implementation[5]. [1] https://threema.ch/press-files/2_documentation/cryptography_whitepaper.pdf https://threema.ch/press-files/2_documentation/cryptography_... [2] https://threema.ch/press-files/2_documentation/external_audit_security_statement.pdf https://threema.ch/press-files/2_documentation/external_audi... [3] http://blog.jan-ahrens.eu/files/threema-protocol-analysis.pdf http://blog.jan-ahrens.eu/files/threema-protocol-analysis.pd... [4] https://media.ccc.de/v/33c3-8062-a_look_into_the_mobile_messaging_black_box https://media.ccc.de/v/33c3-8062-a_look_into_the_mobile_mess... [5] https://openmittsu.de/ https://openmittsu.de/ (Disclaimer: Threema dev)

johnisgood 8y ago

How about Wire as an alternative? I'm curious.

svalorzen 8y ago
I've started using Wire recently, and while it has some minor warts, call quality has always been excellent. In addition I really love being able to use it on my computer without having to check whether my phone has connectivity or not. I hate having to babysit my phone all the time and Wire is just wonderful for that, kind of brings me back to MSN days. This chart [1] compares several messaging apps' security standards; I'm not sure how accurate it is but maybe it can help you. [1]: https://www.securemessagingapps.com/ https://www.securemessagingapps.com/
- iagovar 8y ago
  I thought the best jurisdiction for privacy was Iceland? The solutions provided by your link are all USA/Switzerland/Germany.
  - lucb1e 8y ago
    Meh, jurisdiction is one thing, but if the trust model does not include the server (a e2e encrypted chat app does not require a trusted server by definition), it doesn't really matter that much. Most they can do is social network analysis (as in, who talks to whom), against which the only solution is using an anonymisation network like Tor (no jurisdiction is going to disallow their intelligence services to see to whom an alleged terrorist is talking).
lucb1e 8y ago
We use Wire at work. It's sometimes a little buggy, but given the advantages (see my other comment in this thread: https://news.ycombinator.com/item?id=18838010 https://news.ycombinator.com/item?id=18838010), it's a definite recommendation. Full disclosure: my company is one of the independent auditors of Wire (though they did so before I joined them).

polskibus 8y ago

Signal requires phone number just like Telegram does. Does it mean it is susceptible to the same attack that Telegram is?

gsich 8y ago
Yes. But you don't get message history.
- kiriakasis 8y ago
  I thought that you can get message history but it is not automatic.
BoumTAC 8y ago
Yes
xashor 8y ago
With Signal, if a the numbers registers a new account like in this attack scenario, 1. the attacker cannot access old/pending messages (as they are always encrypted), and 2. the person on the other side of the conversation gets a warning that the keys have changed, thus need new verification before continuing the conversation. So, Signal is more secure on that front.
- Maakuth 8y ago
  Also, there's a PIN code you can use to protect from transferring your number to another device. This is periodically asked by the client app so that you'll remember it.
- mesaframe 8y ago
  Telegram got two factor support which a user can enable anytime for security.

Semaphor 8y ago

I think Threema is more well known in Germany.

qznc 8y ago

I believe Threema is more focused on business messaging these days. My employer recently qualified it as our official mobile messenger. Providing an Open Source client seems no goal anymore. What all the other messengers should copy is their poll feature [0]. It can basically act as an integrated Doodle. [0] https://threema.ch/en/blog/posts/threema-poll-feature https://threema.ch/en/blog/posts/threema-poll-feature

dbrgn 8y ago
Threema puts more focus on business customers than in the past (as it's more sustainable than one-time payments, there are no external investors). But the business app is still fundamentally the same as the "private" app, just with management/configuration features added. Private users are not second class citizens. Regarding open source, the app isn't unfortunately. But the crypto (based on NaCl by djb) is documented[1], has been audited[2], has been reverse engineered twice[3][4] and there is an alternative client implementation[5]. [1] https://threema.ch/press-files/2_documentation/cryptography_whitepaper.pdf https://threema.ch/press-files/2_documentation/cryptography_... [2] https://threema.ch/press-files/2_documentation/external_audit_security_statement.pdf https://threema.ch/press-files/2_documentation/external_audi... [3] http://blog.jan-ahrens.eu/files/threema-protocol-analysis.pdf http://blog.jan-ahrens.eu/files/threema-protocol-analysis.pd... [4] https://media.ccc.de/v/33c3-8062-a_look_into_the_mobile_messaging_black_box https://media.ccc.de/v/33c3-8062-a_look_into_the_mobile_mess... [5] https://openmittsu.de/ https://openmittsu.de/ (Disclaimer: Threema dev)