6 ms·

Honestly, I can't keep up with acquisitions, full e2e encryption claims, then those claims get debunked, and you can't find out what the truth is. Based on all

Honestly, I can't keep up with acquisitions, full e2e encryption claims, then those claims get debunked, and you can't find out what the truth is. Based on all information out there, in year 2020, what is the most secure IM app? What do you recommend to your friends if they care about privacy?

teekert 6y ago
I recommend Signal. Sure, something selfhosted would be nicer (provided I can be trusted to get encrytion rightly implemented and my server updated etc) but Signal hits the best balance for me between trust, hassle and features.
- quantummkv 6y ago
  Matrix is selfhosted and has e2e encryption support.
  - egberts1 6y ago
    I’ve pulled down both the backend for Matrix and Signal and find that the LOC is a lot simpler with Signal. Plus with a bit of work, selfhosting Signal would require the mobile apps to be configurable (or fixedly reconfigured) toward your own backend server.
- alias_neo 6y ago
  You can self-host Signal if you want. It's not easy, or fun, and you'll need to replace the dependencies on cloud tools if you want to host it on bare metal, but it can be done (I have done it). Bear in mind, the server is open source only in name, the state of documentation and configurability is extremely hostile towards running it yourself, to the point that the only way to configure it to run correctly requires reading the code to find the type, size, syntax and everything else about every piece of configuration because none of it is documented or clear.
  - wizzwizz4 6y ago
    Can you document it?
    - alias_neo 6y ago
      Sadly the answer is not the one I'd like to give. Were it in my hands, I'd have documented it publicly already, as an advocate of open source and sharing. I did this as part of my day job, which included, at the time, documenting it. It's impossible for me to share that documentation I did on company time. As for doing it again, I'd have to check my contract and/or discuss it with said employer.
searchableguy 6y ago
Try session - https://getsession.org/ https://getsession.org/ Can someone explain the downvote? I am not complaining but are there security problems with it? Could you explain or highlight them?
- emptysongglass 6y ago
  Don't ask why you were downvoted. It's right there in the Hacker News Guidelines. [1] Secondly, you were probably downvoted because you didn't add any content to the discussion other than a link. Session goes a long way to fixing Signal's problems like its reliance on a centralized server and phone numbers but it's still very early days with an unproven product. Messages still get lost all the time and if you thought it was hard to find your friends on Signal, it's the Sahara Desert on Session. You'd be putting in months and months of fervent pontification to friends and family you've probably just managed to migrate to your other privacy chat platform of choice. [1] https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
kreetx 6y ago
Wire should also be e2ee, but not sure if you can self-host the server (they seem to have started opens-sourcing it years ago, but not sure if that is ready).
paddlesteamer 6y ago
Other than Signal, I also recommend Threema. It doesn't rely on mobile numbers, possible to configure to run on your private server, etc. It's just not free (as in beer). Also, it's from Switzerland, a country respects your privacy more than the USA[0]. [0]: https://www.reddit.com/r/privacy/comments/gukg5z/threema_wins_in_court_against_swiss_authorities/ https://www.reddit.com/r/privacy/comments/gukg5z/threema_win...
- dingaling 6y ago
  > Also, it's from Switzerland, a country respects your privacy more than the USA Well gouv.ch might, but Crypto AG was an NSA front for decades so I wouldn't be so certain about the companies. If I wanted to lure people in on the pretence of security and privacy, Being Swiss would be good bait.
  - caf 6y ago
    CIA front, I believe.
- ohlookabird 6y ago
  It doesn't look like they are open source, does it? https://threema.ch/en/faq/source_code https://threema.ch/en/faq/source_code
axegon_ 6y ago
Generally signal is a solid option. In addition I have a private mattermost server, which is heavily restricted in terms of firewall and users but this is reserved only for a very small selected group of people that I trust and I am 1000% sure that they know what they are doing.
fsflover 6y ago
Matrix: https://matrix.org/ https://matrix.org/ Unlike Signal, it does not rely on a single server.
- unicornporn 6y ago
  And they're working on P2P. http://matrix.org/blog/2020/06/02/introducing-p-2-p-matrix/ http://matrix.org/blog/2020/06/02/introducing-p-2-p-matrix/
upofadown 6y ago
If you want to be completely sure you can't beat boring old PGP. It runs on top of XMPP and is too simple to hide anything in. The new XMPP hotness is OMEMO. Conversations is a good mobile client that supports both PGP and OMEMO.
- xorcist 6y ago
  You probably meant to say OTR, not PGP? OMEMO is five years old, and supported by all major clients, so it's not very "hot" anymore". OTRv4 is somewhat hot and new. It's not in wide use (yet) and it's unclear if it is enough of an improvement to take over.
  - upofadown 6y ago
    >You probably meant to say OTR, not PGP? No. OTR depends entirely on fingerprints for identity. The poster was referring to the difficulty of knowing for sure that you are really end to end. PGP has the advantage here in that you can be completely sure because you can exchange the keys yourself.
medecau 6y ago
Use Tor, use Signal. https://twitter.com/search?q=from%3A%40thegrugq+signal https://twitter.com/search?q=from%3A%40thegrugq+signal
hiq 6y ago
If you dig deeper, you can easily find that the consensus among IT security experts is Signal for privacy / security. Matrix is interesting and I hope it will catch up eventually, but currently it is not E2EE by default and it leaks way more metadata than Signal. These point make it strictly worse than Signal for 1:1 IM. The advantage of Matrix is in federation, but regarding privacy / security, it is still behind (much to my regret). Other apps that could provide similar guarantees in theory are less used and have received less scrutiny, so more not yet exposed bugs and design flaws should be expected. Other apps have been relatively well studied, but have well-known design flaws that also make them worse than Signal (WhatsApp and Wire leak way more metadata).
- Forbo 6y ago
  Matrix is E2EE by default now and has been for the last month: https://matrix.org/blog/2020/05/06/cross-signing-and-end-to-end-encryption-by-default-is-here https://matrix.org/blog/2020/05/06/cross-signing-and-end-to-...
  - goatsi 6y ago
    Matrix is E2EE for some clients and implementations. You have to research what you use carefully, even in the HN discussion about that post people were recommending clients that didn't support encryption.
PascLeRasc 6y ago
Beyond this, is there a somewhat complete, recent guide for low-medium technically literate people to secure themselves, in terms of both privacy and security? I'm going through the easy steps now, like deleting Facebook, using 1Password, Firefox, ProtonMail, FileVault. Tor is too complicated for me to figure out though. Is anyone aware of other "good enough" practices?
danShumway 6y ago
There's pretty wide consensus that Signal is the most secure for now (minus the phone-number requirement, but whatever, not going there). Signal will likely continue to be the most secure platform for the short-to-medium future, and potentially longer. I disagree with Moxie on many things, but he really understands how to write secure code, and I trust him on security in a way that I don't trust many other people. Matrix is significantly less proven, leaks a bit more metadata (at the moment) and has had a few incidents that make people cautious about trusting it for real activism -- but it's a more future-proof investment if you're not currently an activist, and some of the stuff they're working on (most recently around P2P and mesh networks) may be really valuable in the future. Matrix is taking an explicit stance that concepts like federation and custom clients are not antithetical to privacy. It's yet to be seen whether they're right about that, but a lot of us want them to be right. We'd prefer to live in the world that they describe. Apps like WhatsApp and Telegram also exist, and I guess some people like them, but I don't see any reason to bring them to the table since Signal already exists and is already the gold standard for privacy. The only reason Matrix is on the table is because Matrix is fundamentally different from Signal in ways that are worth caring about. So in short: - If you really need to make sure nobody reads your messages, use Signal. Hands down, not even a contest. - If you're invested in the future of apps like this, and you have auxiliary concerns around federation, openness, and bridges that might outweigh your worries about potential vulnerabilities, then consider using Matrix. Nearly all of these apps are better than doing something like encrypting an email. Email encryption is a minefield of insecure clients and foot-guns.

teekert 6y ago

I recommend Signal. Sure, something selfhosted would be nicer (provided I can be trusted to get encrytion rightly implemented and my server updated etc) but Signal hits the best balance for me between trust, hassle and features.

quantummkv 6y ago
Matrix is selfhosted and has e2e encryption support.
- egberts1 6y ago
  I’ve pulled down both the backend for Matrix and Signal and find that the LOC is a lot simpler with Signal. Plus with a bit of work, selfhosting Signal would require the mobile apps to be configurable (or fixedly reconfigured) toward your own backend server.
alias_neo 6y ago
You can self-host Signal if you want. It's not easy, or fun, and you'll need to replace the dependencies on cloud tools if you want to host it on bare metal, but it can be done (I have done it). Bear in mind, the server is open source only in name, the state of documentation and configurability is extremely hostile towards running it yourself, to the point that the only way to configure it to run correctly requires reading the code to find the type, size, syntax and everything else about every piece of configuration because none of it is documented or clear.
- wizzwizz4 6y ago
  Can you document it?
  - alias_neo 6y ago
    Sadly the answer is not the one I'd like to give. Were it in my hands, I'd have documented it publicly already, as an advocate of open source and sharing. I did this as part of my day job, which included, at the time, documenting it. It's impossible for me to share that documentation I did on company time. As for doing it again, I'd have to check my contract and/or discuss it with said employer.

searchableguy 6y ago

Try session - https://getsession.org/ https://getsession.org/ Can someone explain the downvote? I am not complaining but are there security problems with it? Could you explain or highlight them?

emptysongglass 6y ago
Don't ask why you were downvoted. It's right there in the Hacker News Guidelines. [1] Secondly, you were probably downvoted because you didn't add any content to the discussion other than a link. Session goes a long way to fixing Signal's problems like its reliance on a centralized server and phone numbers but it's still very early days with an unproven product. Messages still get lost all the time and if you thought it was hard to find your friends on Signal, it's the Sahara Desert on Session. You'd be putting in months and months of fervent pontification to friends and family you've probably just managed to migrate to your other privacy chat platform of choice. [1] https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

kreetx 6y ago

Wire should also be e2ee, but not sure if you can self-host the server (they seem to have started opens-sourcing it years ago, but not sure if that is ready).

paddlesteamer 6y ago

Other than Signal, I also recommend Threema. It doesn't rely on mobile numbers, possible to configure to run on your private server, etc. It's just not free (as in beer). Also, it's from Switzerland, a country respects your privacy more than the USA[0]. [0]: https://www.reddit.com/r/privacy/comments/gukg5z/threema_wins_in_court_against_swiss_authorities/ https://www.reddit.com/r/privacy/comments/gukg5z/threema_win...

dingaling 6y ago
> Also, it's from Switzerland, a country respects your privacy more than the USA Well gouv.ch might, but Crypto AG was an NSA front for decades so I wouldn't be so certain about the companies. If I wanted to lure people in on the pretence of security and privacy, Being Swiss would be good bait.
- caf 6y ago
  CIA front, I believe.
ohlookabird 6y ago
It doesn't look like they are open source, does it? https://threema.ch/en/faq/source_code https://threema.ch/en/faq/source_code

axegon_ 6y ago

Generally signal is a solid option. In addition I have a private mattermost server, which is heavily restricted in terms of firewall and users but this is reserved only for a very small selected group of people that I trust and I am 1000% sure that they know what they are doing.

fsflover 6y ago

Matrix: https://matrix.org/ https://matrix.org/ Unlike Signal, it does not rely on a single server.

unicornporn 6y ago
And they're working on P2P. http://matrix.org/blog/2020/06/02/introducing-p-2-p-matrix/ http://matrix.org/blog/2020/06/02/introducing-p-2-p-matrix/

upofadown 6y ago

If you want to be completely sure you can't beat boring old PGP. It runs on top of XMPP and is too simple to hide anything in. The new XMPP hotness is OMEMO. Conversations is a good mobile client that supports both PGP and OMEMO.

xorcist 6y ago
You probably meant to say OTR, not PGP? OMEMO is five years old, and supported by all major clients, so it's not very "hot" anymore". OTRv4 is somewhat hot and new. It's not in wide use (yet) and it's unclear if it is enough of an improvement to take over.
- upofadown 6y ago
  >You probably meant to say OTR, not PGP? No. OTR depends entirely on fingerprints for identity. The poster was referring to the difficulty of knowing for sure that you are really end to end. PGP has the advantage here in that you can be completely sure because you can exchange the keys yourself.

medecau 6y ago

Use Tor, use Signal. https://twitter.com/search?q=from%3A%40thegrugq+signal https://twitter.com/search?q=from%3A%40thegrugq+signal

hiq 6y ago

If you dig deeper, you can easily find that the consensus among IT security experts is Signal for privacy / security. Matrix is interesting and I hope it will catch up eventually, but currently it is not E2EE by default and it leaks way more metadata than Signal. These point make it strictly worse than Signal for 1:1 IM. The advantage of Matrix is in federation, but regarding privacy / security, it is still behind (much to my regret). Other apps that could provide similar guarantees in theory are less used and have received less scrutiny, so more not yet exposed bugs and design flaws should be expected. Other apps have been relatively well studied, but have well-known design flaws that also make them worse than Signal (WhatsApp and Wire leak way more metadata).

Forbo 6y ago
Matrix is E2EE by default now and has been for the last month: https://matrix.org/blog/2020/05/06/cross-signing-and-end-to-end-encryption-by-default-is-here https://matrix.org/blog/2020/05/06/cross-signing-and-end-to-...
- goatsi 6y ago
  Matrix is E2EE for some clients and implementations. You have to research what you use carefully, even in the HN discussion about that post people were recommending clients that didn't support encryption.

PascLeRasc 6y ago

Beyond this, is there a somewhat complete, recent guide for low-medium technically literate people to secure themselves, in terms of both privacy and security? I'm going through the easy steps now, like deleting Facebook, using 1Password, Firefox, ProtonMail, FileVault. Tor is too complicated for me to figure out though. Is anyone aware of other "good enough" practices?

danShumway 6y ago

There's pretty wide consensus that Signal is the most secure for now (minus the phone-number requirement, but whatever, not going there). Signal will likely continue to be the most secure platform for the short-to-medium future, and potentially longer. I disagree with Moxie on many things, but he really understands how to write secure code, and I trust him on security in a way that I don't trust many other people. Matrix is significantly less proven, leaks a bit more metadata (at the moment) and has had a few incidents that make people cautious about trusting it for real activism -- but it's a more future-proof investment if you're not currently an activist, and some of the stuff they're working on (most recently around P2P and mesh networks) may be really valuable in the future. Matrix is taking an explicit stance that concepts like federation and custom clients are not antithetical to privacy. It's yet to be seen whether they're right about that, but a lot of us want them to be right. We'd prefer to live in the world that they describe. Apps like WhatsApp and Telegram also exist, and I guess some people like them, but I don't see any reason to bring them to the table since Signal already exists and is already the gold standard for privacy. The only reason Matrix is on the table is because Matrix is fundamentally different from Signal in ways that are worth caring about. So in short: - If you really need to make sure nobody reads your messages, use Signal. Hands down, not even a contest. - If you're invested in the future of apps like this, and you have auxiliary concerns around federation, openness, and bridges that might outweigh your worries about potential vulnerabilities, then consider using Matrix. Nearly all of these apps are better than doing something like encrypting an email. Email encryption is a minefield of insecure clients and foot-guns.