8 ms·

I've been looking for secure messengers during the last few weeks. I use WhatsApp, Signal, and Telegram. Telegram isn't very secure, WhatsApp is owned by Facebo

I've been looking for secure messengers during the last few weeks. I use WhatsApp, Signal, and Telegram. Telegram isn't very secure, WhatsApp is owned by Facebook and even Signal - while very secure - requires a cell phone number... Briar seems great in this regard but isn't available on iPhone and has no support for images, calls, voice messages, etc. Apparently they're going to support images and a desktop client, though. In short, I just don't know what to use. Edit: Session looks great but is not fully released yet: https://getsession.org/ https://getsession.org/ This might be what I'm looking for in the future.

dijit 6y ago
Have you looked at 'threema'? I recently installed it and I'm actually pleasantly surprised. However, all of these bloody messengers mean that my contacts list is spread across a multitude of programs: we need the iOS/Android equivalent of pidgin.
- ssss11 6y ago
  Pidgin is exactly what we need.. and each messenger needs to be a pluggable module. Then we dont need to hound friends and family to switch messenger apps they just use pidgin.
  - raspyberr 6y ago
    But why would something like Facebook open up their walled garden? Does it even count as a walled garden when you have 2 billion people on the platform?
    - flattone 6y ago
      the walls i think refer to transparency ? so is regardless of user count
    - tejtm 6y ago
      Obviously yes. Does any wall count if there are more entities on one side of it than the other?
- dunefox 6y ago
  Threema is closed source which is something I don't really like when it comes to security as there are no independent audits. Edit: Generally, Threema seems interesting feature-wise, but I think the price (4€) will prevent my contacts from using it...
  - dijit 6y ago
    Interesting thought experiment though; if you’re not paying for the development and hosting- who is?
- shuringai 6y ago
  threema claims no having no identificable information yet the account IDs are just the unsalted hashes of your telephone number.
IgorPartola 6y ago
What did Riot, the Matrix client, get renamed to?
- kgraves 6y ago
  "Element". had to look it up, forgotten it already. :/
  - IgorPartola 6y ago
    It is a really forgettable name, to be fair.
overcast 6y ago
iMessage? Natively on your phone/macOS and peer to peer encrypted. Never really saw a need for yet another messaging service. I think I'd trust Apple to do the right thing over any of these.
- marcinzm 6y ago
  Great unless you or someone you want to communicate with doesn't use an apple device. Which covers the majority of the population. I've also had terrible reliability issue with imessage in the past, messages not delivering, not showing up, errors sending, showing up on one device but not another, etc. Was a mess that caused a lot of confusion.
  - overcast 6y ago
    Guess it depends on your circles. For my group, everyone has an iPhone or a Mac. For the outliers, everyone has cell phones, and iMessage supports SMS.
    - marcinzm 6y ago
      >iMessage supports SMS. Which isn't end to end encrypted which defeats the whole point in terms of this conversation.
      - overcast 6y ago
        Thank you for identifying that.
sdenton4 6y ago
FWIW, I think you can just get a Google Voice or other short-term burner number to sign up for Signal, and then never worry about it again. Signal's an order of magnitude more trustworthy than the other messaging players and have built out a good base of features at this point. (telegram specifically is a joke... proprietary closed-source encryption is a recipe for disaster.) I would strongly advise against picking a tiny new-comer without some serious research beforehand... They're not battle-hardened, so will typically be less reliable than any of the existing larger players.
- secretasiandan 6y ago
  I don't think never worry about it again is quit correct What if someone registers with my old number? If someone were to register with your old number on a new phone, then they will have an empty message history. Your contacts will also be made aware of a safety number change if they start messaging with the old number. https://support.signal.org/hc/en-us/articles/360007062012-New-Number-or-New-Phone https://support.signal.org/hc/en-us/articles/360007062012-Ne...
- wojciii 6y ago
  I had no luck getting people to use signal. Family thinks that I'm a freak because I try to make them understand that in socialist Denmark your communication is not secure from the government. The app is easy to use, but people are not using it. They use sms and FB etc. to message friends.
shuringai 6y ago
care to elaborate on how telegram is unsecure? Their fat bug bounty program yielded no security issues for years and I'm unaware of any issues with MTProto
- cl3misch 6y ago
  Their server backend code is closed source and they're running custom crypto. Also groups and desktop clients don't support end-to-end encryption.
PostOnce 6y ago
Signal is working on getting rid of the cell # requirement, but it'll take a while.
- myself248 6y ago
  It can't happen soon enough. I installed Signal a few years ago, and the first thing it did was notify a bunch of people I had in my contacts, that I was now using Signal... ...Including the unstable frenemy-guy who was only in my contacts so I'd recognize the number if he called and I'd know not to answer... ....who immediately PM'd me on Signal to push his latest delusion and make sure I didn't disagree. Great, just great. For a privacy-focused product, that's a pretty colossal fuckup.
  - Watsons221 6y ago
    I understand your frustration, but Signal didn't notify your contacts because you installed it. It notified the other person, because he had your phone number. Your local Signal installation regularly checks if any of your contacts (with the phone numbers you have of them) are registered at the Signal servers - and then lets you know it, such that you can text this contact securely.
    - em-bee 6y ago
      doesn't make a difference. it shouldn't do that without user confirmation
    - theamk 6y ago
      The technical details do not really matter. Many people might have my phone number, possibly from a long ago. But the number itself is pretty safe -- there is no way to tell if this phone is in use or not. Signal breaks that assumption -- it immediately tells every other user that this number is alive, valid, and can be contacted right now. This is a terrible idea to do by default, especially if one cannot disable it.
      - 6y ago
shuringai 6y ago
also, very soon signal won't require a phone numbet as the PIN feature (what is present now for storage encryption) will be extended to serve as account ID
swsieber 6y ago
Self hosted matrix? It has e2e encryption.
- Multicomp 6y ago
  Even better, I'm pinning my hopes on peer-to-peer matrix via dendrite.
- eeZah7Ux 6y ago
  It still leaks all the connections metadata. It's very easy to correlate TCP connections to and from the server.
client4 6y ago
I'm a big fan of Keybase https://keybase.io/ https://keybase.io/. The team was acquired by Zoom, but there's a new website and development is still going on.
clipjokingly 6y ago
I'm surprised nobody mentioned Jami https://jami.net/ https://jami.net/
rapnie 6y ago
The project is no longer maintained but Oversec had a cool concept of hiding your own encrypted text as non-printing chars in Android text fields in any other app, like e.g. WhatsApp. https://github.com/oversecio/oversec https://github.com/oversecio/oversec
lebaux 6y ago
> Telegram isn't very secure Can someone elaborate?
- felixfoertsch 6y ago
  There are different aspects to this. The first and the easily verifiable one is that they default to client-server-client connections, not end-to-end encryption. If you want to have an end-to-end encrypted channel, you have to explicitly open a "secret chat". However, this removes the convenience of cross device syncing. The second one is more difficult to evaluate. If you use the above mentioned "secret chat" feature, Telegram employs their own closed-source encryption scheme. That's usually an indicator to be cautious from the get-go. Since it's closed source, it can't really be trusted. See [Wikipedia](https://en.wikipedia.org/wiki/Telegram_(software)#Security https://en.wikipedia.org/wiki/Telegram_(software)#Security) for a timeline in regards to the security.
  - laegooose 6y ago
    Telegram clients are open source. I downloaded and built MacOS version recently - it was very straightforward. https://telegram.org/apps#source-code https://telegram.org/apps#source-code Encryption for secret chats doesn't involve server, so technically it can be analyzed. It's a pity Telegram decided to roll their own encryption scheme. I use Telegram a lot for daily business because it's superior desktop messenger product. I would gladly participate if somebody started a crowd-funding for Telegram's security and encryption audit.
    - fsflover 6y ago
      > Encryption for secret chats doesn't involve server, so technically it can be analyzed. Except if you are on desktop, you have no secret chats at all. And "desktop" includes GNU/Linux phones.
- codethief 6y ago
  To add to my sibling's comment: Contact lists also get synced with the servers (in contrast to e.g. how Signal handles this).
vats 6y ago
Have you tried Jabber with Conversations or Pix-Art android app? It has end to end encryption (OMEMO), support for sharing media, voice and video calling, multitude of desktop clients, (a less secure) web client etc. Most importantly, you can host the server yourself without cutting off from the network.
kausban 6y ago
"Wire" is the only one, AFAIK, that ticks all those boxes.

dijit 6y ago

Have you looked at 'threema'? I recently installed it and I'm actually pleasantly surprised. However, all of these bloody messengers mean that my contacts list is spread across a multitude of programs: we need the iOS/Android equivalent of pidgin.

ssss11 6y ago
Pidgin is exactly what we need.. and each messenger needs to be a pluggable module. Then we dont need to hound friends and family to switch messenger apps they just use pidgin.
- raspyberr 6y ago
  But why would something like Facebook open up their walled garden? Does it even count as a walled garden when you have 2 billion people on the platform?
  - flattone 6y ago
    the walls i think refer to transparency ? so is regardless of user count
  - tejtm 6y ago
    Obviously yes. Does any wall count if there are more entities on one side of it than the other?
dunefox 6y ago
Threema is closed source which is something I don't really like when it comes to security as there are no independent audits. Edit: Generally, Threema seems interesting feature-wise, but I think the price (4€) will prevent my contacts from using it...
- dijit 6y ago
  Interesting thought experiment though; if you’re not paying for the development and hosting- who is?
shuringai 6y ago
threema claims no having no identificable information yet the account IDs are just the unsalted hashes of your telephone number.

IgorPartola 6y ago

What did Riot, the Matrix client, get renamed to?

kgraves 6y ago
"Element". had to look it up, forgotten it already. :/
- IgorPartola 6y ago
  It is a really forgettable name, to be fair.

overcast 6y ago

iMessage? Natively on your phone/macOS and peer to peer encrypted. Never really saw a need for yet another messaging service. I think I'd trust Apple to do the right thing over any of these.

marcinzm 6y ago
Great unless you or someone you want to communicate with doesn't use an apple device. Which covers the majority of the population. I've also had terrible reliability issue with imessage in the past, messages not delivering, not showing up, errors sending, showing up on one device but not another, etc. Was a mess that caused a lot of confusion.
- overcast 6y ago
  Guess it depends on your circles. For my group, everyone has an iPhone or a Mac. For the outliers, everyone has cell phones, and iMessage supports SMS.
  - marcinzm 6y ago
    >iMessage supports SMS. Which isn't end to end encrypted which defeats the whole point in terms of this conversation.
    - overcast 6y ago
      Thank you for identifying that.

sdenton4 6y ago

FWIW, I think you can just get a Google Voice or other short-term burner number to sign up for Signal, and then never worry about it again. Signal's an order of magnitude more trustworthy than the other messaging players and have built out a good base of features at this point. (telegram specifically is a joke... proprietary closed-source encryption is a recipe for disaster.) I would strongly advise against picking a tiny new-comer without some serious research beforehand... They're not battle-hardened, so will typically be less reliable than any of the existing larger players.

secretasiandan 6y ago
I don't think never worry about it again is quit correct What if someone registers with my old number? If someone were to register with your old number on a new phone, then they will have an empty message history. Your contacts will also be made aware of a safety number change if they start messaging with the old number. https://support.signal.org/hc/en-us/articles/360007062012-New-Number-or-New-Phone https://support.signal.org/hc/en-us/articles/360007062012-Ne...
wojciii 6y ago
I had no luck getting people to use signal. Family thinks that I'm a freak because I try to make them understand that in socialist Denmark your communication is not secure from the government. The app is easy to use, but people are not using it. They use sms and FB etc. to message friends.

shuringai 6y ago

care to elaborate on how telegram is unsecure? Their fat bug bounty program yielded no security issues for years and I'm unaware of any issues with MTProto

cl3misch 6y ago
Their server backend code is closed source and they're running custom crypto. Also groups and desktop clients don't support end-to-end encryption.

PostOnce 6y ago

Signal is working on getting rid of the cell # requirement, but it'll take a while.

myself248 6y ago
It can't happen soon enough. I installed Signal a few years ago, and the first thing it did was notify a bunch of people I had in my contacts, that I was now using Signal... ...Including the unstable frenemy-guy who was only in my contacts so I'd recognize the number if he called and I'd know not to answer... ....who immediately PM'd me on Signal to push his latest delusion and make sure I didn't disagree. Great, just great. For a privacy-focused product, that's a pretty colossal fuckup.
- Watsons221 6y ago
  I understand your frustration, but Signal didn't notify your contacts because you installed it. It notified the other person, because he had your phone number. Your local Signal installation regularly checks if any of your contacts (with the phone numbers you have of them) are registered at the Signal servers - and then lets you know it, such that you can text this contact securely.
  - em-bee 6y ago
    doesn't make a difference. it shouldn't do that without user confirmation
  - theamk 6y ago
    The technical details do not really matter. Many people might have my phone number, possibly from a long ago. But the number itself is pretty safe -- there is no way to tell if this phone is in use or not. Signal breaks that assumption -- it immediately tells every other user that this number is alive, valid, and can be contacted right now. This is a terrible idea to do by default, especially if one cannot disable it.
    - 6y ago

shuringai 6y ago

also, very soon signal won't require a phone numbet as the PIN feature (what is present now for storage encryption) will be extended to serve as account ID

swsieber 6y ago

Self hosted matrix? It has e2e encryption.

Multicomp 6y ago
Even better, I'm pinning my hopes on peer-to-peer matrix via dendrite.
eeZah7Ux 6y ago
It still leaks all the connections metadata. It's very easy to correlate TCP connections to and from the server.

client4 6y ago

I'm a big fan of Keybase https://keybase.io/ https://keybase.io/. The team was acquired by Zoom, but there's a new website and development is still going on.

clipjokingly 6y ago

I'm surprised nobody mentioned Jami https://jami.net/ https://jami.net/

rapnie 6y ago

The project is no longer maintained but Oversec had a cool concept of hiding your own encrypted text as non-printing chars in Android text fields in any other app, like e.g. WhatsApp. https://github.com/oversecio/oversec https://github.com/oversecio/oversec

lebaux 6y ago

> Telegram isn't very secure Can someone elaborate?

felixfoertsch 6y ago
There are different aspects to this. The first and the easily verifiable one is that they default to client-server-client connections, not end-to-end encryption. If you want to have an end-to-end encrypted channel, you have to explicitly open a "secret chat". However, this removes the convenience of cross device syncing. The second one is more difficult to evaluate. If you use the above mentioned "secret chat" feature, Telegram employs their own closed-source encryption scheme. That's usually an indicator to be cautious from the get-go. Since it's closed source, it can't really be trusted. See [Wikipedia](https://en.wikipedia.org/wiki/Telegram_(software)#Security https://en.wikipedia.org/wiki/Telegram_(software)#Security) for a timeline in regards to the security.
- laegooose 6y ago
  Telegram clients are open source. I downloaded and built MacOS version recently - it was very straightforward. https://telegram.org/apps#source-code https://telegram.org/apps#source-code Encryption for secret chats doesn't involve server, so technically it can be analyzed. It's a pity Telegram decided to roll their own encryption scheme. I use Telegram a lot for daily business because it's superior desktop messenger product. I would gladly participate if somebody started a crowd-funding for Telegram's security and encryption audit.
  - fsflover 6y ago
    > Encryption for secret chats doesn't involve server, so technically it can be analyzed. Except if you are on desktop, you have no secret chats at all. And "desktop" includes GNU/Linux phones.
codethief 6y ago
To add to my sibling's comment: Contact lists also get synced with the servers (in contrast to e.g. how Signal handles this).

vats 6y ago

Have you tried Jabber with Conversations or Pix-Art android app? It has end to end encryption (OMEMO), support for sharing media, voice and video calling, multitude of desktop clients, (a less secure) web client etc. Most importantly, you can host the server yourself without cutting off from the network.

kausban 6y ago

"Wire" is the only one, AFAIK, that ticks all those boxes.