7 ms·

Threema – Secure and Private Messenger

83 points by dgudkov 6y ago

anotherhue 6y ago
Benefits over signal: * Does not require a phone number * (related) more tractable on non-phone devices * Does not use GCM. * Interface is smoother (subjective) * Has 'work' mode allowing for enterprise use Drawbacks over signal: * Has a non-zero price, so uptake is embarrassingly low. Embarrassing for humanity that is. I've struggled to get well paid professionals to cough up the €4. There is some mental block beyond 'free', yet these same people decry WA's privacy changes. I think signal was right to use GCM,for the general audience, but I personally would like to avoid it where possible. I use both apps, which in itself is a boon. Feel free to reach out, my Threema ID is in my profile. Would love to create a HN group to test the group features at scale.
- pdimitar 6y ago
  I have no problem paying €4 or even €40. Problem is that I don't know when I can be locked out of an app due to Apple or Google policies. Not the fault of the creator(s), obviously. That, and as another commenter pointed out: network effects. I'll pay alright, no worries. But how I even test the thing if none of my people are there? And why no free trial? I'd evaluate the messenger in maximum 30 minutes.
  - klaushardt 6y ago
    The free trial is just asking the App Store for a refund. I did it twice so far when i bought an App wich sounded good but then didnt do what i wanted. I think you have 48 hours time for this. iOS: https://support.apple.com/de-de/HT204084 https://support.apple.com/de-de/HT204084 Android: https://support.google.com/googleplay/answer/7205930 https://support.google.com/googleplay/answer/7205930
- that_guy_iain 6y ago
  The uptake in Germany was rather good at one point for years I think it was in the top paid apps in the apple app store. I've not looked recently as I bought it just incase anyone I knew got it and wanted to use it. > I've struggled to get well paid professionals to cough up the €4. There is some mental block beyond 'free', yet these same people decry WA's privacy changes. Our culture is totally broken. I think it stems from our salaries being too low. People have less money than they should so need thinks to be free to get by which means investors need to pay for it which means the salaries need to be low so the investors make money.
  - nerdponx 6y ago
    Think about the game theory here. I am willing to pay €4. But only if all my friends also pay €4 and decide to start using the app. Otherwise it's worth €0 to me. So unless I can convince them to start (which I usually can't, because they don't trust that their friends will use it), the natural equilibrium is that nobody buys it. One solution might be a 30 day free trial? I don't know why free trials are so unpopular nowadays. I am much more inclined to buy something when I have had a chance to try it!
    - anotherhue 6y ago
      Then there's a scramble to get all your contacts to align in the same 30 days :( Maybe free for up to 5 contacts?
    - fileeditview 6y ago
      Didn't WhatsApp do it similar in the beginning? AFAIR they offered the app for free and said after one year you have to pay 1€/$. I paid this once or twice and then it was free again (probably because of FB). However it was very clever to give a whole year for free, lock everyone in and then start taking a small fee. I like that strategy. Now with FB it's just a plain data grab.
      - oarsinsync 6y ago
        Correct. And despite this, many of my friends refused to pay the $1/£1/1€ on the basis that facebook messenger was free, as was SMS in their cell plans. So I paid for them. Despite them all earning real money in real jobs. Then Facebook bought WhatsApp, and now none of them are willing to move to Signal, because they like WhatsApp.
        petre 6y ago
        I did something else: I don't have WA or messenger. If anyone wants to text me they should use Signal or SMS or e-mail.
    - 6y ago
- deleted 6y ago
  [deleted]
- okso 6y ago
  > I've struggled to get well paid professionals to cough up the €4. There is some mental block beyond 'free', yet these same people decry WA's privacy changes. For some people the issue is not about the money but about giving it to a vendor-locked platform and have access to the app depend on it. I happily did donations to open-source projects such as MyExpenses [1] and Netguard [2] to support the projects and unlock features. And can still use these now that I went for a mobile with Android but without Google Services/GCM. [1] https://www.myexpenses.mobi/ https://www.myexpenses.mobi/ [2] https://netguard.me/ https://netguard.me/
- stonesweep 6y ago
  > Drawbacks over signal: I'd like to add "network effect" to this, as I can draw a parallel to another failed attempt which made the same general mistake (placing a hurdle in front of newcomers). Google Plus. When Google Plus hit the streets, Google had this stupid "invite only" system and it just became this huge thing within 24 hours to "buy invites" and so forth, people at that exact moment were ready and willing to try the new thing and were excited... then were hit with "yeah sorry, you can't sign up right now" and walked away never to return. They heard about it on Facebook, tried to go give it a try, then hit the hurdle and stayed on Facebook. It's my personal belief this initial step is what Google got wrong, all warts about the service aside. The first 48 hours was make or break, and they lost the momentum and never recovered. Threema was the same to me - I heard about it years ago and read very positive reviews, however to even try it out I needed to spend money and convince a bunch of friends to spend money just to get the client and see what it was about. It may have been great! However if I couldn't have a friend to chat with, it was of $0 value to me to even buy the client. IMHO, this is the hole Threema now has to dig themselves out of - walled gardens with an initial adoption hurdle trigger a psychological "nah, maybe later" reaction out of many people.
  - h0nd 6y ago
    I just bought threema out of the blue and to see how many of my friends are using it (and make themselves be found). I'd say 10% of my contacts, mostly tech-savvy, are there already and no need to convince anyone.
- corobo 6y ago
  > There is some mental block beyond 'free' Yeah I'm not paying for an app nobody else I know is using haha Can apps do custom trial periods? I reckon they'd benefit from something like a 3 month trial period. Let people really get into using it before committing.
- opheliate 6y ago
  Just as someone who has essentially zero knowledge of app development, why is using GCM a negative? Apologies for the very basic question.
  - anotherhue 6y ago
    Addressed below https://news.ycombinator.com/item?id=25859743 https://news.ycombinator.com/item?id=25859743
- baxtr 6y ago
  I think threema is a great product and at the same time a core reason why they haven't grown bigger yet is because they don't experiment enough with pricing models. Successful apps I know offer some standard functionality for free, get users to use the app and then offer additional functionality that a certain amount of people will buy after they have fallen in love with the product. There is no chance competing with all the free messengers otherwise.
- tluyben2 6y ago
  Where is signal hosted? I know quite a few people who picked Threema because it's not hosted in the US (even if you can validate the encryption is sound by checking the app source).
  - dbrgn 6y ago
    As far as I know, Signal is hosted on a mix of Amazon, Google, Microsoft and Cloudflare. https://www.kuketz-blog.de/signal-jegliche-kommunikation-erfolgt-ueber-tech-giganten-wie-amazon-microsoft-google-und-cloudflare/ https://www.kuketz-blog.de/signal-jegliche-kommunikation-erf... Threema is hosted on bare-metal servers in Switzerland. https://threema.ch/en/faq/server_location https://threema.ch/en/faq/server_location
- qqqqqqqqqqqqqqw 6y ago
  > Does not use GCM. Why is this a benefit?
  - anotherhue 6y ago
    a) I feel Google is over-represented in our tech lives, so when it's possible to use an alternative I choose to. b) GCM undoubtedly collects metadata about my usage of it c) [falsified] AFAIK GCM requires a Google account, which means your usage of the system is at the pleasure of Google, and can be disabled for a myriad of Orwellian reasons.
    - chopin 6y ago
      I use Signal on Android and I definitely have no Google account. It seems to be an optional component of Signal. As well I never was asked sign up anywhere.
    - qqqqqqqqqqqqqqw 6y ago
      Thanks for explaining. Though, like xenocratus, I thought you meant Galois/Counter Mode and was similarly puzzled :)
    - lxgr 6y ago
      > AFAIK GCM requires a Google account It does not.
  - xenocratus 6y ago
    I had the same question until I realised it meant Google Cloud Messaging (or, this is how people seem to interpret it) - my initial thought was that it was about Galois Counter Mode (an authenticated encryption mode), and was curious why not using it was considered a benefit. Threema does seem to use XSalsa20 + Poly1305 for authenticated encryption (not AES in GCM), btw.
    - anotherhue 6y ago
      Haha, I'm sorry about that confusion, as a fellow crypto-fan I should have noticed.
- jsiepkes 6y ago
  > Has a non-zero price, so uptake is embarrassingly low. Embarrassing for humanity that is. I've struggled to get well paid professionals to cough up the €4. What's really weird is that people park their car somewhere and pay 8 Euro parking fee without thinking about it. But when an app (which sure lasts a lot longer then a couple of hours of parking space) costs any amount more then zero people it suddenly becomes a mental barrier for people...
  - doublerabbit 6y ago
    My take on it would be that people see cars for example as a physical item. And that item comes with real expenses. Fuel, parking tickets and whatnot. Your conditioned for this when you get your first car Mobile phones apart from the device itself are seen as free. Your conditioned to expect to get apps for free, I expect content to be free. So when you start asking for money; there is no association between the price wanted and a physical object. Only an application which was free.
  - short_sells_poo 6y ago
    I think this is because of the prevalence of free (as in free beer) software. The moment this became normalized, every time something actually does ask for money, you have to decide that the expenditure is indeed worth it. Yes, 4 bucks is a pittance in absolute terms for many people, but they still don't want to just throw it out the window, so they have to actually take the mental energy of justifying this purchase. And yes you could say that the same people won't bat an eye spending 4 bucks on beer, but beer is an immediate reward in itself. The brain is usually already wired to automatically reward it's own decision to buy beer and buying one beer lessens the very restraints that would stand in the way of buying beer to begin with. These factors are usually not present when buying an app, unless it's a game or similar or it becomes a "passion" purchase. I don't know how to fix this. I would like to blame Ad Tech and the blight of "free" apps that fund themselves out of mining people's data. I think it is fair to say that this was a contributing factor at least. At the same time, I think there is genuine value in a proposition where people can pick to get the product for "free" and sell their data, or pay for the product and keep their data private.
  - Stephen304 6y ago
- olah_1 6y ago
  > uptake is embarrassingly low I wonder if this is secure partially because of the "security through obscurity" factor, in that case. More eyes are on Signal based on usage and promotion, that's for sure.
  - nix23 6y ago
    Don't think about that...it's Swiss we breathe encryption...and some backdoors.
- whycombagator 6y ago
  I think Threema seems like it might be a solid alternative to Signal. A couple of other drawbacks for Threema: - Can’t delete messages on recipient devices (disappearing messages in Signal) - As far as I can tell, the server isn’t open source Also, a very brief look suggests the two most recent security audits for Threema only covered the iOS & Android clients? Someone correct me if I am wrong Threema run & operate all their own servers - that’s good & bad in my eyes (do they know what they doing? Has any of their infrastructure been security audited?)
  - chopin 6y ago
    > Threema run & operate all their own servers - that’s good & bad in my eyes (do they know what they doing? Has any of their infrastructure been security audited?) Afaik that's not different to Signal.
  - AnonC 6y ago
    > As far as I can tell, the server isn’t open source That could be said of Signal too, since updates to the server source code haven’t been published for a very long time now (unlike the client’s source code).
    - fsflover 6y ago
      Exactly, which is why one should use Matrix instead.
- sradman 6y ago
  GCM is Google Cloud Messaging [1] used for push notifications on Android and Chrome. > It has been superseded by Google's Firebase Cloud Messaging (FCM) on May 29, 2019. [1] https://en.wikipedia.org/wiki/Google_Cloud_Messaging https://en.wikipedia.org/wiki/Google_Cloud_Messaging
- clairity 6y ago
  apparently threema also uses google for notifications on android: "Threema uses Firebase Cloud Messaging (FCM) to notify the app of new messages in the background. If Google Play Services are not installed, Threema checks for new messages using polling. The polling interval is configurable between 5 and 30 minutes and may cause additional battery drain and data usage." but, apparently doesn't transmit any messages via fcm: "Threema uses Firebase Cloud Messaging (FCM) to inform Android users about incoming messages in the background. The app then fetches messages directly from the Threema servers, decrypts them and displays a local notification. Neither contents nor details about messages are transmitted via FCM (the FCM payload is empty), and all of Firebase’s tracking and analysis components have been removed." perhaps signal does something similar? on ios, it apparently encrypts notification messages instead: "Threema uses the Apple Push Notification Service (APNS) to inform recipients with iOS about new messages while the app is closed or in the background. The APNS message contains a payload that has been encrypted with a symmetric key, which is negotiated between the app and the Threema servers and is not known to Apple."
- mickotron 6y ago
  Signal still works with notifications and everything without GCM or any google aervices. I have grapheneos on my pixel phone and signal works flawlessly. But yes it would be nice if they used something else other than GCM for the vast majority.
pcdoodle 6y ago
I use this for video chats as well! surprisingly good, it prefers resolution over frames and never gets choppy. Also on my Mac I use a dedicated browser to have a dedicated dock item to log into the web client for desktop notifications (Firefox in my case).
- bsdooby 6y ago
  Me too, but use Opera for this.
- yunohn 6y ago
  I was under the impression that Firefox doesn’t not support PWAs, so much that the feature request was even closed? Has something changed? Last time I tried, it could not create dedicated dock items like Chrome.
- veddox 6y ago
  The sound quality for phone calls is fantastic - I prefer Threema calls over regular mobile phone calls because they are just so much clearer. (Provided one has a stable Internet connection, of course.)
DerWOK 6y ago
Multi-year Heavy Threema User here. They just made it fully open source. Which I greatly appreciate. And though this comparison by them might be little biased I found it interesting especially with regards to Signal: https://threema.ch/en/messenger-comparison https://threema.ch/en/messenger-comparison
- kenniskrag 6y ago
  Be aware that there is still a license check. So open source != free.
bsdooby 6y ago
Server infrastructure is not Open Source (I guess). So, this might be a problem for some.
- nix23 6y ago
  >Server infrastructure is not Open Source Exactly...it is a problem for me.
  - dbrgn 6y ago
    If it were open source, how would you be able to tell that this is the actual code running? If the proper application of E2EE can be validated using the open source client apps, why is the server code relevant from a security standpoint?
    - hrjet 6y ago
      That's why Matrix is better. Open server, open client, open protocol. Host your own server, build your own client, and yet be able to talk with everyone else.
behnamoh 6y ago
I have mixed feelings about the video on the website.
- moritonal 6y ago
  Omg I just watched it... that, that shouldn't exist. A lot of production quality went into that.. and yet if I tried to convince anyone to use Threema based off that vid they'd balk.
  - icy 6y ago
    ... what the fuck was that lol. What were they thinking?
    - volgar1x 6y ago
      I think it's hilarious while staying on point (almost, ending tissue might be too much)
- krlx 6y ago
  God, I expected a funny bad video, but this was beyond embarrasing.
- dbrgn 6y ago
  Maybe you'll prefer the old promo clip from 2014: https://www.youtube.com/watch?v=x5ULcrBUXT0 https://www.youtube.com/watch?v=x5ULcrBUXT0 Ah, 3:4 aspect ratio, a blast from the past :)
moritonal 6y ago
Wasn't WhatsApp both a pay-once and privacy first messaging app? It then changed at the sound of dollar signs. What's different here?
- hutattedonmyarm 6y ago
  Threema is Open Source and didn’t get bought by Facebook. Also, was WhatsApp ever super privacy friendly? They weren’t Facebook level bad, but I don’t remember them being specifically targeted towards privacy
  - dbrgn 6y ago
    Back when Threema was founded, WhatsApp was still blasting messages in plaintext through your WiFi, where the other people sitting next to you in Starbucks could read along. I don't ever recall WhatsApp as being privacy friendly.
- AnonC 6y ago
  Depending on the country, WhatsApp was “pay once a year” or free. I don’t understand how a service that requires online resources and maintenance can charge a one-time fee and be done with it, more so considering that this one says it’s based out of (expensive) Switzerland.
  - dbrgn 6y ago
    There are also enterprise offerings with recurring payments: https://work.threema.ch/ https://work.threema.ch/ If you take a look at the customer list (Daimler with 300k employees, Bosch with 400k employees, the federal administration of Switzerland, and others) it does seem to be quite a sustainable business model. (Edit: Added note about customer list)
gadders 6y ago
Quite popular in Switzerland - it's featured in a few banking scandals: https://www.reuters.com/article/us-creditsuisse-spying-finma/regulator-asks-for-credit-suisse-directors-mobile-data-in-spy-inquiry-sources-idUSKBN22V0MT https://www.reuters.com/article/us-creditsuisse-spying-finma...
z77dj3kl 6y ago
Note that Signal's crypto is more robust. This lacks forward secrecy, and Signal also has the Double Ratchet algorithm which provides some protection to earlier and later keys (/messages) if an attacker is able to recover a user's keys at a fixed point in time.
_visgean 6y ago
Note that Slovakian police (With the help of Europol) have been able to obtain access to Threeema. https://balkaninsight.com/2019/10/09/puppet-master-slovakia-reckons-with-backstory-to-reporters-killing/ https://balkaninsight.com/2019/10/09/puppet-master-slovakia-...
- djeiasbsbo 6y ago
  Since then, they seem to have open sourced their client applications, so it should at least be possible to verify e2e encryption of messages. That isn't to say that metadata isn't valuable as well, of course.
- whycombagator 6y ago
  > Slovak investigators, working with Europol, the European Union’s law enforcement agency, cracked Kocner’s phone and gained access to encrypted communication via the instant messaging app Threema.
- tbabej 6y ago
  If I remember correctly, the user in question kept exported plain-text backups of the conversations on the phone. The encryption of the app itself was not breached.
k_sze 6y ago
How does Threema deal with the keyboard leak that Naomi Wu has pointed out multiple times about Signal (and basically all other messenger apps)? I'm talking about the fact that virtual keyboards don't necessarily respect the incognito mode requested by the app.
- nitrohorse 6y ago
  Related, looks like Signal recently added a support doc for this issue. https://support.signal.org/hc/en-us/articles/360055276112-Incognito-Keyboard https://support.signal.org/hc/en-us/articles/360055276112-In... More discussion found at https://community.signalusers.org/t/signal-should-warn-users-who-are-likely-using-insecure-ime-apps/10272/1 https://community.signalusers.org/t/signal-should-warn-users...
magicpointer 6y ago
The Swiss government is using the Threema Work version as its official internal messenger [1] They also provide a transparency report about metadata shared with government agencies through court orders, requests have been going up in the last years [2] [1] https://twitter.com/ThreemaApp/status/1095675070922534912?s=19 https://twitter.com/ThreemaApp/status/1095675070922534912?s=... [2] https://threema.ch/en/transparencyreport https://threema.ch/en/transparencyreport

83 points by dgudkov 6y ago

Benefits over signal: * Does not require a phone number * (related) more tractable on non-phone devices * Does not use GCM. * Interface is smoother (subjective) * Has 'work' mode allowing for enterprise use Drawbacks over signal: * Has a non-zero price, so uptake is embarrassingly low. Embarrassing for humanity that is. I've struggled to get well paid professionals to cough up the €4. There is some mental block beyond 'free', yet these same people decry WA's privacy changes. I think signal was right to use GCM,for the general audience, but I personally would like to avoid it where possible. I use both apps, which in itself is a boon. Feel free to reach out, my Threema ID is in my profile. Would love to create a HN group to test the group features at scale.

pdimitar 6y ago
I have no problem paying €4 or even €40. Problem is that I don't know when I can be locked out of an app due to Apple or Google policies. Not the fault of the creator(s), obviously. That, and as another commenter pointed out: network effects. I'll pay alright, no worries. But how I even test the thing if none of my people are there? And why no free trial? I'd evaluate the messenger in maximum 30 minutes.
- klaushardt 6y ago
  The free trial is just asking the App Store for a refund. I did it twice so far when i bought an App wich sounded good but then didnt do what i wanted. I think you have 48 hours time for this. iOS: https://support.apple.com/de-de/HT204084 https://support.apple.com/de-de/HT204084 Android: https://support.google.com/googleplay/answer/7205930 https://support.google.com/googleplay/answer/7205930
that_guy_iain 6y ago
The uptake in Germany was rather good at one point for years I think it was in the top paid apps in the apple app store. I've not looked recently as I bought it just incase anyone I knew got it and wanted to use it. > I've struggled to get well paid professionals to cough up the €4. There is some mental block beyond 'free', yet these same people decry WA's privacy changes. Our culture is totally broken. I think it stems from our salaries being too low. People have less money than they should so need thinks to be free to get by which means investors need to pay for it which means the salaries need to be low so the investors make money.
- nerdponx 6y ago
  Think about the game theory here. I am willing to pay €4. But only if all my friends also pay €4 and decide to start using the app. Otherwise it's worth €0 to me. So unless I can convince them to start (which I usually can't, because they don't trust that their friends will use it), the natural equilibrium is that nobody buys it. One solution might be a 30 day free trial? I don't know why free trials are so unpopular nowadays. I am much more inclined to buy something when I have had a chance to try it!
  - anotherhue 6y ago
    Then there's a scramble to get all your contacts to align in the same 30 days :( Maybe free for up to 5 contacts?
  - fileeditview 6y ago
    Didn't WhatsApp do it similar in the beginning? AFAIR they offered the app for free and said after one year you have to pay 1€/$. I paid this once or twice and then it was free again (probably because of FB). However it was very clever to give a whole year for free, lock everyone in and then start taking a small fee. I like that strategy. Now with FB it's just a plain data grab.
    - oarsinsync 6y ago
      Correct. And despite this, many of my friends refused to pay the $1/£1/1€ on the basis that facebook messenger was free, as was SMS in their cell plans. So I paid for them. Despite them all earning real money in real jobs. Then Facebook bought WhatsApp, and now none of them are willing to move to Signal, because they like WhatsApp.
      - petre 6y ago
        I did something else: I don't have WA or messenger. If anyone wants to text me they should use Signal or SMS or e-mail.
  - 6y ago
deleted 6y ago
[deleted]
okso 6y ago
> I've struggled to get well paid professionals to cough up the €4. There is some mental block beyond 'free', yet these same people decry WA's privacy changes. For some people the issue is not about the money but about giving it to a vendor-locked platform and have access to the app depend on it. I happily did donations to open-source projects such as MyExpenses [1] and Netguard [2] to support the projects and unlock features. And can still use these now that I went for a mobile with Android but without Google Services/GCM. [1] https://www.myexpenses.mobi/ https://www.myexpenses.mobi/ [2] https://netguard.me/ https://netguard.me/
stonesweep 6y ago
> Drawbacks over signal: I'd like to add "network effect" to this, as I can draw a parallel to another failed attempt which made the same general mistake (placing a hurdle in front of newcomers). Google Plus. When Google Plus hit the streets, Google had this stupid "invite only" system and it just became this huge thing within 24 hours to "buy invites" and so forth, people at that exact moment were ready and willing to try the new thing and were excited... then were hit with "yeah sorry, you can't sign up right now" and walked away never to return. They heard about it on Facebook, tried to go give it a try, then hit the hurdle and stayed on Facebook. It's my personal belief this initial step is what Google got wrong, all warts about the service aside. The first 48 hours was make or break, and they lost the momentum and never recovered. Threema was the same to me - I heard about it years ago and read very positive reviews, however to even try it out I needed to spend money and convince a bunch of friends to spend money just to get the client and see what it was about. It may have been great! However if I couldn't have a friend to chat with, it was of $0 value to me to even buy the client. IMHO, this is the hole Threema now has to dig themselves out of - walled gardens with an initial adoption hurdle trigger a psychological "nah, maybe later" reaction out of many people.
- h0nd 6y ago
  I just bought threema out of the blue and to see how many of my friends are using it (and make themselves be found). I'd say 10% of my contacts, mostly tech-savvy, are there already and no need to convince anyone.
corobo 6y ago
> There is some mental block beyond 'free' Yeah I'm not paying for an app nobody else I know is using haha Can apps do custom trial periods? I reckon they'd benefit from something like a 3 month trial period. Let people really get into using it before committing.
opheliate 6y ago
Just as someone who has essentially zero knowledge of app development, why is using GCM a negative? Apologies for the very basic question.
- anotherhue 6y ago
  Addressed below https://news.ycombinator.com/item?id=25859743 https://news.ycombinator.com/item?id=25859743
baxtr 6y ago
I think threema is a great product and at the same time a core reason why they haven't grown bigger yet is because they don't experiment enough with pricing models. Successful apps I know offer some standard functionality for free, get users to use the app and then offer additional functionality that a certain amount of people will buy after they have fallen in love with the product. There is no chance competing with all the free messengers otherwise.
tluyben2 6y ago
Where is signal hosted? I know quite a few people who picked Threema because it's not hosted in the US (even if you can validate the encryption is sound by checking the app source).
- dbrgn 6y ago
  As far as I know, Signal is hosted on a mix of Amazon, Google, Microsoft and Cloudflare. https://www.kuketz-blog.de/signal-jegliche-kommunikation-erfolgt-ueber-tech-giganten-wie-amazon-microsoft-google-und-cloudflare/ https://www.kuketz-blog.de/signal-jegliche-kommunikation-erf... Threema is hosted on bare-metal servers in Switzerland. https://threema.ch/en/faq/server_location https://threema.ch/en/faq/server_location
qqqqqqqqqqqqqqw 6y ago
> Does not use GCM. Why is this a benefit?
- anotherhue 6y ago
  a) I feel Google is over-represented in our tech lives, so when it's possible to use an alternative I choose to. b) GCM undoubtedly collects metadata about my usage of it c) [falsified] AFAIK GCM requires a Google account, which means your usage of the system is at the pleasure of Google, and can be disabled for a myriad of Orwellian reasons.
  - chopin 6y ago
    I use Signal on Android and I definitely have no Google account. It seems to be an optional component of Signal. As well I never was asked sign up anywhere.
  - qqqqqqqqqqqqqqw 6y ago
    Thanks for explaining. Though, like xenocratus, I thought you meant Galois/Counter Mode and was similarly puzzled :)
  - lxgr 6y ago
    > AFAIK GCM requires a Google account It does not.
- xenocratus 6y ago
  I had the same question until I realised it meant Google Cloud Messaging (or, this is how people seem to interpret it) - my initial thought was that it was about Galois Counter Mode (an authenticated encryption mode), and was curious why not using it was considered a benefit. Threema does seem to use XSalsa20 + Poly1305 for authenticated encryption (not AES in GCM), btw.
  - anotherhue 6y ago
    Haha, I'm sorry about that confusion, as a fellow crypto-fan I should have noticed.
jsiepkes 6y ago
> Has a non-zero price, so uptake is embarrassingly low. Embarrassing for humanity that is. I've struggled to get well paid professionals to cough up the €4. What's really weird is that people park their car somewhere and pay 8 Euro parking fee without thinking about it. But when an app (which sure lasts a lot longer then a couple of hours of parking space) costs any amount more then zero people it suddenly becomes a mental barrier for people...
- doublerabbit 6y ago
  My take on it would be that people see cars for example as a physical item. And that item comes with real expenses. Fuel, parking tickets and whatnot. Your conditioned for this when you get your first car Mobile phones apart from the device itself are seen as free. Your conditioned to expect to get apps for free, I expect content to be free. So when you start asking for money; there is no association between the price wanted and a physical object. Only an application which was free.
- short_sells_poo 6y ago
  I think this is because of the prevalence of free (as in free beer) software. The moment this became normalized, every time something actually does ask for money, you have to decide that the expenditure is indeed worth it. Yes, 4 bucks is a pittance in absolute terms for many people, but they still don't want to just throw it out the window, so they have to actually take the mental energy of justifying this purchase. And yes you could say that the same people won't bat an eye spending 4 bucks on beer, but beer is an immediate reward in itself. The brain is usually already wired to automatically reward it's own decision to buy beer and buying one beer lessens the very restraints that would stand in the way of buying beer to begin with. These factors are usually not present when buying an app, unless it's a game or similar or it becomes a "passion" purchase. I don't know how to fix this. I would like to blame Ad Tech and the blight of "free" apps that fund themselves out of mining people's data. I think it is fair to say that this was a contributing factor at least. At the same time, I think there is genuine value in a proposition where people can pick to get the product for "free" and sell their data, or pay for the product and keep their data private.
- Stephen304 6y ago
olah_1 6y ago
> uptake is embarrassingly low I wonder if this is secure partially because of the "security through obscurity" factor, in that case. More eyes are on Signal based on usage and promotion, that's for sure.
- nix23 6y ago
  Don't think about that...it's Swiss we breathe encryption...and some backdoors.
whycombagator 6y ago
I think Threema seems like it might be a solid alternative to Signal. A couple of other drawbacks for Threema: - Can’t delete messages on recipient devices (disappearing messages in Signal) - As far as I can tell, the server isn’t open source Also, a very brief look suggests the two most recent security audits for Threema only covered the iOS & Android clients? Someone correct me if I am wrong Threema run & operate all their own servers - that’s good & bad in my eyes (do they know what they doing? Has any of their infrastructure been security audited?)
- chopin 6y ago
  > Threema run & operate all their own servers - that’s good & bad in my eyes (do they know what they doing? Has any of their infrastructure been security audited?) Afaik that's not different to Signal.
- AnonC 6y ago
  > As far as I can tell, the server isn’t open source That could be said of Signal too, since updates to the server source code haven’t been published for a very long time now (unlike the client’s source code).
  - fsflover 6y ago
    Exactly, which is why one should use Matrix instead.
sradman 6y ago
GCM is Google Cloud Messaging [1] used for push notifications on Android and Chrome. > It has been superseded by Google's Firebase Cloud Messaging (FCM) on May 29, 2019. [1] https://en.wikipedia.org/wiki/Google_Cloud_Messaging https://en.wikipedia.org/wiki/Google_Cloud_Messaging
clairity 6y ago
apparently threema also uses google for notifications on android: "Threema uses Firebase Cloud Messaging (FCM) to notify the app of new messages in the background. If Google Play Services are not installed, Threema checks for new messages using polling. The polling interval is configurable between 5 and 30 minutes and may cause additional battery drain and data usage." but, apparently doesn't transmit any messages via fcm: "Threema uses Firebase Cloud Messaging (FCM) to inform Android users about incoming messages in the background. The app then fetches messages directly from the Threema servers, decrypts them and displays a local notification. Neither contents nor details about messages are transmitted via FCM (the FCM payload is empty), and all of Firebase’s tracking and analysis components have been removed." perhaps signal does something similar? on ios, it apparently encrypts notification messages instead: "Threema uses the Apple Push Notification Service (APNS) to inform recipients with iOS about new messages while the app is closed or in the background. The APNS message contains a payload that has been encrypted with a symmetric key, which is negotiated between the app and the Threema servers and is not known to Apple."
mickotron 6y ago
Signal still works with notifications and everything without GCM or any google aervices. I have grapheneos on my pixel phone and signal works flawlessly. But yes it would be nice if they used something else other than GCM for the vast majority.

pcdoodle 6y ago

I use this for video chats as well! surprisingly good, it prefers resolution over frames and never gets choppy. Also on my Mac I use a dedicated browser to have a dedicated dock item to log into the web client for desktop notifications (Firefox in my case).

bsdooby 6y ago
Me too, but use Opera for this.
yunohn 6y ago
I was under the impression that Firefox doesn’t not support PWAs, so much that the feature request was even closed? Has something changed? Last time I tried, it could not create dedicated dock items like Chrome.
veddox 6y ago
The sound quality for phone calls is fantastic - I prefer Threema calls over regular mobile phone calls because they are just so much clearer. (Provided one has a stable Internet connection, of course.)

DerWOK 6y ago

Multi-year Heavy Threema User here. They just made it fully open source. Which I greatly appreciate. And though this comparison by them might be little biased I found it interesting especially with regards to Signal: https://threema.ch/en/messenger-comparison https://threema.ch/en/messenger-comparison

kenniskrag 6y ago
Be aware that there is still a license check. So open source != free.

bsdooby 6y ago

Server infrastructure is not Open Source (I guess). So, this might be a problem for some.

nix23 6y ago
>Server infrastructure is not Open Source Exactly...it is a problem for me.
- dbrgn 6y ago
  If it were open source, how would you be able to tell that this is the actual code running? If the proper application of E2EE can be validated using the open source client apps, why is the server code relevant from a security standpoint?
  - hrjet 6y ago
    That's why Matrix is better. Open server, open client, open protocol. Host your own server, build your own client, and yet be able to talk with everyone else.

behnamoh 6y ago

I have mixed feelings about the video on the website.

moritonal 6y ago
Omg I just watched it... that, that shouldn't exist. A lot of production quality went into that.. and yet if I tried to convince anyone to use Threema based off that vid they'd balk.
- icy 6y ago
  ... what the fuck was that lol. What were they thinking?
  - volgar1x 6y ago
    I think it's hilarious while staying on point (almost, ending tissue might be too much)
krlx 6y ago
God, I expected a funny bad video, but this was beyond embarrasing.
dbrgn 6y ago
Maybe you'll prefer the old promo clip from 2014: https://www.youtube.com/watch?v=x5ULcrBUXT0 https://www.youtube.com/watch?v=x5ULcrBUXT0 Ah, 3:4 aspect ratio, a blast from the past :)

moritonal 6y ago

Wasn't WhatsApp both a pay-once and privacy first messaging app? It then changed at the sound of dollar signs. What's different here?

hutattedonmyarm 6y ago
Threema is Open Source and didn’t get bought by Facebook. Also, was WhatsApp ever super privacy friendly? They weren’t Facebook level bad, but I don’t remember them being specifically targeted towards privacy
- dbrgn 6y ago
  Back when Threema was founded, WhatsApp was still blasting messages in plaintext through your WiFi, where the other people sitting next to you in Starbucks could read along. I don't ever recall WhatsApp as being privacy friendly.
AnonC 6y ago
Depending on the country, WhatsApp was “pay once a year” or free. I don’t understand how a service that requires online resources and maintenance can charge a one-time fee and be done with it, more so considering that this one says it’s based out of (expensive) Switzerland.
- dbrgn 6y ago
  There are also enterprise offerings with recurring payments: https://work.threema.ch/ https://work.threema.ch/ If you take a look at the customer list (Daimler with 300k employees, Bosch with 400k employees, the federal administration of Switzerland, and others) it does seem to be quite a sustainable business model. (Edit: Added note about customer list)

gadders 6y ago

Quite popular in Switzerland - it's featured in a few banking scandals: https://www.reuters.com/article/us-creditsuisse-spying-finma/regulator-asks-for-credit-suisse-directors-mobile-data-in-spy-inquiry-sources-idUSKBN22V0MT https://www.reuters.com/article/us-creditsuisse-spying-finma...

z77dj3kl 6y ago

Note that Signal's crypto is more robust. This lacks forward secrecy, and Signal also has the Double Ratchet algorithm which provides some protection to earlier and later keys (/messages) if an attacker is able to recover a user's keys at a fixed point in time.

_visgean 6y ago

Note that Slovakian police (With the help of Europol) have been able to obtain access to Threeema. https://balkaninsight.com/2019/10/09/puppet-master-slovakia-reckons-with-backstory-to-reporters-killing/ https://balkaninsight.com/2019/10/09/puppet-master-slovakia-...

djeiasbsbo 6y ago
Since then, they seem to have open sourced their client applications, so it should at least be possible to verify e2e encryption of messages. That isn't to say that metadata isn't valuable as well, of course.
whycombagator 6y ago
> Slovak investigators, working with Europol, the European Union’s law enforcement agency, cracked Kocner’s phone and gained access to encrypted communication via the instant messaging app Threema.
tbabej 6y ago
If I remember correctly, the user in question kept exported plain-text backups of the conversations on the phone. The encryption of the app itself was not breached.

k_sze 6y ago

How does Threema deal with the keyboard leak that Naomi Wu has pointed out multiple times about Signal (and basically all other messenger apps)? I'm talking about the fact that virtual keyboards don't necessarily respect the incognito mode requested by the app.

nitrohorse 6y ago
Related, looks like Signal recently added a support doc for this issue. https://support.signal.org/hc/en-us/articles/360055276112-Incognito-Keyboard https://support.signal.org/hc/en-us/articles/360055276112-In... More discussion found at https://community.signalusers.org/t/signal-should-warn-users-who-are-likely-using-insecure-ime-apps/10272/1 https://community.signalusers.org/t/signal-should-warn-users...

magicpointer 6y ago

The Swiss government is using the Threema Work version as its official internal messenger [1] They also provide a transparency report about metadata shared with government agencies through court orders, requests have been going up in the last years [2] [1] https://twitter.com/ThreemaApp/status/1095675070922534912?s=19 https://twitter.com/ThreemaApp/status/1095675070922534912?s=... [2] https://threema.ch/en/transparencyreport https://threema.ch/en/transparencyreport