This sort of discussion of encrypted instant messengers is fun and all but as usual misses the elephant in the room: Only a small percentage of people verify t

This sort of discussion of encrypted instant messengers is fun and all but as usual misses the elephant in the room: Only a small percentage of people verify the identities of their correspondents. Here is a discussion of this with respect to Signal: * https://sequoia-pgp.org/blog/2021/06/28/202106-hey-signal-great-encryption-needs-great-authentication/ https://sequoia-pgp.org/blog/2021/06/28/202106-hey-signal-gr... Presumably the situation with Threema is as bad if not worse. So in either case the people that run the servers can usually get access to actual encrypted content with a straightforward MITM attack. Some random observations: Most users of encrypted instant messengers keep their old messages around. That for all practical purposes negates the forward secrecy right up to the point that those messages are somehow securely deleted. If someone can get access to your secret key information they pretty much for sure can get access to your saved messages. As a result forward secrecy is not very valuable in practice for encrypted messaging. AFAIK, Signal does not offer any sort of strong passphrase feature to protect secret key information or stored data. That is why successful attacks from things like Cellebrite forensic boxes get a fair bit of saved Signal information and it is then possible to impersonate you. So it seems odd to complain that the passphrase feature offered by Threema requires longer passphrases than it should.