19 ms·
Delta Chat is a decentralized and secure messenger app
- exe34 1y agoWhy not just create a group chat and invite FBI and Shin Bet?
- monkaiju 1y agoObligatory briar mention... Briar supports communication over multiple mediums, including wifi & Bluetooth, has forward secrecy, and feels quite 'signal-like' so its not impossible to get people to use it. https://briarproject.org/ https://briarproject.org/
- Tmpod 1y agoBriar cannot do offline delivery unless you setup a stand-in service. Unfortunately that's way to complicated for regular use. Briar looks really nice for people that really need the extra security and privacy, though. I've been interested in SimpleX lately, but I don't really have anyone to properly test it with.
- kingkawn 1y agoPretty Good Protection ain’t good enough anymore
- upofadown 1y agoYeah, that was a figure of speech. Encrypted email is probably still the most secure thing available to most people, even these days. That's because it as asynchronous and offline. You can do it in your air gapped system in your shielded and guarded basement if you really want to. That is as opposed to some instant messaging scheme running on an inherently insecure device like a smart phone where there is access to the messages all the time. Delta Chat is an instant messaging scheme. It is still good to use preexisting standards where possible.
- raybb 1y agoIf you want to migrate to a different chatmail server is it possible to keep that same chat alive or do you have to create a new one and the old stays in the history? This is already how it is with whatsapp but it is a pain point.
- styanax 1y agoAn email address is your Identity; while it's possible for you to maintain the same chat when you migrate, you'll sever the chat for the other person because they have to chat with a new Identity (your new email). (think the email headers to/from, you've kept "to" but changed "from" for them, but it could use the same PGP keys to decrypt etc.)
- ZoomZoomZoom 1y agoDelta chat looks great, and reusing the existing infra is a huge boon. However, it has the same issue of hard reliance on a specific server for connectivity. Why do every system insists on having persistent names as network identifiers? Practice shows that the main threat for the vast majority of users is state censorship. In case of Delta, Matrix, XMPP and others, once you're cut off your home server, your account is basically toast. The only thing you can do, besides circumventing, is a cumbersome and messy account migration[1], where available. In case of Matrix, I feel very bitter, as I managed to onboard a considerable chunk of my personal network but most of them can't login anymore without using VPNs. I'm not sure if I have enough social capital to convince them to repeatedly register on different servers as they get blocked. P2P[2] feels still too far away. Why can't we use key pairs as identifiers and simply request a desired username upon first login? In case of federated networks this would allow seamless server switching and allow users to continue their conversations. Servers shouldn't care what server a particular user's messages are coming from as long as they are verifiably theirs. You can even add username propagation between servers (a new server requests the username from the old one that's supplied with user's login request). I know about Matrix identity servers but I don't see how it helps in this case. 1. https://ems.element.io/tools/matrix-migration https://ems.element.io/tools/matrix-migration 2. https://arewep2pyet.com/ https://arewep2pyet.com/
- Arathorn 1y agoagreed, lack of account portability in Matrix is a pain. we’re working on it in msc4014 and I expect to see some progress this year.
- snthpy 1y agoFor FOSS software, why not have a link to the Github repo or org prominently displayed in the title/menu bar? It took me a couple of clicks to find: https://github.com/deltachat https://github.com/deltachat The "Internet Standards" link points to a URL under https://github.com/deltachat/deltachat-core-rust/ https://github.com/deltachat/deltachat-core-rust/ but when you go there it actually redirects and you end up at https://github.com/chatmail/core https://github.com/chatmail/core which is also confusing.
- gosplchat 1y agoIt's great to see important questions being raised around encryption defaults, metadata, user trust, and the broader push toward decentralized, user-controlled messaging - things we at gospl.chat think about every day. We salute projects like Delta Chat that get more people thinking about privacy and building tools that are both easy to use and secure by design. Cheers!
- fouronnes3 1y agoI'm curious how spam protection works if you're an alternative, few users, chat app? I hate Meta's monopoly as much as the next guy but one thing you do have to credit them for is the second to none spam protection. I also wonder how much requiring a cell number is part of that strategy.
- chrisldgk 1y agoI wouldn’t necessarily agree that WhatsApp‘s spam protection is that great. I’ve been invited to quite a lot of pyramid scheme/scam WhatsApp groups, however that’s mostly happened after having to expose my private cell number on the internet (thanks to app stores and GDPR requiring some kind of phone number for businesses of any size).
- Bluestein 1y ago... always wondered if the cell phone requirements are not (also) tied to then wanting an actual, physical, person behind each account - as in most EU jurisdictions each SIM card is tied to an actual ID.-
- marci 1y agoIn many EU countries, you can buy sim cards from some vending machine, in a grocery store or places where you can buy international telephone cards. No ID required. But phone plans are often tied to your home internet.
- sixtiethutopia 1y agoIt's email-compatible and uses pgp for encryption. No forward secrecy and supports sending unencrypted messages as well for people who don't have pgp. No forward secrecy and will automatically switch to unencrypted messages if you receive an unencrypted message from a contact. I wonder if it's vulnerable to downgrade attacks from adversaries falsifying the sending address. If an adversary sends an unencrypted email imitating a contact will delta chat reject it or will it silently switch the chat with that contact over to unencrypted email?
- maqp 1y ago>No forward secrecy and supports sending unencrypted messages as well for people who don't have pgp. JFC. There's a reason Signal dropped SMS support. What an insane design decision.
- joecool1029 1y agoFWIW textsecure (signal's SMS predecessor) did provide forward secrecy. Details are here: https://signal.org/blog/asynchronous-security/ https://signal.org/blog/asynchronous-security/
- maqp 1y agoYeah but it later also supported non-E2EE SMSs and those were a security risk and they rightfully dropped the support. It was not ideal your grandma thinks any message sent in Signal is safe, when that wasn't the case.
- folmar 1y agoThe way to have guaranteed encryped is creating two user encrypted group chat. https://delta.chat/en/help#how-can-i-ensure-message-end-to-end-encryption-and-deletion https://delta.chat/en/help#how-can-i-ensure-message-end-to-e...
- deknos 1y agodid you look into their spec? perhaps they used the updated openpgp standard which has authenticated encryption. or perhaps they just sign everything. and it's not just pgp with email, it's more akin to an overlaysystem.
- HelloUsername 1y agoPrevious discussions: 05-mar-2025 https://news.ycombinator.com/item?id=43262510 https://news.ycombinator.com/item?id=43262510 100 comments 24-jan-2021 https://news.ycombinator.com/item?id=25893626 https://news.ycombinator.com/item?id=25893626 148 comments 07-jan-2021 https://news.ycombinator.com/item?id=25674894 https://news.ycombinator.com/item?id=25674894 4 commments 27-feb-2019 https://news.ycombinator.com/item?id=19263357 https://news.ycombinator.com/item?id=19263357 11 comments 21-feb-2019 https://news.ycombinator.com/item?id=19216827 https://news.ycombinator.com/item?id=19216827 56 comments 03-feb-2017 https://news.ycombinator.com/item?id=13560279 https://news.ycombinator.com/item?id=13560279 1 comment
- data_maan 1y agoGreat source of info. I wonder why this was downvoted
- m3kw9 1y ago[flagged]
- hkt 1y agoUsed it for years, it is great. Webxdc apps work in both android and desktop clients (not sure about iOS) so I can play chess, share calendars and to do lists, and even collaboratively edit documents, all by email, all privately. Anyone who hasn't tried it really ought to. To the haters talking about PGP: giving your entire social graph to Meta or even Signal is considerably worse.
- singpolyma3 1y agoBesides the fact that hating on PGP is like hating on TLS. It's a spec and a container for just about anything you want to do. gnupg (the thing most people have come to dislike) isn't even spec compliant anymore and was always a power user tool not something most users should actually touch anyway
- Avamander 1y agoNah, hating on PGP is like hating on SSLv3. The specs are bad, the entire system is very error-prone, and the cryptography itself is also outdated.
- singpolyma3 1y agoI somehow agree with your analogy and not your conclusion? SSLv3 is what gave us TLS1.3 The OpenPGP crypto can never be "outdated" because it is constantly being updated.
- Avamander 1y ago> I somehow agree with your analogy and not your conclusion? SSLv3 is what gave us TLS1.3 There's no PGP equivalent of TLSv1.3. The last time people tried that it created a huge drama. > The OpenPGP crypto can never be "outdated" because it is constantly being updated. Yet it hasn't been, it's not there in the implementations, it's not there in the defaults.
- rlue 1y agoHow is the latency? All mainstream chat apps have low-enough latency that a live conversation feels fluid and natural, whereas I frequently encounter situations where I have to wait up to five or ten seconds for an email to come through. That kind of latency would kill the experience IMO.
- shark_laser 1y agoWhy not 0xchat? Private key login, encrypted private chats and contacts, encrypted group chats, and lightning payments. Decentralised, built on Nostr. Available on all platforms. https://www.0xchat.com/ https://www.0xchat.com/
- emptysongglass 1y agoIs it just me or does the website render poorly on mobile?
- data_maan 1y ago0xchat on the surface seems better: looks like a professionally maintained codebase, with clear ways to interact with the devs. But - has there been security audit been done?
- rpdillon 1y agoI think the point here is that everyone has email. A chat client built on Nostr is fine (and I want to love Nostr), but it just doesn't have the reach or ubiquity of email.
- AJ007 1y agoWhen you start looking at alternative messengers outside of Matrix, XMPP, and IRC, there isn't much where third parties can operate or implement both servers and clients. Certainly if no one can implement these two things it is functionally a closed source project. It also is a security failure from the standpoint of control, validation, and also future security and vulnerability patching (there's a graveyard of dead "secure" messaging apps.) Is DeltaChat perfect from a security standpoint? No, but it's certainly well above the hurdle most people are at now. Most people are using non-encrypted communication that is actively scanned & stored, or e2e on paper stuff where one party controls the client, server, application, and storage (trust me e2e security.) Telegram, Discord, Facebook Messenger, stop using that shit.
- promptdaddy 1y ago
- data_maan 1y agoHow does this (or 0xchat) compare to Signal? Have their been done any third-party security audits by reputable companies? If not, it's not safe to use - who knows what's buried in the source code (even if the source code is open).
- singpolyma3 1y agoBiggest advantages are the code is open, the infrastructure is open, and you don't have to hand all your metadata to a single centralized provider
- johnisgood 1y agoI mean, should probably just use Ricochet Refresh, Briar, Session, Element, etc. I also built OTR on top of Discord but it requires Nitro because the messages for OTR end up being way too long. :(
- progval 1y agoCan't they be split into lines? OTR was designed for IRC that limited protocol lines (ie. payload line + command + extra fluff) to 512 bytes, so that ought to work on Discord too.
- johnisgood 1y agoI have not yet tried, that may work since it does work for IRC (which also has a limit per message). It was just more of a proof of concept, tbh, but it works, just not as usable as it could be.
- em-bee 1y agothe whole point of deltachat is that it is reusing an already standardized protocol with existing servers. i am using element/matrix and i have tried briar. the usability of deltachat and the ease of onboarding beats both of those. briar was especially difficult to get started with and only has a very limited usefulness compared to the others. and matrix is simply very complex and easier to misconfigure.
- blancotech 1y agoAnyone else immediately think of delta airlines? I was excited to read an analysis of a seat-to-seat chat implementation
- seydor 1y agothis is my favourite version of decentralization. building on existing widely available infrastructure. The war-proof internet. Maybe with AI there could be a sort of decentralized antispam filtering . but maybe not
- lclc 1y agoHas anyone used that with their Protonmail account? Maybe something Proton should build on for its own chat app.
- kseistrup 1y agoDeltaChat is incompatible with ProtonMail: https://providers.delta.chat/protonmail https://providers.delta.chat/protonmail
- floren 1y agoThey mention the bridge but if they're using pgp under the hood it may well just be entirely broken: https://jfloren.net/b/2023/7/7/0 https://jfloren.net/b/2023/7/7/0
- b0a04gl 1y ago[dead]
- heavyset_go 1y agoNote that while it might be decentralized and "secure", it is not anonymizing as IMAP + SMTP are far from anonymous. Email is a legacy system that was never designed with privacy or anonymity in mind. This is useful if you want to keep the content of your messages secure, but if you need to keep your identity, social graph and the fact that you conversed with certain people obfuscated, I don't think Delta Chat via email is a good solution. It's also only decentralized as much as public email infrastructure is decentralized.
- School-Cotton 1y ago> It's also only decentralized as much as public email infrastructure is decentralized. So… entirely? What am I missing about your point?
- binary132 1y agoPublic email infrastructure is almost entirely dominated by Google. This is worth looking into if you’re not familiar with the state of affairs
- heavyset_go 1y agoI run my own email servers, but 99% of mail goes over Google/Microsoft/AWS/etc email servers anyway. In practice, it's quite centralized and you're always at risk of one of the big providers locking your servers out of their network or putting you on a blocklist they all use.
- singpolyma3 1y agoIt is not possible to hide the fact that you conversed with a certain person from your service provider. That's part of why being able to choose a service provider is so important.
- heavyset_go 1y agoTheoretically, Cwtch[1] would afford you this obfuscation assuming Tor is secure and your adversary isn't nation-state level. Similarly, using SimpleX private message routing via .onion message relays and the fact that the system has no identifiers can also afford you that obfuscation. [1] https://docs.cwtch.im/ https://docs.cwtch.im/
- maqp 1y ago"No, Delta Chat doesn’t support Perfect Forward Secrecy (PFS). This means that if your Delta Chat private decryption key is leaked, and someone has collected your prior in-transit messages, they will be able to decrypt and read them using the leaked decryption key." https://delta.chat/en/help#pfs https://delta.chat/en/help#pfs It's great they're being open about the implications. But given that there's better protocols out there (Signal protocol for example), it makes no sense to use inferior apps.
- em-bee 1y agoforward secrecy is under discussion: https://support.delta.chat/t/autocrypt-key-rotation/2936 https://support.delta.chat/t/autocrypt-key-rotation/2936
- zaik 1y agoModern XMPP clients implement the Signal protocol for encryption and are decentralized like Delta Chat.
- heavyset_go 1y agoXMPP is riddled with privacy pitfalls even when you bolt on encryption to it. Like email, it was not designed with privacy in mind.
- Valodim 1y agoI'm not sure that's fair. It would be if it was otherwise just another messenger app, but Delta uses email as a transport, which gives it a special kind of resilience. It's harder to shut down email than signal.
- tcfhgj 1y agoyou don't have to use email to federate between servers, there are other protocols such as Matrix, XMPP, probably many more
- 1y ago
- iqandjoke 1y agoWhich party the developer associated with? Hopefully not CIA.