6 ms·

A few friends of mine really really tried to switch from Hangouts to TextSecure, but we couldn't do it - it was just too painful, complicated and buggy. We're u

A few friends of mine really really tried to switch from Hangouts to TextSecure, but we couldn't do it - it was just too painful, complicated and buggy. We're using Telegram now and it's at least way better than Hangouts and TextSecure on the user experience, even though it's less secure than TextSecure. Are there any good secure messengers out there that truly works cross platform (iOS, Android and Web/Win/OSX)? It's a shame that something like Telegram seems to be the best right now, considering its dodgy security model.

huuu 12y ago
imho there is only 'secure' and 'insecure'. Less secure == insecure.
- kcorbitt 12y ago
  It depends on the threat profile. Something can be "secure from a MITM on the coffee shop wifi" without necessarily being "secure from a directed attack by the NSA". For any practical security scheme, you do have to make some assumptions about the limitations of your adversary's capabilities. In the extreme case of "attacker has ability to read contents from memory on the end user's machine at will," I'm not aware of any secure cryptographic solution short of memorizing the key and performing all encryption/decryption by hand.
  - _asummers 12y ago
    To add to this, there is a time component as well. If your data only needs to be secure for 20 years, it has a different threat profile than one that needs to be secure for 200 years. Then the question becomes "20 years for who?". The safe industry, as an example, thinks about their security problems in this manner.
- saraid216 12y ago
  Not really. There's only "insecure" and "less insecure". "Secure" just means that no one has figured out how to break it yet, or that you don't care if the people who can break it do so.
  - drdaeman 12y ago
    Perfectly implemented one-time pads are secure. But they're insanely hard to implement perfectly.
Nursie 12y ago
What's buggy about textsecure? Genuinely interested, never had issues with it so far.
- kristofferR 12y ago
  It suddenly, for no apparent reason at all, stops working until it is reinstalled. Messages are marked as being successfully sent, but they're not being received by the recipient. All my friends have the same issue.
  - deleted 12y ago
    [deleted]
  - Nursie 12y ago
    How strange! The only issue I've seen has been to do with changing handset and needing to re-associate a phone number with a new key. There's a menu option for that which was quite well hidden. I shall watch out for new issues as the iOS version gains functionality.
  - drdaeman 12y ago
    Were you using SMS or push (GCM) transport? Non-related to TextSecure, I've tried to use GCM to send notifications about faulty servers and found it quite unreliable. It seem to work fine when the phone's on and has a good WiFi connection, but seem to lose messages in real-life conditions. Not to the extent to completely stop working, just a packet loss, though.
- doque 12y ago
  I've had a lot of issues with MSS not being received.
- SnacksOnAPlane 12y ago
  Mine almost never can properly receive MMS messages. Either I just don't get them or it can't download the attached image. It also has problems getting group messages. I've switched back to the stock messaging app.
RDaneelOlivaw 12y ago
I've not found textsecure to be buggy at all, can you explain your experience a bit more? My friends and I switched to it from surespot and love it. Its also a killer feature that it handles standard SMS as well. A single app for all messaging. Also, wasn't telegram demonstrated to have awful crypto? Like basically pointless to use from an encryption standpoint? I'm keeping an eye on the forthcoming Hemlis messenger which should have good crypto and launch on iOS/android and from the demo videos it has an awesome ui. However they're taking forever to launch the thing so who knows when it'll be out. Also it will need to be open sourced and audited before I trust it.
- kristofferR 12y ago
  It suddenly, for no apparent reason at all, stops working until it is reinstalled. Messages are marked as being successfully sent, but they're not being received by the recipient. All my friends have the same issue. Since it's only on Android I can't use it as the single app for all messaging. I certainly type much faster on my desktop keyboard than I do on my cell phone, so I need something with desktop support too. A lot of my friends also have iOS, which also is an issue. Telegram's crypto is pretty weird, and potentially insecure - no doubt. However, it's the only messaging app I've found with good clients (superb in fact) on all platforms that has some level of encryption. I don't "need" (although I would certainly prefer) to be protected from targeted attacks, I need to be protected from mass surveillance.
  - mtrimpe 12y ago
    +1 on the message loss issues. Even got to the point where I would lose incoming messages if I didn't catch them on the notification screen.
  - justcommenting 12y ago
    > Since it's only on Android I can't use it as the single app for all messaging. messaging is expected to be rolled into the Signal iOS app quite soon, as I understand it
    - 12y ago
darkhorn 12y ago
I use Telegram too, because it is easy to use, secure, and you can use it even in Windows 7. If we don't have internet we switch to Babel Full, which works both on Android and iOS.
- mkesper 12y ago
  You mean INsecure: http://security.stackexchange.com/questions/49782/is-telegram-secure http://security.stackexchange.com/questions/49782/is-telegra...
gasull 12y ago
I use it with some friends. No issues. Pro tip: to use TextSecure and RedPhone with Google Voice, enter your Google Voice number, let the SMS validation time out and then retry the validation by phone call.
tptacek 12y ago
If your adversaries aren't nation-states, the mainstream chat applications (Facebook messages, Google Chat, and iMessage) all probably do a better job of protecting the integrity of their channel than Telegram does. If your enemies are capable enough to compromise Google Chat, you need to be using something without a dodgy security model.
- opendais 12y ago
  This++. Also, if they were nation-states you probably shouldn't post about it in a public forum either. I'd only worry if you were a Google competitor using Google Chant/Hangouts. :p
aftbit 12y ago
OTR on XMPP is alright. I use ChatSecure on Android, Pidgin/Adium on Linux/Mac. It has some issues with multiple devices being logged on at once, but that's alright.
psuter 12y ago
I've been using Threema [1] without any issues, and it works on Android and iOS. The user experience is on par with WhatsApp, I would say. The source is not available, so you must be willing to take their claims at face value [2]. [1] https://threema.ch/en/ https://threema.ch/en/ [2] https://threema.ch/press-files/cryptography_whitepaper.pdf https://threema.ch/press-files/cryptography_whitepaper.pdf
hobarrera 12y ago
> Are there any good secure messengers out there that truly works cross platform (iOS, Android and Web/Win/OSX)? It's a shame that something like Telegram seems to be the best right now, considering its dodgy security model. XMPP+OTR has been supported on major platforms for years (and for decades without OTR). It offers all the features the above Telegram/TextSecure/etc offer, and is descentralized, so you don't rely on some arbitrary third-party.
- hrjet 12y ago
  That piqued my interest. Do you have recommendations for an open-source XMPP+OTR client for Android?

huuu 12y ago

imho there is only 'secure' and 'insecure'. Less secure == insecure.

kcorbitt 12y ago
It depends on the threat profile. Something can be "secure from a MITM on the coffee shop wifi" without necessarily being "secure from a directed attack by the NSA". For any practical security scheme, you do have to make some assumptions about the limitations of your adversary's capabilities. In the extreme case of "attacker has ability to read contents from memory on the end user's machine at will," I'm not aware of any secure cryptographic solution short of memorizing the key and performing all encryption/decryption by hand.
- _asummers 12y ago
  To add to this, there is a time component as well. If your data only needs to be secure for 20 years, it has a different threat profile than one that needs to be secure for 200 years. Then the question becomes "20 years for who?". The safe industry, as an example, thinks about their security problems in this manner.
saraid216 12y ago
Not really. There's only "insecure" and "less insecure". "Secure" just means that no one has figured out how to break it yet, or that you don't care if the people who can break it do so.
- drdaeman 12y ago
  Perfectly implemented one-time pads are secure. But they're insanely hard to implement perfectly.

Nursie 12y ago

What's buggy about textsecure? Genuinely interested, never had issues with it so far.

kristofferR 12y ago
It suddenly, for no apparent reason at all, stops working until it is reinstalled. Messages are marked as being successfully sent, but they're not being received by the recipient. All my friends have the same issue.
- deleted 12y ago
  [deleted]
- Nursie 12y ago
  How strange! The only issue I've seen has been to do with changing handset and needing to re-associate a phone number with a new key. There's a menu option for that which was quite well hidden. I shall watch out for new issues as the iOS version gains functionality.
- drdaeman 12y ago
  Were you using SMS or push (GCM) transport? Non-related to TextSecure, I've tried to use GCM to send notifications about faulty servers and found it quite unreliable. It seem to work fine when the phone's on and has a good WiFi connection, but seem to lose messages in real-life conditions. Not to the extent to completely stop working, just a packet loss, though.
doque 12y ago
I've had a lot of issues with MSS not being received.
SnacksOnAPlane 12y ago
Mine almost never can properly receive MMS messages. Either I just don't get them or it can't download the attached image. It also has problems getting group messages. I've switched back to the stock messaging app.

RDaneelOlivaw 12y ago

I've not found textsecure to be buggy at all, can you explain your experience a bit more? My friends and I switched to it from surespot and love it. Its also a killer feature that it handles standard SMS as well. A single app for all messaging. Also, wasn't telegram demonstrated to have awful crypto? Like basically pointless to use from an encryption standpoint? I'm keeping an eye on the forthcoming Hemlis messenger which should have good crypto and launch on iOS/android and from the demo videos it has an awesome ui. However they're taking forever to launch the thing so who knows when it'll be out. Also it will need to be open sourced and audited before I trust it.

kristofferR 12y ago
It suddenly, for no apparent reason at all, stops working until it is reinstalled. Messages are marked as being successfully sent, but they're not being received by the recipient. All my friends have the same issue. Since it's only on Android I can't use it as the single app for all messaging. I certainly type much faster on my desktop keyboard than I do on my cell phone, so I need something with desktop support too. A lot of my friends also have iOS, which also is an issue. Telegram's crypto is pretty weird, and potentially insecure - no doubt. However, it's the only messaging app I've found with good clients (superb in fact) on all platforms that has some level of encryption. I don't "need" (although I would certainly prefer) to be protected from targeted attacks, I need to be protected from mass surveillance.
- mtrimpe 12y ago
  +1 on the message loss issues. Even got to the point where I would lose incoming messages if I didn't catch them on the notification screen.
- justcommenting 12y ago
  > Since it's only on Android I can't use it as the single app for all messaging. messaging is expected to be rolled into the Signal iOS app quite soon, as I understand it
  - 12y ago

darkhorn 12y ago

I use Telegram too, because it is easy to use, secure, and you can use it even in Windows 7. If we don't have internet we switch to Babel Full, which works both on Android and iOS.

mkesper 12y ago
You mean INsecure: http://security.stackexchange.com/questions/49782/is-telegram-secure http://security.stackexchange.com/questions/49782/is-telegra...

gasull 12y ago

I use it with some friends. No issues. Pro tip: to use TextSecure and RedPhone with Google Voice, enter your Google Voice number, let the SMS validation time out and then retry the validation by phone call.

tptacek 12y ago

If your adversaries aren't nation-states, the mainstream chat applications (Facebook messages, Google Chat, and iMessage) all probably do a better job of protecting the integrity of their channel than Telegram does. If your enemies are capable enough to compromise Google Chat, you need to be using something without a dodgy security model.

opendais 12y ago
This++. Also, if they were nation-states you probably shouldn't post about it in a public forum either. I'd only worry if you were a Google competitor using Google Chant/Hangouts. :p

aftbit 12y ago

OTR on XMPP is alright. I use ChatSecure on Android, Pidgin/Adium on Linux/Mac. It has some issues with multiple devices being logged on at once, but that's alright.

psuter 12y ago

I've been using Threema [1] without any issues, and it works on Android and iOS. The user experience is on par with WhatsApp, I would say. The source is not available, so you must be willing to take their claims at face value [2]. [1] https://threema.ch/en/ https://threema.ch/en/ [2] https://threema.ch/press-files/cryptography_whitepaper.pdf https://threema.ch/press-files/cryptography_whitepaper.pdf

hobarrera 12y ago

> Are there any good secure messengers out there that truly works cross platform (iOS, Android and Web/Win/OSX)? It's a shame that something like Telegram seems to be the best right now, considering its dodgy security model. XMPP+OTR has been supported on major platforms for years (and for decades without OTR). It offers all the features the above Telegram/TextSecure/etc offer, and is descentralized, so you don't rely on some arbitrary third-party.

hrjet 12y ago
That piqued my interest. Do you have recommendations for an open-source XMPP+OTR client for Android?