I've been inspecting this topic quite a lot and I'm a little confused now. So, we have reasons not to use Signal, reasons not to use Matrix, there were also some claims about Session being a fraught. Briar is mostly activists related (not very suitable for daily use), XMPP lacks good clients and suffers from fragmentation of protocol standards implementation, SimpleX is too feature-incomplete (no UnifiedPush support, big battery drain on Android, very decent desktop client without any message sync). I can't say a lot about Threema or Wire, as I'm not very familiar with them.
So, my question is — is there any good private messenger at all? What do you think is the most acceptable option?
EDIT: In addition to my post:
All messengers have their flaws, I'm well aware of that. I was interested in hearing users' opinions regarding these shortcomings, not in finding the perfect messenger. I may have worded my thoughts incorrectly, sorry for that.
Almost all those can be self-hosted, and built from source, so matrix, xmpp, simplex, are fine. Don't use anything that's uses a centralized server in a five eyes country, like signal or threema.
How is Threema in a five eyes country?
I mean, sure, only the clients are open source. Don't use it for that.
So, we have reasons not to use Signal, reasons not to use Matrix
yes, nearly all possible things in the world have been argued by someone somewhere already
These reasons are serious and valid. That's why I provided links, so as not to be unsubstantiated.
From what I've seen there's a lot of very bad security advice out there with even tech journalists and such just straight up repeating stuff they don't understand
XMPP lacks good clients and suffers from fragmentation of protocol standards implementation
- For Android: Conversations is excellent, also on F-Droid if you don't want to use the Google store.
- For iOS/MacOS: Siskin or iOS/MacOS: Monal.
- For Linux/Windows: Gajim or Linux: Dino.
"Protocol fragmentation" is not a valid complaint about XMPP -- it's like complaining that ActivityPub is fragmented; but that's not a problem: you use the services (Mastodon, Lemmy, Kbin, etc) built with it which suit your needs, mostly interacting with that sector of the federation (eg, Lemmy+Kbin), but get a little interoperability with other sectors as a bonus (eg, Lemmy+Mastodon).
People say this over and over "depends on your threat model" and yet people seem to have a hard time understanding that. Your threat model is "who is your adversary and what he is willing/able to do". Your security goal is what do you want to keep from your adversary.
As others said, if you are an activist or sth important, perhaps you might want to build a working knowledge of cryptography yourself. If you just want META not being able to see your NSFW chat with your romantic partner Signal might be more than enough. In fact, people way more relevant than me also suggest that Signal is good even for bounty hunter vulnerability reporting.
Having said that, what bugs me most is that people think the instant messaging format as suitable for everything: activism, jobs, crimes, broadcasting 1970's prog rock for extraterestrials , whatever lmao. Do you really want to use your phone for all that? Like, just carrying the phone around in the first place nullifies your other precautions, for all advanced threat models beyond privacy of non-critical social messaging.
Persistent/resourceful adversaries can eventually get to you, using a set of penetration and intelligence techniques, which means, if you are involved, the convenience of messaging your partners in crime from the phone in your pocket while waiting for a bus is a convenience you probably can't afford.
It's impossible to escape the surveillance of those three letter agencies. We only got a brief glimpse into the other side of the curtain back in 2013, and there is no idea how advanced their surveillance technologies are, so why bother for a normie?
It's also painstaking if not impossible to wipe all your metadata from the internet, which can later be mined to infer personal data and sold by data brokers. Not to mention that people have jobs and use their credit cards, no way even to hide the most important personal identifying information.
So using Signal, despite being centralized, is not too bad at all. Very few people can totally sacrifice convenience for privacy.
Not to mention that people have jobs and use their credit cards, no way even to hide the most important personal identifying information.
Exactly, this is a lost cause. If you participate in society your essential data are simply out there. For most people the task is to minimize their footprint. If we are talking about evading mass surveillance, then we should take for granted that the person will be to one or another degree marginalized, or lead a fringe lifestyle.
You will always find problems associated with every thing but here's some recommandations :
For a good start, Signal and his forks (molly...)
For daily basis and better than Signal, choose SimpleX (SimpleX is only feature incomplete for the mainstream app, but in it you can send texts, voices, photos, videos, live messages, have a PP, a alias for your contacts...)
Important stuff and activism, use Briar
It really just depends on your threat model.
Think it in this way: What is the most secure way to walk in the city? You'll need a team of armed bodyguards and wear a full bulletproof vest. Do you REALLY need this level of security? Who are you protecting from? If the answer is a criminal organization or law enforcement, then yes, probably. But if the answer is a random thief, then you'll probably need to just carry a gun, pepper spray, knife etc.
Same goes for privacy online and messenger in this case. Are you an activist or a drug dealer? Then you'll probably need Tails + something like SimpleX via TOR. Otherwise, if you are just concerned of typical surveillance capitalism (and don't want the government to scan your chats like it probably will in the EU after Chat Control), in my opinion, Signal is the best compromise of privacy, security and convenience.
What is the most secure way to walk in the city?
Way ahead of you.
Step 1: stay in the basement
Step 2: hire a representative to wear your face and livestream IRL back at you
See, this is the benefit of stem cells. I was able to cut off my face a few years back and now I have several copies of it that I grew and surgically attached to my doubles.
I have family in China and I need to communicate with them. Seems like a pretty common threat model. Signal works only with a foreign SIM and that's only tolerated with tourists. XMPP servers get blocked almost immediately.
does signal's censorship circumvention work for them? It is also possible to use Molly (signal fork) which supports TOR via orbot. If they cannot sign up in the first place, you could use SimpleX chat with TOR also via orbot, but you should figure out a way to send them your link or QR code without the government knowing, or they might get in trouble.
Molly (signal fork): https://molly.im/
Use TOR in China: https://support.torproject.org/censorship/connecting-from-china/
Wire is the best for security (it literally won't let you send messages unencrypted), cost (its free), privacy (no phone number required), and usability for the masses (Foss client on all the platforms, messages sync between each client like you'd expect)
I haven't found anything that checks all those boxes other than Wire (though I do wish we had other options that came close)
https://Wire.com
There are a few that do a good job of protecting our messages with end-to-end encryption, but no single one fits all use cases beyond that, so we have to prioritize our needs.
Signal is pretty okayish at meta-data protection (at the application level), but has a single point of failure/monitoring, requires linking a phone number to your account, can't be self-hosted in any useful way, and is (practically speaking) bound to services run by privacy invaders like Google.
Matrix is decentralized, self-hostable, anonymous, and has good multi-device support, but hasn't yet moved certain meta-data into the encrypted channel.
SimpleX makes it relatively easy to avoid revealing a single user ID to multiple contacts (queue IDs are user IDs despite the misleading marketing) and plans to implement multi-hop routing to protect meta-data better than Signal can (is this implemented yet?), but lacks multi-device support, lacks group calls, drops messages if they're not retrieved within 3 weeks, and has an unclear future because it depends on venture capital to operate and to continue development.
I use Matrix because it has the features that I and my contacts expect, and can route around system failures, attacks, and government interference. This means it will still operate even if political and financial landscapes change, so I can count on at least some of my social network remaining intact for a long time to come, rather than having to ask everyone to adopt a new messenger again at some point. For my use case, these things are more important than hiding which accounts are talking to each other, so it's a tradeoff that makes sense for me. (Also, Matrix has acknowledged the meta-data problem and indicated that they want to fix it eventually.)
Some people have different use cases, though. Notably, whistleblowers and journalists whose safety depends on hiding who they're talking to should prioritize meta-data protection over things like multi-device support and long-term network resilience, and should avoid linking identifying info like a phone number to their account.
XMPP clients are fine albeit it all, as many as they are, slightly different as is the nature of the protocol. This just means there is value in contributing to existing clients, creating new clients, or embracing progressive enhancement (which most do for example with emoji reactions just being a quoted text reply & so on) & complete feature parity is a fool’s errand if you want an exensible protocol with diversity & experimentation in the community. With the broad exception of the Conversations Compliance, there isn’t a flagship client & instead the best ideas come to the most used or most innovative clients. I use Cheogram, Profanity, Gajim, Dino, Movim at different times (& would love to create my own). The protocol is stable, healthy, & ready for proposals for improvement.
If I compare this to the more-expensive-by-all-metrics-to-run Matrix, if it ain’t Element, you gotta problem since a vast majority of users are on it & using all of its features & no other client has anything near parity but are expected to have parity instead of allowing things to sometimes be gracefully missed or shown in a less than ideal manner as acceptable. This hurts experimentation. Good luck trying anything similar to GDPR when all nodes are design & required to duplicate all messages & attachments for all users to every server anyone in it comes from.
The only real gotcha is the same gotcha as Matrix when using multiple clients with double-ratchet encryption (ala Signal) is that clients will expire keys that haven’t been seen in a while & is hard to get both devices retrusting one another. Turning it off & on again rarely works & requires fiddling on both ends sometimes. I really should just use PGP for encryption more often…
The problem is that iPhone has some weird shit about push notifications and none of the high security XMPP clients I have tried seem to support them.
XMPP doesn’t need notifications per se since it already has a connection to the client. Since it works for all other OSs to hook into this & display a notification, I don’t even want to know what restrictions Apple has on iOS that prevent such basic behavior. Apple digs its own grave here. What’s worse is I want to say “go get a Android phone, dummy” to a ‘normie’ but the stock OS on any Android phone is going to be on aggregate a worse privacy situation unless you would have to be ready to teach how to unGoogle it to the extent they would tolerate.
Linux phone when?
I didn't say I don't like Signal, Matrix or anything else. I just provided links to accompany my question.
DeltaChat. I don't use it myself because it's built on electron (which basically excludes 99% of modern chat clients); but as it's technically an email client turned into a chat client, we can assume you're protected by PGP when writing to most users, and with the added effect of not needing to convince anyone to install anything since from their end it's just an email.
protected by PGP
Someone here recently linked to this gem https://www.latacora.com/blog/2019/07/16/the-pgp-problem/
The article warns PGP over Email is a safety concern. They suggest Signal instead. (And several other tools to replace PGP)
PGP is unfortunately one of the only reliable ways to get encrypted messages into and out of China. Most of that article is kind of nitpicking IMO. The only major cryptographic issue is lack of forward security. The rest can be dealt with if you have a bit of know how.
Sure, I see where you are coming from. I used to be in favor of PGP as well, but I think I just was conditioned to it because it was everywhere, eg Linux repositories. The argument I found more convincing in this article is that PGP is a swiss-army knife. You might want to use it in an emergency, but professionals have special tools for each different task. In fact, the article suggests very nice alternatives for each task: Encrypt with age , sign with minisign. Two different tasks, two different tools, no need for a web of trust. Just for the arguments sake why do you think that PGP is worth it given the burden of entry?
Kind of limited due to there not being an iOS version, but Briar is pretty decent. It was made to be usable in repressive areas by press and other groups, as well as in areas where bad weather has taken out cell and regular wifi. Can be used with phone data, but also offline via ad-hoc wifi and bluetooth. But stuff like Signal and SimpleX are more overall useful to more people (and I think SimpleX also supports offline local immediate area of each other like wifi and bluetooth but I don't remember atm).
The SimpleX battery drain issue does not affect everyone. At least for me, it has been perfectly fine.
