this post was submitted on 07 Jun 2024
51 points (100.0% liked)

Privacy

789 readers
3 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
 

Cross-posted from : https://lemmy.ml/post/16566616

Hi, I wanna know what is the most secure and best messaging app/platform... Need an app that is crossplatform and has a very good numbers of features and security. (And it has to be FLOSS) I thought about XMPP clients, Signal, Session, IRC clients.. Propose and explain me your choice

top 39 comments
sorted by: hot top controversial new old
[–] mox@lemmy.sdf.org 16 points 5 months ago* (last edited 5 months ago) (4 children)

There is no best, because none of them cover every use case or threat model. However, these are worth considering:

  • Matrix, if you don't mind minor meta-data leaks (reactions and avatars have not yet been moved to the encrypted channel, IIRC).
  • XMPP with OMEMO, if all your contacts are technically skilled enough to manage the requisite clients, servers, and protocol extensions, or if they have a skilled admin to do it for them.
  • Signal, if you don't mind linking a phone number to your account, can tolerate an ecosystem effectively married to Google, and accept the risks of a centralized service that can be attacked or shut down by someone with the right access or influence.

In situations where your safety depends on anonymity from the powerful or well-connected, I would instead look for a messaging system tailored for such things. (It would, of course, require giving up some convenient features that most of us expect from a general-purpose chat platform.)

[–] smileyhead@discuss.tchncs.de 11 points 5 months ago

reactions and avatars have not yet been moved to the encrypted channel

Fortunetly there is ongoing work to do that. Still admin sees who you are talking to, but there is some effort.

[–] GravitySpoiled@lemmy.ml 5 points 5 months ago (1 children)
[–] toastal@lemmy.ml 1 points 5 months ago

Even with the UnifiedPush fork from F-Droid where you can avoid the Play Store & FSM notifications, you are still shackled to Android which isn’t a long-term solution with Google ultimately at the helm.

[–] Blizzard@lemmy.zip 2 points 5 months ago (2 children)

I think Signal dropped the phone number requirement, didn't they?

[–] BlueKey@kbin.run 10 points 5 months ago (1 children)

As far as I know you still need a phone number to create an account. But for connecting you can use the new usernames (and make sure to disable automatic number sharing with contacts in the settings).

[–] foremanguy92_@lemmy.ml 1 points 5 months ago
[–] jjlinux@lemmy.ml 3 points 5 months ago

Now you're able to hide your number at different levels, but it still requires you to use a phone number to sign up and use.

[–] foremanguy92_@lemmy.ml 2 points 5 months ago (1 children)

In fact you could say that for now XMPP is the best in your opinion, but a bit technical?

[–] mox@lemmy.sdf.org 4 points 5 months ago (2 children)

No, I would not say that.

I used XMPP in the past, but long-lived public server support is almost nonexistent these days, and proper setup/maintenance requires too much tech skill for the general public. Also, it lacks modern features that many people have come to expect. I would only suggest it for small groups, and only if you can run your own server and provide tech support.

For my needs, Matrix is the best available today. It covers the things that I find most important, and is constantly improving.

[–] poVoq@slrpnk.net 5 points 5 months ago* (last edited 5 months ago)

but long-lived public server support is almost nonexistent these days

Uhm, that is untrue, especially compared to Matrix where multiple public servers recently had to shut down because of excessive server resource use.

But yes, like in any healthy federation it is better to run your own XMPP server.

[–] toastal@lemmy.ml 1 points 5 months ago* (last edited 5 months ago)

For beginner self-hosters Snikket’s guide is even less work than others, but ejabberd/Prosody are easy to setup up compared to most software. General public is generally out at needing their own server even if the system requirements for XMPP incredibly minimal & many would have access to hosting at home on the cheap with dynamic DNS & basically anything with a processor + a Linux distro.

Not sure what the modern feature support you are talking about tho. Some clients already have stickers, reactions, threading… but the ‘X’ is for ‘extensible’ so it is all meant to be optional on purpose so it is easier to implement clients & democracy wins on features that clients decide are worthwhile to uptake (at least now that Google is out of the picture dictating too much)--& you have community-ran compliance suites for server features like the one for Conversations. Having used a couple of Matrix clients that aren’t Element, the fragmentation of client feature support is literally just as bad--except there is a lot less maturity due to age.

[–] arran4@aussie.zone 14 points 5 months ago

Where your friends are?

[–] cyrus@sopuli.xyz 12 points 5 months ago (1 children)

SimpleX is quite a promising project, uses Double Ratchet End-to-End-Encryption (from Signal), and has a very interesting protocol and model to provide quite strong metadata protection, especially in regards to whom you talk to and groups you're in.

If your threat model requires exceptionally strong Metadata protection, SimpleX is probably going to be your go-to

Though, for a more lenient threat model, where still good, but less laser-focused metadata protection is enough, Signal will probably do just fine.

Personally I use Signal, but I also have a SimpleX Profile, an XMPP Account and Matrix. (preferred in that order)

[–] foremanguy92_@lemmy.ml 1 points 5 months ago
[–] Charger8232@lemmy.ml 9 points 5 months ago (3 children)

This spreadsheet is a very helpful comparison of the different messaging apps. I've been using SimpleX for quite some time now, and the only issue I have is some lag on the iOS client.

[–] Lemongrab@lemmy.one 4 points 5 months ago* (last edited 5 months ago) (1 children)
[–] toastal@lemmy.ml 1 points 5 months ago

Use on multiple devices (in addition to mobile device)

Anything that isn’t green here is a ‘no’. The amount of service requiring mobile devices is absurd. I would hope many of us would love to make the jump out of the Apple/Google duopoly at some point if not already, & these sort of lock-ins should be avoided if you put even two thoughts into the future.

[–] foremanguy92_@lemmy.ml 1 points 5 months ago
[–] jafffacakelemmy@fedia.io 1 points 5 months ago

the spreasheet is really good, but rcs is not there - i'd love to know how that compares.

[–] GolfNovemberUniform@lemmy.ml 7 points 5 months ago (1 children)

You need to understand your threat model. Some apps are very secure but extremely inconvenient and hard to use. Others are more convenient but may not be able to hide the fact of a conversation between certain users for example

[–] foremanguy92_@lemmy.ml 2 points 5 months ago (1 children)

If I want convenience for now I would use Signal or maybe Session, but here I want the (almost) most secure thing that I could get

[–] umami_wasbi@lemmy.ml 3 points 5 months ago* (last edited 5 months ago) (1 children)

There is always a cost to security. How much you and your recipent ready to pay?

And, what you mean by "secure"? E2EE is basic. How about meta data? Or resilient to DPI? How about correlation attacks? Then the directory server. And the operator of the server. Where they located can be a factor too.

There can be a milion factors that can contribute to security. You can have it all but I don't know if such thing exist or not. For each factor, you gain some security but loss some in other places. You need to pick and choose what you need.

[–] foremanguy92_@lemmy.ml 2 points 5 months ago (1 children)

I wanna get something that could be tweaked like changing the encryption... Something really customizable, maybe running my XMPP server

[–] umami_wasbi@lemmy.ml 6 points 5 months ago* (last edited 5 months ago) (1 children)

So you want self hosted? And what you mean by changing the encryption? Changing the encryption protocol and encryption algorithm are two different thing. OMEMO is kind of de facto for XMPP. Last I checked it seems doesn't let you choose the cipher suite like TLS 1.2 does. You can spin another if you have the capability to do so but not recommend.

And whatelse you want to tweek?

EDIT: typo

[–] foremanguy92_@lemmy.ml 1 points 5 months ago (1 children)

That would be cool to have a messaging app that let me change almost what I want like the encryption protocol, changing the encryption keys... And so on, don't know if it's possible

[–] umami_wasbi@lemmy.ml 2 points 5 months ago* (last edited 5 months ago)

Key? Oh, welcome to the land of GPG/OTP where platform and protocol doesn't matter. Good luck finding a friend willing to deal with this just to talk to you though. And loose some important security features like forward secrecy and double ratchet.

[–] smileyhead@discuss.tchncs.de 6 points 5 months ago

There is no one best, as we wish there would be. Depends what you want.

XMPP and Matrix are definetly the most based ones, because you are not tying yourself to one particular app and server, they're the common languages. And this is what I would want to use for mass communication and as a base, default.

Signal is nice if those above are not enough developed yet for you. Easy to switch friends into and discover contacts with it's phonebook based nature. But there is no open API for thrid-party apps, only reverse engineering from open source code.
If you don't need calls Matrix has a bridge so you can use both at the same time.

There are also the most anonymous ones, like Briar, SimpleX or Session, there is a lot of them. For me their usage is when two or more people want really private chat and both agree on the app. I really can't and don't want to see them as the default.

[–] sic_semper_tyrannis@lemmy.today 5 points 5 months ago

"Best" is subjective. I like Signal because it has a great modern UI so I can pretty easily get non techy/privacy people using it.

[–] crispy_kilt@feddit.de 5 points 5 months ago* (last edited 5 months ago) (1 children)

I'd go with Signal or Threema

Signal: Best data protection. They are on a different level from anyone else. They even reimplemented gif search through their app so it can be anonymised (instead of the data-collecting gif search in your keyboard). Just an example, they really try. Also has a desktop app that doesn't need the mobile app to be running. Downsides are google dependency (for push notifications - but they're empty, the encrypted data does never even touch google) and required linking to phone numbers. They do have usernames now so you don't have to give out your phone number to talk to someone. Behind it is an US based non profit - whether that is a downside everyone can decide for themselves.

Threema: No need for phone number, not even a credit card, you can buy it anonymously through their website. No google services required. Swiss based company, so much better laws than USA. Finance themselves through the one time fee of 2 USD and through their corporate offers, no nags for donations, no selling of data. Downsides are server code is not open source, and their protocol is less good than Signals, but still reasonably secure. They're working on a new one though. Also no independent desktop app yet (also working on it).

[–] foremanguy92_@lemmy.ml 2 points 5 months ago

Would maybe choose Signal for its simplicity but I do not would like to use threema, it is a bit too related to his company, rather prefer simplex as example

[–] onlinepersona@programming.dev 5 points 5 months ago (1 children)

What is it you're looking for actually? "Best" is subjective to the person's needs.

For example for me, the best is signal but I would much rather use something decentralised that still allows friends and family to find me easily using my phone number. Stories / client defined groups without notifications are also very useful to me. Also a native desktop app (aka not a locked down browser running some local webpage) would be awesome. But such an app doesn't exist yet.

What would you need and prefer?

Anti Commercial-AI license

[–] foremanguy92_@lemmy.ml 1 points 5 months ago (1 children)

Would like to have something with a strong encryption and good capability of tweaking

[–] onlinepersona@programming.dev 3 points 5 months ago
[–] thegreekgeek@midwest.social 3 points 5 months ago (1 children)

Delta Chat is quite good, it's an email client thats built like a messenger app. It's E2EE with Autocrypt lvl 1, you can use it with most email services, and they have a self hostable/hosted "chatmail" service that you can also use if regular email services are slowing down the messages (gmail isn't the best for this). It also supports apps and games in chat using the webXDC standard.

[–] toastal@lemmy.ml 1 points 5 months ago

Webxdc is pretty neat. Cheogram & Monocles clients also support it on Android.

[–] Zerush@lemmy.ml 3 points 5 months ago* (last edited 5 months ago) (1 children)

The other day I found this, using an very old inbuild command line tool in Windows, Mac and Unix: finger

https://happynetbox.com

Write for Example

finger zerush@happynetbox.com

in the command line

[–] LodeMike@lemmy.today 2 points 5 months ago (1 children)

Do you finger your friends?

[–] Zerush@lemmy.ml 2 points 5 months ago

Not until now, I discovered it only some days ago. I think it's an interesting methode to send Messages ocassionaly, but not so practically in the daily use.