Chat Apps, Government Ties, and Transparency – Threema
(threema.ch)
from Star@sopuli.xyz to privacy@lemmy.ml on 13 May 2024 20:22
https://sopuli.xyz/post/12597670
from Star@sopuli.xyz to privacy@lemmy.ml on 13 May 2024 20:22
https://sopuli.xyz/post/12597670
#privacy
threaded - newest
Let’s be honest, Signal is not perfect either:
(UPD: It was funded by CIA)
(UPD2: Here I will quote www.securemessagingapps.com:
((UPD)Source: androidpolice.com/…/it-looks-like-signal-isnt-as-…)
(I’m gonna find sources for the last two statements a bit later to not be unsubstantiated)Done.
Although, we all can agree, that Signal is still better than Telegram, or WhatsApp, or Threema, or whatever.
Still, we probably want to look at the better alternatives, like Simplex or Session.
Session is also sus because you effectively cannot host a node, last I have seen. They claim it is “against a Sybil attack” but all it does is making sure only people wih large disposable funds can have nodes, and the effect might be the exact opposite.
Simplex is more interesting in this regard because while I am concerned with initial centralization (the default servers), they made hosting your own easy. But I personally stick with imperfect yet trusty XMPP.
SimpleX is great. BUT it’s not user friendly. Thus general adoption for the average user will be hard. Don’t get me wrong using the app itself is easy but as soon as someone switches their phone that doesn’t have technical knowledge they will loose their chats because they won’t understand the concept of moving their DB. Since you don’t have an identifier like a phone number with SimpleX those people could even lose contacts as a whole since they generate a new DB, hurting their social connections.
That’s the reason I personally never recommend SimpleX to anyone who doesn’t have the technical knowledge to understand stuff like that.
I can’t believe people are saying Telegram and Threema might be better than Signal. Signal isn’t perfect but Telegram and Threema are worse.
Signal is not applicable when you need a public space for people to just have a discussion, like in discord. Signal clients are clunky and rely on cross sync from what I see, while telegram clients are well made and convenient to use. Even Whatsapp went away from electron so I’d choose it over signal any day.
Obviously you have never used Element for matrix. Signal is like a Ferrari in comparison.
Yeah I’ve never used matrix really.
how has no one discussed matrix here
I don’t get it at all. There are plenty of platforms like matrix, xmpp, simplex that don’t require phone numbers tied to your identity. Signal has somehow managed to convince people that it’s a private platform, despite it being a US hosted service that requires phone numbers.
Who have they convinced that it is private? I think it has more to do with the overall purpose of the platform. Signal is not made for large group chatting with strangers like Matrix… apples to oranges IMO.
I use Matrix for my personal 1 on 1 chats with family and friends, so dunno
It’s a Google hosted service, which is arguably worse because they may as well be a nation-state unto themselves.
And the largest homeserver, matrix.org, is MITM’d by Crimeflare.
Fuck matrix.org, just selfhost.
Any homeserver that federates (even indirectly) with matrix.org will still have practically all the same data shared with it, just not your password.
What passwords where?
The password used to login to the homeserver
Doable, but a huge pain in the ass because of conflicts in the protocol. I spent about a year trying to suss them out and come up with a fix but never figured it out.
Say the US government, in a worst-case scenario in which it constantly monitors all traffic that goes through Signal’s data centers, can ‘only’ see phone numbers, IP addresses and timestamps, right? Or am I forgetting something here?
Metadata and social graphs are more important than message content, esp since not many people have the time to read through individual messages to build meaning.
Signal stores phone numbers (meaning your identity, and home address), and message timestamps: who texted who and when, and who’s in chats with who else. More than enough to build social graphs and connections, and also figure out where people are through their IP addresses.
Signal can’t see who is texting who. They can’t see which groups you are part of. Those information are end to end encrypted, same as your chats itself, your profile picture, your stories, etc.
Signal doesn’t store message timestamps either.
What Signal itself knows of you is your phone number, the timestamp of your registration, the timestamp of your last connection to the server. That’s it.
Yes metadata is critical but Signal handles metadata very well. Indeed, even though I’m a fan of Matrix, better than Matrix. Matrix is a metadata nightmare due to it’s centralized structure and the way the protocol works.
This is completely false. They can absolutely see who is texting who, in fact they need it to be able to route messages. They have message timestamps, and phone numbers stored in their database.
Question, why do you “trust” signal? You can’t see what code their centralized server is running, unlike matrix which you can self-host and build from source. You don’t have to “trust” matrix, you can verify it for yourself.
Signals server is open source. You can run a server. You just can’t connect to the main net because each server is it’s own thing so it doesn’t make sense besides for development purposes.
Please don’t spread misinformation.
They went over a year without publishing their server updates. And how do you know signal is running the code they say they are? Do you trust them?
The good thing here is that you don’t need to trust the server in order to have a secure communication since your clients decrypt and encrypt and not the server.
Yes they can optimize with things like this but that doesn’t make it insecure. It’s still the most secure solution that the average person can use.
Threema doesn’t even have the server open sourced at all, are for profit and their encryption has been compromised.
Session is shady.
Matrix is a metadata nightmare due to it’s federated aspects.
SimpleX is the only thing that is secure, anonymous and good in this regards but it has some small details left that prevents people from switching. I.e. simple things like the fact that you can’t see an overview of your images and videos sent in a chat without scrolling up all those messages. It seems trivial but for the average user stuff like that is important since they know it and use it every day in other messengers.
Do you happen to know what metadata matrix stores? I assume matrix.org specifically stores email and username, right
Yes, but I don’t think user metadata outside of your apub url, name, icon, display name, leaves your homeserver. Email or passwords don’t leave iirc.
The server / backend is not open source. Even though it’s audited that’s a red flag.
‘Open source’ misses the point of libre software.
I use Signal as my main daily messenger the two major problems in my opinion are: