from TurkeyDurkey@piefed.world to privacy@lemmy.ml on 12 Oct 21:51
https://piefed.world/post/546029
Over the past few years I have gone through a bunch of different apps and protocols to find the best one for “securely” communicating with my family and friends.
I ended up with the amazing XMPP protocol and my family/friends frequently use its clients to contact me.
Monal for IOS and Cheogram/Conversations/Quicksy for Android. The android app I install depends on if I can get F-Droid on their phone or not.
It’s been great with OMEMO encryption and the clients/apps available for XMPP. But sometimes I have issues introducing people to it.
Jabber (friendly name for xmpp) sounds silly to say. The clients all have weird names. And after trying the Signal mobile app it feels more focused than what anyone in the XMPP community has whipped up.
But the capabilities of XMPP makes it better.
Signal Cons (immediete)
- Centralized
- Single app
- Phone numbers
XMPP/Jabber Cons
- Picking server
- Apps are sort of less friendly
What really scares me about Signal is the centralization. Any nerd can easily host an XMPP server these days. But Signal from what I’ve heard really wants us to use their server.
If XMPP gets more attention I’m sure we can get people supporting projects and creating better apps.
I keep seeing people recommended Signal instead.
This is a bit of a tired ramble. What I wanna know is why anyone is preferring Signal over XMPP apps. I assume it might be not knowing about it. Tell me what you use to message people.
threaded - newest
Signal is the best intersection of genuine security and ease-of-use that I’ve ever seen. No choosing a server, no making an account. Just install the app, get a confirmation SMS, and now you can communicate with future-proof encryption and authentication right away.
For more technical people, who aren’t going to be intimidated by things like making accounts and secure passwords and choosing servers, Signal is not the best. But when I need to communicate securely with non-technical people, it’s a wonderful quick go-to solution.
With some spit and polish, I think that SimpleX could actually be very similar in that regard.
Its even simpler and more secure and privacy friendly. But the battery usage…
I have not noticed it causing a significant hit to my battery usage, but maybe I just am lucky or something.
In how many larger groups are you and which notification style do you use?
I’m in two large groups and quite a number of smaller ones.
For the most part, I have notifications muted on most things, except for a couple of very small groups that don’t get chats often.
I’m not sure exactly what notification style I’m using because I can’t remember, but I do know that I do not have Google Play Services or Google Apps of any sort.
I wouldn’t recommend simplex just yet because contacts are tied to servers. If the server you are using with a contact for down, you lose the contract
Signal & Conversations (XMPP). Apparently the move from WA to Signal seems easier for most of my bubble. Can’t understand why.
You can’t understand why? Are you incapable of evaluating a user experience?
Care to explain, kind person? What’s so different between Signal and WA that a user could not find their way? Enlighten me.
For start, search xmpp on the app store and notice how the first result is a paid app that costs $8 and isn’t clear whether or not it will connect you to your friends.
Well I seached for “jabber” and found Trillian as fourth or so hit. Dunno how good it’s on Apple, but I seem to remember using a PC build somewhen with no negative memories. It’s free. Your concerns till now seem like rambling. Or general, as in: How do I make people leave WA, which is, admittedly, complicated.
edit: Double word deleted
You cant make anyone do anything, you can entice them over.
To do that they need to be simple and easy to use, what you’re describing is already more complicated than downloading signal or WhatsApp, signing up, and starting.
Was that too many words for you or what?
Use this thing called empathy and try and imagine how a non-tech nerd thinks. If you lack the capability of empathy, then you’re never going to get a satisfying answer.v
I used xmpp with otr encryption… maybe also omemo, it rings a bell. This was some years ago. But it was barely usable. Otr refused to connect at times and only unecrypted worked, messages were encrypted with wrong keys or something and history became unreadable. It worked on the desktop, but then not on the phone, only with this and that client, but not those. It was a confusing mess and I had to stop using it. If it works today, thats great.
Android’s bullshit made me quit XMPP. We needed instant messages to be instant but Android kept making that harder and harder until it was impossible.
With Signal we’re still fighting but it works a little bit better due to integration with the messenger service or whatever it’s called. Dunno, maybe XMPP can work with that as well by now.
Sigh, I want my Linux phone where I can control battery life vs availability myself.
I’m not going to push anyone who uses a secure decentralized FOSS chat already to signal, but someone who uses telegram/viber/whatsapp is easier to get gradually on signal, which is super low effort compared to the ones you mentioned.
I’ve tried. I’m happy that I got friends and family to move from SMS and WhatsApp to Signal. Some I got to move to e.g. matrix but that’s only a few.
Just my two cents since you asked. I agree with you but I don’t want perfect to be the enemy of good.
Why is your name red
It means they are your god and you should bow. (they’re an admin on your instance)
Ah… But there is another. The all mighty creator (app developer of voyager) whose name is in purple!
Ohh cool :)
I’m guessing you are using Voyager app. It’s because I’m your instance (sopuli) admin :)
Because the most useful communication apps are the ones that you can reach people on. XMPP’s lack of user friendly UX or long term support and commitment make it DOA for most normal people, which in turn makes it DOA for everyone who might want to talk to one of those normal people who are turned off by it.
There’s nothing wrong with Signal’s centralization model in a worrying sense. It acts only as a clueless message relay, and it has near-zero information on any of its users, even as it delivers messages from person to person. The only information Signal knows is if a phone number is registered and the last time it connected to the server. There is great care taken to make sure everything else is completely end-to-end encrypted and unknowable, even by subpoena.
The only real issue with Signal’s centralization is that if Signal the company goes down, then all clients can no longer work until someone stands up a new server to act as a relay again. Signal isn’t the endgame of privacy, but it’s the best we have right now for a lot of usecases, and it’s the only one I’ve had any luck converting normies to as it’s very polished and has a lot of features. IMO, by the time the central Signal server turns into an actual problem we’ll hopefully have excellent options available to migrate to.
Also TMK, the only reason you still need a phone number for Signal is to combat spam. You can disable your phone number being shown to anyone else in the app and only use temporary invite codes to connect with people, so I don’t count the phone number as a huge problem, though the requirement does still annoy me as it makes having multiple accounts more difficult and asserts a certain level of privilege.
I like signal but they do probably know who you talk to, when you talk to them, your IP, their IP, and size of your messages. The fact that they are pretending they can’t get this info with just server side changes worries me
Check their transparency log for subpoenas etc: https://signal.org/bigbrother/
Are they legally required to publish that?
No, and in fact they have fought to unseal and publish the articles they have. The point is that if you read the subpoenas, they request a lot of data from Signal and Signal can only ever return the phone number, account creation date, and last connected timestamp. So either Signal is consistently lying to various governments or they actually don't have any of that data. Signal's client is also open-source and has been audited, and they have published many blogposts about how the technology works.
I'd strongly recommend digging deeper into this and trusting the auditors and experts instead of dismissing it based on lazy and cynical guesses. If you don't trust anyone you're welcome to read the source code of the client yourself. Soatok recently posted an 8-part series going through Signal's encryption that you can read as a primer: https://soatok.blog/2025/02/18/reviewing-the-cryptography-used-by-signal/.
Since they are not required to publish these they could be publishing only the ones that make them look good. You might also notice that they haven’t published any for over a year. I know how siglan works and I trust the client and the security. I even recommend it. But let’s not pretend they are INCAPABLE of building your social graph
Since you’ve clearly not read or comprehended any of the subpoenas that I linked, nor the encryption analysis, nor read any of Signal’s blogposts, I see no point with responding any further. You are spreading FUD, and I question your motives.
I’m not the one that is not listening. I don’t care about the ones they post. I care about the ones they don’t. I trust they client code. I don’t trust ANYONES server side code. Their encryption is top of the line and an industry standard. But is DOES NOT hide your IP, the time of the day you send messages
ONCE AGAIN (this is the third time I’m saying this) I like and recommend signal. I have no evil motives nor I’m trying to be paranoid. But let’s not pretend they are perfect.
If you are hurt because I said mean things about a company you base your personality on, that is not my problem.
From the blog you provided. Next time. Read your sources
And
Edit: removed the word “moron”. I’m not a native English speaker and I thought it meant something else. It seems its like “retard” which I wouldn’t use as an insult. I’ve used it so much…
Note that Signal is not a company, it’s an NGO. Would you say that Wikipedia is at risk of disappearing because it’s centralized?
Yep, I forgot it's not a company. The point stands though; someone has to pay for the servers and administration, and if they run out of money or the foundation falls apart, then the problem happens in the same way. I don't know much about Wikipedia's structure, but I would guess it's a similar situation in terms of needing money to stay running and also being able to be salvaged by the community if it does go down.
Signal is really simple and has a sizable userbase now. I’ve worked with people in non-tech companies and they’ll have signal installed because theres someone in management that cares for security to a degree and does official nonofficial team communication with signal
Element/Matrix I think has a chance. The newest Element X app looks a lot better on the phone and on desktop. It’s progressing to good user experience
I’ve used XMPP since shortly after it was developed. I still use it today.
HOWEVER, while the clients are relatively good, as long as they support the extensions you want to use, I’ve found maintaining the server to be a royal headache. Between protocol and extension improvements, security updates and general server instability, I find that it’s a constant struggle to have it running and compatible with whatever client someone is using, when someone actually uses it.
Signal, on the other hand, pretty much always works, has a single client, and nobody has to worry about managing the server except Signal. So as infrastructure, it makes a lot more sense.
I use Telegram. Eek? It’s just my wife and I though. All these things I’ve heard about Telegram? Never actually seen them in mine. I have looked at groups, but I’ve only seen memes, crypto crap, and what look like scams (“post this in 5 Reddit threads to get invited to the actual group”). There’s nothing of value out there that I’ve seen. So I just use it to message my wife, because texting wasn’t good enough when we started using it (both our phones have RCS now) and I don’t use Facebook, and she doesn’t have an iPhone (so, no iMessage).
I completely reject this notion that you have to pick one and stay with it. My messaging apps include iMessage, Session, Signal, and Telegram. I also have a fork of Telegram that lets me use it from my watch (as in, it has a watch companion; official Telegram does not). I also have Discord (need it for a couple things).
I totally agree with you. But!
Signal doesn’t have their own servers. Instead, they rent servers from 4 companies, 3 of them is Google, Amazon, and Microsoft. So Signal is relying on Big Tech and if Big Tech decides that enough is enough, they can easily shut Signal down.
THAT is what I find most terrifying. And why not use their own server? Not enough money, but they are working on it (good).
And to make it a little bit worst: Signal depends on a third party company for sending out SMS. Your phone number is therefore handled by not Signal, but by yet another company, highly likey an American company. And they are against privacy invading companies at the same time they are one. Oh, the irony.
You want sources? Sure.
Don’t get me wrong, I absolutely love the idea of Signal. But there is flaws that makes Signal more privacy invading than privacy friendly.
That's the part that makes me nervous. If I get a bunch of people locked on Signal, then they take away services or change how they run the servers, then it would be a hassle to move people to a completely new interface.
Yeah. Let say Signal goes down because of Big Tech and lets say that 50% of their users use Signal as their only messaging app. What will happen then? Hysteria!
No, XMPP all the way for me until Signal becomes decentralized with zero external connections and when they also have removed the phone number requirement.
If the worst part about Signal is having a third party send you an SMS to confirm your phone number then that’s amazing.
Nobody would host a worldwide instant messaging (including a lot of data such as video) on its own servers. That would be incredibly costly and inefficient. Designing for E2E (nothing critical happening on the server) is the way to go.
Because it’s nearly impossible to convince friends and family to use anything other than iMessage or “the text app” on their phone. The process you’ve described is basically akin to swimming the English Channel for the general public. I’d do it. But expecting anyone else to is just a pipe dream.
I’m already a social outcast and second class citizen for not using imessage. Asking my friends and family to install a whole separate app just to communicate with me puts me firmly in weirdo territory.
It can be tough trying to stick to good privacy and staying social. I can do it because I've set boundaries and have a passion for what I believe in.
If somebosy actually wants to contact me, they join a privacy friendly platform, or just take my email. Most people my generation do not use email for instant communication, and neither do I.
I've gotten myself to be someone people want to reach out to, almost entirely in an effort to promote/market FOSS. To be a likable, knowledgeable, and friendly resource. That's how I managed to convert a lot of people. If I say anymore I really bet I could be identified from my post. 😆
Tough pursuits will never be a pipe dream. It just takes enough time and grit. And a little mojo.
Use simplex. Funny the cons you named about signal, people were arguing with me about a few days ago. (Phone numbers aren’t good for privacy)
It does suck if you do a lot of filesharing, since files only stay in the servers for 2 days
We should definetly not make it a habit to store files for long on volunteer servers. :(
XMPP also supports federation, or server-to-server communication, but it’s whitelist based from my cursory read
Such a benefit indeed. Like email, you can use any server and app. Except it has more instant messenging features.
If I could get a single person to use Signal instead of Whatsapp… or even the nerds I know to use matrix instead of Discord…
There two kinds of nerds. Ones that are actually curious to try new things, and ones that conform and sully the name. It's like tech bros vs real IT professionals.
I think the slightly more charitable division is “nerds who want to work on the tool” vs “nerds who want to use the tool to work on something else”
Some people want their discord chat to work with little effort or errors because what they’re actually interested in is some video editor, or something. And if the chat is broken, it prevents then from getting to what they really want.
I personally use XMPP, so this isn’t just to clear my own name, or anything.
Against XMPP+OMEMO
Signal is a much better recommendation when leaving Telegram. And the OMEMO implementation concerns are something I need to consider. That unprofessional response from one of the devs is not a good look at all.
Though as a comment pointed out, control of servers is like the one main checkbox that I really need filled.
On the point about clients not being OMEMO by default or enforced. This isn't the biggest issue for me. I'm not doing crimes, but I still wouldn't want my saucy messages to be read by server admins or third parties. Whenever I message somebody, I confirm that they are the proper recipient and are using OMEMO. And the clients I found myself comfortable with all support PGP key use instead. (That would be Cheogram & Gajim if anyone was interested.)
This was a great read though, at least to me. It gave me some thoughts to consider.
I'm gonna look into what kind of threats these improper dependency versions and such might pose. Hopefully by now most of these issues have been resolved.
The biggest thing is getting people into the loop of "secure apps" before they really need it.
I’ll be honest, most of the crypto/security jargon flies straight over my head, but Tim Henkes’ reply at the end, for fucks’ sake man. I don’t suppose xmpp has an alternative encryption to use instead of omemo?
Pretty much any encryption you can send over text. My favorite clients support PGP instead. But it's up to the clients to implement envryption and not really the protocol I guess.
I think this post is a noteworthy response.
Against Silos+Signal
Noteworthy perhaps, but one is based on analysis of facts and the other is based on principle. I think they’re both valuable points of view, but they’re not actually debating the same points IMO even if they think they are.
First of all, thank you for your recommendation. I was on the fence between Siskin IM and Monal, so I went with Monal to replace AstraChat.
I’ve used Signal before and it was fine but I prefer not to give a phone number to open an account; there are other services that don’t require it.
Speaking of services, I use Simple X, Session, Matrix and Delta Chat (occasionally). Most of my eccentric mix of family, friends and colleagues are happy to try something new or switch as long as it doesn’t require a phone number to sign up. They’re slowly leaving Signal, WhatsApp, Telegram and limiting access to their iMessage.
In my experience, Session syncs very well between my devices which makes it my favorite. I chose FluffyChat over Element because of the App Privacy in iOS.
Speaking of wacky whole in the wall messagers!
reticulum.network
Its tectonically a network stack but theres a few apps, to use it. And MAAAN is it decentralized
to answer your question - if you wanna eventually talk to normies. like cute boy/girl you meet at a bar or a business contact from a random meet. even Signal has dogshit penetration compared to the big players, so XMPP/Matrix/Briar/etc aren’t even a blip on the dradis.
also, you sorta sidestepped the UX. if you’re coming off the hyper-polished world of Telelgram and iMessage, all those things have dogshit UX. yes, you’ll eventually find your way around them but you have to be motivated to endure them ugly and slow and unrealiable apps (comparatively speaking); you got that shit covered, your contacts do not.
the situation is kinda like with The Linux Desktop - it’s competing with gargantuan corpos with unlimited resources, and to add to that the miniscule dev teams aren’t working together, they’re competing, pulling in different direction (Gnome, Plasma, Cinnamon, etc.) with duplicated efforts and tons of abandoned paths. can you imagine where we’d be if all that dev effort went towards one goal?
same thing with the messenger space, it’s doubtful any of them will become mainstream, but they have their uses.
Wrong, XMPP is the only option that actually lets you talk to baddies on their phone number without them downloading a new app just for you. Aside from some kind of tortured solution such as AirMessage/BlueBubbles involving buying a literal Macbook.
.
Cheogram offers a phone gateway. They don’t even know they are using XMPP.
.
Matterbridge works with some of those, but I doubt anyone wants to talk to a relay bot. Just directly get people’s real phone numbers and run the Insta from your home PC in browser. All of those apps are cancer and even in a separate profile on Graphene or some shit, I would feel like a dirty bastard.
Oh, since you mentioned Telegram, I ought to mention that it’s totally possible to puppeteer your account on there so it looks just like you are using the real app. If a lady asked me to use TG or Signal I would unironically assume she knows drug dealers 😭
.
Yeah if you want to use Signal and TG, Molly and AyuGram are a bit better than stock FYI
.
None whatsoever sorry. I got made fun of as a Westoid for mentioning Whatsapp though, apparently the cool kids are on Viber now.
.
100% it is aggravating that I cannot make something as simple as a chat relay on the mighty computer. It is the work of depraved individuals
We still probably show up as green bubbles though. Might have given the baddies the ick.
Not a real thing, you just have high bodyfat and poor eye contact skills. Hope this helps
Just an unrelenting FOSS agenda and weird aversion towards social media 😭
If you avoid technical stuff a lot of people are pretty understanding of not having socials. Instagrsm ks HITLER NOW! Everyone jokes abt it. Way I do it is I just post hiking photos on Insta and other stuff. In order to avoid booting it up yourself, it can be automated with IFTTT (proprietary but so are the datamining services you use it to reach so who care??). Problem is being responsive to notifs but I just check half of them every other day so people don’t think you died and hit like
Yeah people have been talking (real life) about their breaks from it and thoughts on leaving the social media sludge whenever I say I don't use that stuff. It's refreshing, but I still reject sharing my number except for work and maybe a baddie every now and then. Wish I didn't even need to pay for one even for how cheap it is.
I try to get people to add me on musicbrainz and link up music services to it. It’s cool bc you can funnel music player program listens, funkwhale (which is activitypub!), scloud, spotify, yt music, apple, all of their ʜᴏᴛ ɢᴀʀʙᴀɢᴇ right, but it still works with open source shit. It can absorb lastfm which a lot of ppl have hanging around. None of this solves the reality of being at an information disadvantage vs someone who plays weird games with IG likes. But are people like that worth the stress anyways??
But if you get each other’s music recs and can dm realistically what else do you need? Am i boring? Lol
Right? Although I'd love to communicate with everybody in my community and be reachable on the ready, do I really want to give up my values for people who don't care to understand them? If you wanna contact me outside of face to face, then use what I use. And it goes for the other way around too. Not worth the stress.
You know if Movim really takes off I admit that would be amazing because it’s like a hardened facebook. Public photo albums are important to people
Any good mobile apps? I'd love to have a place to share updates with my friends like social media does. Integrated with XMPP makes it all the better I'd say.
They’re just in browser at the moment, but it’s very flexible since you can login to instances with XMPP accounts elsewhere. It’s under pretty active development although TBQH I find the Povoq guy difficult 😂
Many people will tell you you have to sacrifice your principles because interface, because “normies” (which is an elitist way of telling you that non-elitist people are idiots…), etc. I say: stick to your dreams!
It’s not elitist, it’s realist. They don’t want to install Signal just as much as I don’t want to install Facebook messenger.
Yes you can nag people but it will more often than not have the same effect as when people try to convince me to install Facebook messenger.
I find this resistance weird. (From the “normies”, not the Signal users)
Most of them have phones filled with all sorts of crap that they download willy nilly, yet they only seem to put the walls up for Signal.
They can say the same about me, right? I have so many communication apps on my phone, why do I draw the line on Facebook Messenger?
Most likely you’re the only person they know on Signal and it makes more sense to them that you move to Facebook rather than moving their entire friend-sphere into Signal.
speaking of “normies” is elitist, because the term is used usually people privileged/experienced with knowledge about technology to describe people who don’t have this privilege/experience. It is implying that there would be a class of (sub-)humans who are not capable of taking the same path as the person who employs this term. I stand by the term “elitist”. In a world of diverse people, life-paths and needs, in my own experience everybody is capable of understanding the political reasons to use a piece of software over another one (because one company sucks, because their model of centralization is detrimental to freedom, because they got shady funding, because they pretend to be something else but bar free software authors to modify their software, because they’re from the USA, etc.). Everyone has their own way of understanding these things. Everyone has some arguments that will resonate better than others. Pretty much the same way you probably decided to not install Facebook messenger. Well the good news is: everybody is capable of understanding these things. It may take time and effort, it may make elitist people realize it is not as easy as they first thought it would be, and require to fail and try again. It requires efforts and a humble approach as to listen to these people and take them where they are and walk a bit along the way with them.
My personal experience is that most people are capable of understanding such things. It may take time, but everyone is capable.
I also saw tons of elitist tech-enthusiasts and other tech-savvies “bros” not even addressing who they call “normies” out of pure lazyness, to avoid to speak outside of their own comfort zone and question their own status, and to avoid sharing their elitist knowledge.
-> “‘normies’ won’t do that” = “i am too lazy to engage meaningfully with people who do not know the same things as i know.”
That’s a major part of the problem. Elitist feedback loop…
First of all normie not an insult or a derogatory term. The term “normies” is often used in many niche communities to refer to someone outside the community. It has nothing to do with being smart, privileged or experienced. It means more like “the average user” or “the typical person”. Example: a person in the boardgaming community may refer to you as a normie, not because you’re dumb but because you don’t play hobby boardgames (check out Brass: Birmingham, what a game).
The problem isn’t about comprehending the problem, most people understand that Facebook is selling their data. They just don’t care. They would rather have their data sold than to have the trouble to move to yet another communication app. WhatsApp is working just fine, Facebook is sparking joy. They don’t care.
“Normies won’t do X” is a perfectly acceptable way to express that the hurdles are too high for the average user. The average user wants a sleek UI, a user friendly experience and most of all they want to be in the place everyone is already at. The average Joe doesn’t want to be the first guy on Simple X, they actually really want the hassle free platform everyone is already at.
Also, the next great communication app is constantly changing. It used to be IRC, ICQ, MSN Messenger, Facebook Messenger, WhatsApp, Instagram, Telegram, Signal, Matrix, Simple X, Session. I’m sorry to say that the average person is not willing to migrate that often. Facebook works, their friends are already there, they stick to it. This isn’t elitism, it’s just stating what I see.
Normies isn’t an elitist term it is a counter culture term for people outside the norm to refer to the general opinion. It is the not like us statement or the fact that there is experience that one would not understand fully unless they are in a subset group.
en.wikipedia.org/wiki/Normie_(slang)
was first used in its original meaning of “ordinary, normal” in English in the 1950s.[6] According to Merriam-Webster, the term “normie” appeared in the late 1980s in the United States. It was used ironically by people with disabilities in reference to the rest of the population.[2] In the late 1990s, the term was used in Alcoholics Anonymous literature to refer to individuals who were not addicted to any substances.[7]
Since the early 2000s it has been spreading on the Internet.[2][4] In the Russian-language sphere, popularization was promoted by the use of the imageboard Dvach, whose users consider themselves representatives of informal culture, which is expressed in controversial publications, non-standard political views, black humor, involvement in various subcultures.[8]
Don’t forget that OMEMO on XMPP has no backward decryption - all messages are lost with every new client. Massive dealbreaker for me, as I value message history between those I love.
I’ve gone for Matrix. Signal doesn’t interest me until they get rid of the requirement for phone numbers.
Others have noted that XMPP servers hold user contacts (and maybe other parts) wholly unencrypted, and if the server isn’t yours, that’s a trust risk.
Do you not use backups?
As in, backup messages to import into new clients? Is that possible?
Yes!
Son of a… Thank you! Time to reassess my server aha
The whol eXMPP ecosystem is really confusing I just strongly disagree that matrix is a step forward. On the subject of its backups, I had multiple mysterious failures with matrix it before switching to XMPP. I use a password manager so the likelihood of user error is low
I recently switched some of my contacts from Signal to Matrix and I really prefer the user experience. The room-based model and the video chat features are great.
which client are you using? the element client on androud and desktop/web seems to be pretty glitchy.
I use SimpleX
Based privacy enthusiast 🗿
Do you use simplex or do you have an account with simplex?
I use it daily
That’s honestly shocking. Where do you find other people who actually use it?
simplex.chat/docs/directory.html
Signal may not be the best in a technical sense, but it is good enough and it has the network effect. I’ve been pleasantly surprised when in the span of a few months I met two different people actually in real life, who happened to already be using Signal.
Signal is also just as usable as the big tech alternatives, which makes it not a very hard sell to friends and family. For quite a few years now I have managed to convince everyone I communicate with to do so over Signal. There is no chance I would be as successful with something else.
.
For most people, Not this community, it’s trying to get people off Whatsapp. So even signal is better
Signal for people that partly care about privacy. SimpleX for true privacy enthusiasts
I love the irony of the name. It’s probably the best thing about the app.
One of the things I’m curious about and the website doesn’t explain: how are the message queues not identifiers?
They are local identifiers, not global ones. Each one exists only for a single pair of users so they don’t function as stable or traceable identities. “Pairwise anonymous addresses”.
simplex.chat/#privacy-of-identity-contacts-metada…
But those are still identifiers linked to you and in a global space because it says multiple servers need to know how to route data.
Nvmd: seemingly if the server hosting your queues shuts down you lose all contact, so your UIDs are shared but only to a specific set of servers you choose with the drawback of fragility. Seems like someone else shutting down a server kills your contact list?
When it comes to initializing the connection, It’s true that those identifiers (or perhaps more accurately, addresses) are susceptible to collisions in a “global space”. But they are temporary, ephemeral addresses (they are discarded after use and/or expiration), and the space is astronomical so chances of collision are tiny, and even in the rare event of a collision you still have a step in which you verify a fingerprint code that’s independent of the address, related to the individual local device… so you have a second factor authentication of sorts, if you are adding a person and the code does match then you can be pretty sure it’s the correct person, since both the shared address and the internal locally-stored key match.
If there’s a permanent global fingerprint code isn’t that, well, the opposite of what the marketing says? Why is that not a unique user identifier?
The fingerprint (or you can also call it “security code”, it’s just a code for verification), is generated from the combination of the locally stored encryption keys from each side of the conversation, it will be different every time. I believe it’s also not technically required by the protocol that the same encryption key should be used for all conversations (although I don’t really know if the client does generate a new one every time or keeps reusing the same, that’s up to the implementation I believe).
Makes sense, thanks for the explanation
@Ferk has given a more elaborate answer. As for servers shutting down. Haven’t had it happen yet. With any service you always risk servers shutting down or failing, even centralized ones like signal: so that is a bit of a nirvana fallacy.
I didn’t compare it to signal. I just asked if that was the facts of the situation.
If I were to compare it might be to the topic of this thread which I can self host and thus control.
However, since you opened the door on signal I’d comment that the entire signal org would have to go down for that to happen, not just a few servers. Is simplex managed by a large well funded entity that is unlikely to fail or are the servers more mom & pop setups? What happens if Kurt Cobain wakes up one morning and shuts down his server?
TBH it’s worrying, but at the same time, it’s better to have people on something that’s somewhat Privacy-respecting.
Baby steps, you know. BTW how many here are familiar with GNU-Jami ?
What's that? GNU-Jami?
Very similar to Signal, but Libre software & has no phone-number requirement jami.net
Oh okay! Didn't recognize the GNU in there. Was there a trademark issue in the past?
No I don’t think so. It’s a high-priority GNU project
I tried using Jami with a very technical friend. The android version kinda seemed to work, though a little glitchy. The desktop linux/windows version was complete garbage, completely unusable.
Jami is a mess, when i tried it first it starting calling as it were to receive a phone call. The second time i tried it on 3 devices, out of which 2 could contact each other lol. My last attempt was when I needed to send a few strings from a (internet connected) VM to its host machine*, installed Jami on both and the 2 instances couldn’t talk to each other. Joke of a program, really.
Joke of an app ??
Not really
If the devs put work into making the backend work instead of adding shiny new features, maybe it would gain some usage, but if an IM doesn’t work between 2 devices, which is its most basic job, and this continues over span of almost a decade, it’s just not something anyone but its developers can use.
I use XMPP, and the original idea was for it to be a family chat and a way to securely ask for things on Jellyfin.
No one uses it. (XMPP, not JF)
No one cares. They know it’s a hassle to ask for media. They know they can only ask me in person if they don’t use it. They just won’t bother installing a client. Can’t be bothered.
Oh well, I can’t be asked, then. So we sit in this perpetual state of tug of war. I can’t be contacted, it’s complained about, the situation is explained again, they complain again, and still never resolve the situation.
Going on three years now.
I've been slimming down the services that I don't personally feel the need to use. And Jellyfin is right around the chopping block. Started Jellyfin to replace costly streaming services. Only one person is using Netflix and that's the only reason my parents are paying for it still.
I’d still use JF if no one else did. It’s convenient for streaming. The alternative would be maybe kodi and samba and that’s three steps back, two forward imo. I use xmpp for notifications a lot, its close integration with the server its on allows for using it kinda like ntfy.
Most people don’t understand what is instance and do not want to do 3 step registration if they can do 2 step registration on Signal. Also, if I understand correctly, xmpp protocol and client didn’t support stickers and Signal added that feature and gifs? Not sure
Protocol and client are different. I know Cheogram has some kind of sticker thing, but I don't think it's as robust as what Signal probably has. I can download Signal stickerpacks to use on Cheogram (the xmpp client), but using them was a tad difficult.