What's the best messaging platform?
What's the best messaging platform?
Cross-posted from : https://lemmy.ml/post/16566616
Hi, I wanna know what is the most secure and best messaging app/platform... Need an app that is crossplatform and has a very good numbers of features and security. (And it has to be FLOSS) I thought about XMPP clients, Signal, Session, IRC clients.. Propose and explain me your choice
- SimpleX is libre software and the most decentralised voice chat here.
- Briar is libre and the most decentralised but is missing voice chat.
- XMPP and Matrix are libre software and federated/decentralised. XMPP servers use far less resources, so creates more decentralisation than Matrix in practice.
- Signal is libre and more popular but centralised, acceptable.
- Avoid Threema's app which requires a service as a software substitute.
SimpleX doesn't need a phone. The desktop app can run standalone or linked to the phone-profile (but the phone must stay connected for that).
They also have a CLI version (which you can use as a central hub for your profile).I don't think briar is cross platform.
Thx
SimpleX
Signal is a close second.
There is no best, because none of them cover every use case or threat model. However, these are worth considering:
- Matrix, if you don't mind minor meta-data leaks (reactions and avatars have not yet been moved to the encrypted channel, IIRC).
- XMPP with OMEMO, if all your contacts are technically skilled enough to manage the requisite clients, servers, and protocol extensions, or if they have a skilled admin to do it for them.
- Signal, if you don't mind linking a phone number to your account, can tolerate an ecosystem effectively married to Google, and accept the risks of a centralized service that can be attacked or shut down by someone with the right access or influence.
In situations where your safety depends on anonymity from the powerful or well-connected, I would instead look for a messaging system tailored for such things. (It would, of course, require giving up some convenient features that most of us expect from a general-purpose chat platform.)
reactions and avatars have not yet been moved to the encrypted channel
Fortunetly there is ongoing work to do that. Still admin sees who you are talking to, but there is some effort.
Just use molly
Even with the UnifiedPush fork from F-Droid where you can avoid the Play Store & FSM notifications, you are still shackled to Android which isn’t a long-term solution with Google ultimately at the helm.
I think Signal dropped the phone number requirement, didn't they?
Now you're able to hide your number at different levels, but it still requires you to use a phone number to sign up and use.
In fact you could say that for now XMPP is the best in your opinion, but a bit technical?
No, I would not say that.
I used XMPP in the past, but long-lived public server support is almost nonexistent these days, and proper setup/maintenance requires too much tech skill for the general public. Also, it lacks modern features that many people have come to expect. I would only suggest it for small groups, and only if you can run your own server and provide tech support.
For my needs, Matrix is the best available today. It covers the things that I find most important, and is constantly improving.
Where your friends are?
Yup. Reality. No point using a hyper secure chat system if literally nobody you know is using it.
That’s sadly where it’s at. I’ve been lucky and managed to convince most of my friends to give Signal a go and in the end we stuck with it. But we’re all technically minded people so YMMV.
Use Matrix bridge Everything else 🙂
Pretty much what will always happen. You move away from society, you get fucked. Your mental health is down the drain. However, this allows an opportunity to introspect on how respectful your friends really are, and what you want your life to be like. Most privacy stans never capitalise on this opportunity and get fucked instead.
We should be glad that WhatsApp with E2EE is what people jumped to, instead of Facebook Messenger or Viber or some crap with no encryption. While Facebook does abuse metadata, message content is perfectly secure and private, and your metadata does not matter much in daily life when it's just your family and friends. I would not use it to connect to people if I was a big public activist or politician or high profile person, since both the metadata and a popular app with 0days can become a threat to my life or assets.
I should share my testimony. My "good" friend did not give a fuck about privacy when I asked him to use Signal for me. Our communication massively decreased. A year passed, and we stopped communicating. I learnt that day that most people in life who are "friends" see you as an investment, and it can be treated as a sunk cost endeavour. Also learnt that we saw each other as friends of convenience and not necessity or truly.
SimpleX is quite a promising project, uses Double Ratchet End-to-End-Encryption (from Signal), and has a very interesting protocol and model to provide quite strong metadata protection, especially in regards to whom you talk to and groups you're in.
If your threat model requires exceptionally strong Metadata protection, SimpleX is probably going to be your go-to
Though, for a more lenient threat model, where still good, but less laser-focused metadata protection is enough, Signal will probably do just fine.
Personally I use Signal, but I also have a SimpleX Profile, an XMPP Account and Matrix. (preferred in that order)
Okay thx
This spreadsheet is a very helpful comparison of the different messaging apps. I've been using SimpleX for quite some time now, and the only issue I have is some lag on the iOS client.
This table is really good: https://www.messenger-matrix.de/messenger-matrix-en.html
Use on multiple devices (in addition to mobile device)
Anything that isn’t green here is a ‘no’. The amount of service requiring mobile devices is absurd. I would hope many of us would love to make the jump out of the Apple/Google duopoly at some point if not already, & these sort of lock-ins should be avoided if you put even two thoughts into the future.
Thank you
the spreasheet is really good, but rcs is not there - i'd love to know how that compares.
Depends on what you mean by "secure", being very loose with the definitions, we have
- end to end confidentiality (i.e. only you and the intended destination can see the message contents)
- privacy (only the destination knows i'm sending messages to them)
- anonymity (no one can find out who you are, where you live, i.e. metadata/identity/etc)
My personal preference is Simplex.
Reasoning for a few:
- Email: even if you use PGP to encrypt messages the server(s) in the delivery path have access to all metadata (sender, receiver, etc, etc). If no encryption is in use, they see everything. Encryption protocols in e-mail only protect the communication between client and server (or hop by hop for server to server)
- XMPP: similar reasoning to email. i.e. the server knows what you send to who. I should note that XMPP has more options for confidentiality of message content (PGP, OMEMO, others). So I find it preferable to email - but architecturally not too different.
- IRC: Again similar reasoning to email - even if your IRC server supports TLS, there is no end to end encryption to protect message contents. There were some solutions for message encryption/signing, but I've never seen them in the wild.
- Signal: Good protocol (privacy, confidentiality, etc). Dependency on phone number is a privacy concern for me. I think there are 3rd party servers/apps without the use of phone numbers.
- Simplex: Probably the strongest privacy protection you can find, but definitely not easy in terms of usability. The assumption is that we do not trust the intermediate server at all (and expose nothing to it), we just leave our encrypted messages there for the receiver to pick up later. It also does some funny stuff like padding messages with garbage.
- Matrix: In theory it supports end to end encryption in various scenarios, but my experience with it has been so bad (UX, broken encrypted sessions) I only use it for public groups.
Some more food for though though; these protocols support both group communication and 1-1 messaging - privacy expectations for these two are very different. For example I don't care too much about confidentiality in a group chat if there are 3000 people in there. It might be more concerned with concealing my phone/name/metadata.
In general I consider large group chats "public", I can try to be anonymous, but have no other expectations. e.g. some people use some protocols over ToR because they do not trust the service (or even the destination) but they try to protect their anonymity.
On a technical note: I don't think there is any protocol that supports multi-device without some kind of vulnerability in the past. So I would temper my expectations if using these protocols across devices.
I'm not familiar with the other ones that were mentioned in comments or in the spreadsheet.
Permanently Deleted
For privacy it's probably one that nobody uses. Then it's even more private because you'll never send anything
Right!
You need to understand your threat model. Some apps are very secure but extremely inconvenient and hard to use. Others are more convenient but may not be able to hide the fact of a conversation between certain users for example
If I want convenience for now I would use Signal or maybe Session, but here I want the (almost) most secure thing that I could get
There is always a cost to security. How much you and your recipent ready to pay?
And, what you mean by "secure"? E2EE is basic. How about meta data? Or resilient to DPI? How about correlation attacks? Then the directory server. And the operator of the server. Where they located can be a factor too.
There can be a milion factors that can contribute to security. You can have it all but I don't know if such thing exist or not. For each factor, you gain some security but loss some in other places. You need to pick and choose what you need.
"Best" is subjective. I like Signal because it has a great modern UI so I can pretty easily get non techy/privacy people using it.
There is no one best, as we wish there would be. Depends what you want.
XMPP and Matrix are definetly the most based ones, because you are not tying yourself to one particular app and server, they're the common languages. And this is what I would want to use for mass communication and as a base, default.
Signal is nice if those above are not enough developed yet for you. Easy to switch friends into and discover contacts with it's phonebook based nature. But there is no open API for thrid-party apps, only reverse engineering from open source code.
If you don't need calls Matrix has a bridge so you can use both at the same time.There are also the most anonymous ones, like Briar, SimpleX or Session, there is a lot of them. For me their usage is when two or more people want really private chat and both agree on the app. I really can't and don't want to see them as the default.
What is it you're looking for actually? "Best" is subjective to the person's needs.
For example for me, the best is signal but I would much rather use something decentralised that still allows friends and family to find me easily using my phone number. Stories / client defined groups without notifications are also very useful to me. Also a native desktop app (aka not a locked down browser running some local webpage) would be awesome. But such an app doesn't exist yet.
What would you need and prefer?
Would like to have something with a strong encryption and good capability of tweaking
Tweaking? In which regard?
SimpleX has a native desktop app
I'd go with Signal or Threema
Signal: Best data protection. They are on a different level from anyone else. They even reimplemented gif search through their app so it can be anonymised (instead of the data-collecting gif search in your keyboard). Just an example, they really try. Also has a desktop app that doesn't need the mobile app to be running. Downsides are google dependency (for push notifications - but they're empty, the encrypted data does never even touch google) and required linking to phone numbers. They do have usernames now so you don't have to give out your phone number to talk to someone. Behind it is an US based non profit - whether that is a downside everyone can decide for themselves.
Threema: No need for phone number, not even a credit card, you can buy it anonymously through their website. No google services required. Swiss based company, so much better laws than USA. Finance themselves through the one time fee of 2 USD and through their corporate offers, no nags for donations, no selling of data. Downsides are server code is not open source, and their protocol is less good than Signals, but still reasonably secure. They're working on a new one though. Also no independent desktop app yet (also working on it).
Would maybe choose Signal for its simplicity but I do not would like to use threema, it is a bit too related to his company, rather prefer simplex as example
I would recommend looking at this site. My personal recommendation would be simplex chat. It’s decentralized, doesn’t require a phone number and supports forward secrecy.
Delta Chat is quite good, it's an email client thats built like a messenger app. It's E2EE with Autocrypt lvl 1, you can use it with most email services, and they have a self hostable/hosted "chatmail" service that you can also use if regular email services are slowing down the messages (gmail isn't the best for this). It also supports apps and games in chat using the webXDC standard.
Webxdc is pretty neat. Cheogram & Monocles clients also support it on Android.
The other day I found this, using an very old inbuild command line tool in Windows, Mac and Unix: finger
Write for Example
finger zerush@happynetbox.comin the command line
Do you finger your friends?
Not until now, I discovered it only some days ago. I think it's an interesting methode to send Messages ocassionaly, but not so practically in the daily use.
Email, probably. Kind of depends on your needs, and how willing other people are to accommodate them. The most secure messaging platform is email with a third party IMAP client using OpenPGP. That way the client and the server are run by different people, and the encryption is based on a verifiable and well known standard. But will other people use that to communicate with you? Probably not. So probably something like Signal would strike a good balance between privacy and ease of use.
I strongly disagree, email is a train wreck for secure communication.
Proton has done a pretty good job of making an implementation that's actually secure but PGP email has fundamental flaws like the subject line and recipient being clear text on the message, user error/key management complexity, and it's also just a high-friction means of communication vs "texting" or "IRC"-like approaches.
They asked what the most secure one is, not the most practical. When I said other people wouldn’t communicate with you, I meant because it is very difficult to set up, so I wouldn’t recommend it for anyone. But unless your client and server come from different parties, you’re putting all your trust into one other party (like with Signal), so that’s inherently less secure.