It seems like I constantly see “X secure messaging option is actually bullshit because it was purchased by Dr. Evil and Y is actually just e-mailing your messages directly to Xi Jinping.”
Is there an authoritatively “best” one I can just…download and setup easily? Is Signal good? Or do I need to solder a Raspberry Pi to the flux modulator of my home Linux NAS GUI, etc…?
I’d rather use a Swiss messenger than basically any other country, but yeah Threema is not mainstream and might as well not exist to most normals.
I’d trust them personally over any other country though, and I did once make my own messenger that used a few different encryptions (main one was serpent) and 2 passwords (using a lot of variations on both with slightly dif encryption types in multiple rounds which I’ll be honest was slow) . But yeah most normal people need to at least know something is mainstream/popular before they will ever install an app.
There is no best, each has their merits and drawbacks.
If you were to pick a messaging app I would go with Singal because they give good transparency to users, while giving frustrations to governments wanting data.
Also Elin Musk has blocked signal links on Twitter.
Only downsides of Signal are 1. It’s centralized 2. You have to sign up with a phone number.
It’s secure, cross platform, and easy to set up and use.
Probably most importantly, it’s a similar experience to using other popular texting apps and the set-up experience is familiar to anyone singing into any big-brand-name app, making it a relatively easy sell to non-techies.
To add to this:
It’s also owned and operator by a non-profit in the United States (unlike Telegram and Whatsapp which are operated from the UAE and a for-profit company respectively).
WhatsApp is owned by Meta (FaceBook), which is notorious for stooping to the level of borderline malware to steal data.
Look at openAI trying to switch to a forprofit. It’s hard to imagine signal surviving for longer especially that it is hemorrhaging a shit load of money and donations aren’t enough to keep it afloat
Signal is actually trying very diligently to pioneer a novel financial model for a sustaining long term. Here’s a lemmy post from a few month ago about a Wired interview with Signal Foundation’s president covering it in some depth (and a current archive link to the article). They seem to be one of the few actually good entities left in a world of surveillance capitalism and pervasive domestic government espionage.
Whether they succeed or not in the long term is certainly still unclear, but I expect they have many years of financial runway remaining.
Signal is known as the gold standard right now but there are new ones popping up all the time. SimpleX chat is good too (despite the “Nazi-haven” smears).
You say it’s a “smear” but is it based in truth?
I’m certain that any worthwhile encrypted communication will be used by evil people to do evil.
That doesn’t really answer the question lol
it’s a nazi haven in the same way a public library computer is a nazi haven if nazis come in and use it. the library doesn’t check your ideology when you log on, and neither does simplex.
I suppose I was commenting on the question, not trying to answer it. I’m out of the loop, so I can’t answer it. Checked some articles and it looks like a bunch of neo-nazis switched to it.
They are also using Google, Windows, Apple, etc. so I’m not sure the question actually pertains, but I guess that’s not my concern.
Don’t need the whole SimpleX to find Nazis everywhere. X is plenty enough.
I wouldn’t be surprised to find out its true.
The problem is it shouldn’t be a blight because its impossible to prevent bad actors from using an actually private and secure messaging app.
So the act of reporting on it is a smear because most don’t understand or acknowledge the impossibility of preventing those bad actors.
Nazi’s are going to go wherever they can be safe from tracking and doxxing. So obviously they’d be there.
If you think just because they are there, it is a bad platform, you may also be the same type of person that would allow law enforcement to look at your most private messages because “if you’re not breaking the law, you shouldn’t have anything to hide!”
I didn’t say or think any of that. I was asking.
you may also be the same type of person …
Signal works the best for me, and I think its the best option out there for common people who wants the best privacy
Signal has good encryption etc, is centralized, afaik needs Google Play Services except if you use Molly; but I think it’s a bit more mainstream and simple to use for end-users
SimpleX also seems to have good encryption, post-quantum etc, and is anonymous and doesn’t even use user identifiers (they explain why that’s good on their website), so it could be good for occasional more sensitive conversations or sth (but I see people struggling with onboarding when installing it, and I still get confused by the UX sometimes). It’s kind of not even decentralized, more like peer-to-peer, with servers to just cache messages when you’re offline, I think.
Personally for day-to-day I prefer to use Matrix with Element: decentralized (which I really value for competition and user choice), e2e, and has good support for creating communities etc, so I’m lucky to have it as our main chat platform for work, and I’ve been using it for years in our hackerspace and personal chats etc. I see end-users still struggling sometimes with onboarding, but if they’re close friends/family I usually need to set it up for them anyway
Signal runs just fine without play services for me. It does drain quite a bit of battery without cloud messaging, but that is to be excepted since it needs to keep its own connection up in that case
Molly is fantastic. Maybe someday I’ll be able to convince people to get on Matrix, but we’re not there yet. Plus there’s all of the metadata that comes along with using Matrix.
Doesn’t most of Element route through Matrix.org?
Signal.
Wired had an interview with Signal’s President last year that I found enlightening and provided an entry point for me to self educate further. Here’s an archive.org snapshot of it: https://web.archive.org/web/20240828100224/https://www.wired.com/story/meredith-whittaker-signal/
For the click-averse here’s an excerpt I find compelling:
Going back to your sense of Signal’s new phase: What is going to be different at this point in its life? Are you focused on truly bringing it to a billion people, the way that most Silicon Valley firms are?
I mean, I … Yes. But not for the same reasons. For almost opposite reasons.
Yeah. I don’t think anyone else at Signal has ever tried, at least so vocally, to emphasize this definition of Signal as the opposite of everything else in the tech industry, the only major communications platform that is not a for-profit business.
Yeah, I mean, we don’t have a party line at Signal. But I think we should be proud of who we are and let people know that there are clear differences that matter to them. It’s not for nothing that WhatsApp is spending millions of dollars on billboards calling itself private, with the load-bearing privacy infrastructure having been created by the Signal protocol that WhatsApp uses.
Now, we’re happy that WhatsApp integrated that, but let’s be real. It’s not by accident that WhatsApp and Apple are spending billions of dollars defining themselves as private. Because privacy is incredibly valuable. And who’s the gold standard for privacy? It’s Signal.
I think people need to reframe their understanding of the tech industry, understanding how surveillance is so critical to its business model. And then understand how Signal stands apart, and recognize that we need to expand the space for that model to grow. Because having 70 percent of the global market for cloud in the hands of three companies globally is simply not safe. It’s Microsoft and CrowdStrike taking down half of the critical infrastructure in the world, because CrowdStrike cut corners on QA for a fucking kernel update. Are you kidding me? That’s totally insane, if you think about it, in terms of actually stewarding these infrastructures.
My understanding is that Briar is ethically the best, but no one uses it. Signal is the best if you actually want to use it to communicate. Telegram is where the pirates and drugs are.
Here’s the long version: when a dev is making a messaging app, they eventually have to make a choice: do I integrate SMS/MMS? If they want to make this app a daily driver messaging platform to help you ungoogle your android phone, they have to integrate SMS/MMS, which has security vulnerabilities and limits how secure they can make their app. More importantly, people do not tolerate ads on their messaging app, so they flat-out cannot monetize it without losing their entire userbase. If they don’t integrate SMS/MMS, they are creating a closed ecosystem, and a closed ecosystem can be profitable. If leadership changes, the new leaders might decide to turn their users into either cutomers or products.
Briar seems like meshtastic but with no additional hardware at the expense of significantly less range when offline.
Signal if you trust them to not leak your identifier and because its gotten the most mass adoption.
Simplex if you can convince your circle to use it because it has no identifiers and is user friendly.
Whoever built that website really needs to fix the hitbox on the ‘X’ when you’re done reading the popups. Or instead of trying to show off with JavaScript they can just have a separate page like most websites
What do u mean leak ur identifier. Isn’t that just like your phone number
Signal is the best balance between secure and convenience. There are more private options out there (i.e. don’t require a phone number), but they are harder to adapt especially if you want to get non-techy family and friends to switch over.
For everyone suggesting signal, have a read here and then decide for yourself.
https://github.com/signalapp/Signal-Android/issues/8974
ETA: when I say “decide for yourself” I mean exactly that. I don’t think all the stuff written in there is true, but some is. You should make a decision based on what you think about those comments, not trust them blindly. But at least you can make an informed decision.
They might have valid concerns, but when the writeup includes stuff like
the developer of Signal wants us all to beLIEve
it’s hard not to imagine the whole thing hand-painted on the side of a van.
I agree, that’s why I specified “make your own decision”. It’s better to have an informed opinion than just trust it.
Signal via Molly seems like the best option at the moment. Molly is a third party client that allows for even more protections like database encryption and getting rid of Google firebase notifications, for example.
I use signal but if I could convince everyone I knew to use a messenger for security it would be Threema. No chance of that happening it’s hard enough convincing people to use signal.
Two years old, switched to a new protocol, all open source, more recent security audits didn’t find anything, etc.
As always the answer is it depends.
Ive seen a lot of merchants of illicit products move towards sessions.
It depends on your threat model, signal or maybe element is likely the best compromise.
If self-hosting and “Warning, some assembly required” isnt an issue, Matrix - Synapse. I spooled that up in my home lab recently and im slowly moving my group chats over to it.
