- cross-posted to:
- privacy@programming.dev
- cross-posted to:
- privacy@programming.dev
I currently use Telegram for my friends and family, but have reluctantly come to the conclusion that the UK Government is either reaching agreement for backdoors with messaging services, or is trying its hardest to.
I’m also on Element/Matrix. Before I try to get my contacts to join me on there, should I be aware of any privacy issues or is that a good place to head?
You must log in or register to comment.
There’s also Wire
E2EE and can be used as desktop or phone app interchangeably. No phone number required for signup.
Family has been using this for years now
I currently use Telegram for my friends and family, but have reluctantly come to the conclusion that the UK Government is either reaching agreement for backdoors with messaging services, or is trying its hardest to.
Unless you start an encrypted chat, Telegram chats are not E2E.
I’m also on Element/Matrix. Before I try to get my contacts to join me on there, should I be aware of any privacy issues or is that a good place to head?
Host your own Matrix node, and then you don’t have to worry about prying eyes. Realistically, instead of worrying about the protocol, worry about the content of the text. Use PGP to encrypt your own text and send it over clearnet. Who cares at that point.
I think at this point it would be funnier to just use something obviously unsecure like discord but share your public key with the other user and then send encrypted text.
I guess a vencord plugin for that wouldn’t be that difficult to do
Telegram is the least secure thing there is. Not only it’s complete zero effort security, it’s also much above zero effort to advertise itself as almost secure. Not a good combination as you know.
I’ve honestly found signal better than matrix.
Matrix is just not there yet in terms of features UI etc and is less private than signal because it collects way more metadata and stuff. I know the idea of federation is cool, but Signal works better for the privacy aspect.
Interesting—I feel like I see Matrix touted as more private than Signal b/c of Signal’s phone number requirement. What compromising metadata does Matrix require that Signal does not?
Sorry I’ll let someone more knowledgeable answer about metadata, but signal does allow you to set a username and hide your phone number (so people add you with username instead if f number)
Matrix is good for private general messaging. The fact that it’s decentralised means it can also withstand things like government-ordered shutdowns or back doors, since there is no central point that controls the whole network.
Two things to be aware of:
- Some non-message bits (e.g. room topic text and membership) have not yet been moved to the encrypted channel, so those could be read by the administrator of a homeserver that participates in your chat room. Since most people care primarily about keeping the message content private, this is an acceptable trade-off to get all the things that Matrix offers.
- The upcoming Matrix 2.0 features and design choices simplify the UI and fix some occasional errors. It might be worth waiting until this stuff officially lands in the client apps before bringing your contacts to Matrix, for a better experience all around.
As long as you onboard them with the ElementX/SchildichatNext(better fork of element) mobile client, their experience and setup should be fairly future proof. Its still changing and growing for sure but the most important stuff is finally working now and the new call systems is a huge improvement.
But yeah if you want zero metadata, your only choice is P2P stuff like Briar.
Government-ordered shutdowns do not work the way you think. Government doesn’t play by the rules, it makes rules for itself.
Which means - they may, say, make a list of instances updated hourly, which automatically get blocked by ISPs.
Free speech or not, it won’t withstand such.
Note that I said the network can withstand such things, not that it guarantees your connectivity to it when using a hostile ISP. No internet messaging service can do that.
Are there any other messaging options that are more resistant to government ordered shutdowns than Matrix?
There are a few messaging systems that don’t rely on internet service. That usually means a peer-to-peer design using some form of radio link, which can work well for local gatherings (like protests), but tend to be impractical for general use.
The biggest issue with Matrix is that the server collects ALL the metadata. If that’s your server, that’s fine. If thats the default matrix.org server that almost everyone uses, you might as well be using WhatsApp. Same thing goes if any of those people are conversing with people on your server, as they will store all redundant metadata on their server as well.
Signal is easier to use, more private, and faster.
Signal requires a phone number on setup.
Also, matrix has bridges, which alone make it worthwhile for me. They, of course, don’t help privacy, but they are so so nice for convenience.
Matrix is definitely slow though, and a grand majority of the clients are heavy terrible buggy electron apps. There are a few good ones ( nheko and the new beeper clients ), but even they have some rough edges.
I still use matrix all the time and love it.
If max privacy was the goal I think simplex looks wonderful. No required info for sign up, no way for them to possibly collect any metadata ( because there are no identifiers sent over internet for anyone at all ), E2EE, and decentralized.
Sure but it allows VOIP numbers. I’m using a jmp.chat number with it just fine.
Good to know!
Is the phone number required for 2fa codes or anything like that at any point ?
Signal requires a phone number on setup.
It is dumb and annoying and inconvenient but doesn’t affect its use or privacy.
I do agree that SimpleX seems like the best chat option.
It affects its use for me definitely. I don’t want to have a phone number. At all.
Signal requires a phone number on setup.
Not anymore.
You can choose to share a username instead of a phone number, but they still require the phone number at setup iirc.
Yes it does
Signal is easier to use, more private, and faster.
Unfortunately, it’s also effectively tied to Google services due to the app distribution and push notification channels used by most people on it, and (as a centralised service) is vulnerable to shutdown or network-level metadata monitoring by anyone with sufficient access at the organisation or data center, such as a government who doesn’t like encrypted messaging.
You can use Molly, a fork of Signal for android. It offers an alternative for push notifications.
Yep, I run my own mollysocket + ntfy server.
Essentially, molly socket functions as another device, when it recieves a notif, it pings your specified unified push server, which then queues up a notification for the ntfy app on your device.
You don’t need to run your own unified push server, and can just use one of the main ones, but I figured I might as well.
I personally have them hosted on fly.io for free via the legacy hobby plan.
Now all I need to do is get more of my friends to message me on it 🤣
Uhhhh yeah, no literally none of that is true
You may want SimpleX. You can still self-host your own server if you wish, but it doesn’t have nearly the metadata issues of matrix and encryption keys are stored in a database that you back up instead of constantly breaking
Last time I tried Simplex, the desktop app was incompatible with the mobile app. Do you know whether this has been fixed?
I haven’t personally tried it, but I think there’s a setting in the mobile app for using it with a desktop. So I assume it is fixed, but I won’t swear to it.
The two encrypted messaging platforms I currently suggest are XMPP or Matrix. Both are usually fine and are decentralized. The main thing with them is to either self-host or choose a server you trust to set up an account — which applies to the Fediverse in general.
I’ve heard good things about simplex give it a look
