/msg/ - Messaging Apps General

A thread to discuss the various different text-based communication applications and protocols. Main: irc.lainchan.org >Interoperable/federated messengers: XMPP: https://xmpp.org/ - You can use a client like Conversations (Android) or Gajim (Desktop). IRC - There is so many options. Most popular it's probably HexChat (Dekstop) irssi (console) and Revolution IRC (Android). SIP - As above. Most popular option it's probably Linphone (Android/Desktop) Bonjour (XEP-0174 btw.) Tox Matrix Rocket.chat (i guess?) >Shit tier messengers: Signal - SPOF, Phone requred, no federation TeamSpeak - Proprietary Whatsapp, Skype, Discord, iMessage - Shouldn't have to explain (not to mention another SPOF) >Discord/zoom/other soykaf replacement: Matrix/Element: https://element.io/ - More suited for groups than 1v1 chats. Rocketchat: https://rocket.chat/ convos.chat - It's literally IRC + jitsi.

why no one is interested in biglybt i2p irc chat ? it's the epitome of chadness >anonymous , i2p based >irc , anti-normal person by design >support for file transfer via i2p p2p it's the chosen one

>>50332 Stuff like this is interesting. These pda's, of which the first came from Russia, seem to have had two way radio text messaging. The early 2000s was the peak of everything cyber in my opinion. All of these new 'apps' or sites are just 'a fad' for sheep to flock to and are utterly pointless. IRC is inconvenient but at least you can download ebooks and such from them I will say. Anyway, I wonder what frequency and range these things were?

>>50334 I wonder if it is possible to connect several DCC users in one chat, similar to group SMS, then you would have the best of both worlds: an interoperable P2P chat protocol. it would even be possible to conduct voice conferences and broadcast the voice (See, DCC.VOICE by KVirc)

>>50332 ever stopped to consider that instant messaging isn’t a problem to solve? for anyone that believes instant messaging has significantly improved their life, please do tell me —and before you knee jerk reply, do take time to think through your experience

>>50343 Instant Messaging, like all technology, has a good and a bad use. It's been a relatively good use for me, because I am able to do the follow: >Keep in contact with friends from all over the world, in a live environment >Work from home and when I was in middle and high school: >Talk to my girlfriend, as well as all my other friends, while playing video games (like runescape, world of warcraft, and neverwinter nights) All in all, it has significantly improved my life because otherwise I would have been even more unsocial. In fact, the only reason I even have a wife is because I met her through a friend's girlfriend on YahooIM. We were in the same school district, but I likely would have never met her because we were in slightly different friend circles. Then we reconnected several years later, through instant messager. I'm pretty happy having her, so that's a pretty significant improvement. If I didn't have IM, I probably would have been the friendless loser I was prior to getting access to the internet that I was. All I did was play video games, skateboard, and read books when I wasn't attending classes. I had no interest in hanging out with people, too. The only reason I even had the friend I mentioned before was because I skipped class on my own and we ended up breaking into the same house to hide from the rain. After I moved away, I probably would've not kept in contact with them if it weren't from YahooIM. Anyways, that's just one thing. Its also an isolated incident.

>>50343 With increasing WiFi access point coverage, it becomes a free alternative to SMS, and in case of WhatsApp, also phone calls. I personally use WhatsApp whenever I need to call or message someone, and I have internet access. I have to call people quite often, and it does indeed cut costs to use instant messaging. From a non-normalf4g perspective, instant messaging is indeed of no use. And for most people, privacy is not a concern, as they post pictures of themselves anyways, which anyone interested enough can find. Autistic NEETs on the other hand, rarely post anything personal at all, and the only privacy concern they can have are wether Amazon knows if you bought a XXL black Dildo for Christmas, or that Google knows your account/IP has searched for animal porn 45 times in a month. And if things like these concern you, well, then it's time to think about leaving the internet, because that's the case with every search engine/website. As with everything, you have to ask yourself, how much you actually care. Not how much it strokes your ego to care about it, but how much you actually give a fvck about it. I give none. None of my social media accounts is tied to any personal data, I order to a PO box, but mostly buy stuff in person, I use my phone for instant messaging with a burner number, which can be bought, I use free online SMS receiver services for SMS verification, and I have several different e-mail accounts at several different providers, for when I don't want to use my personal e-mail, or if I expect spam. As for information collection, is there a comprehensive list of info, that discord, Microsoft and co. Collect through their service? I cannot imagine them collecting my meme collection, or my 50gb folder of pictures of my chickens, but who knows? Maybe you can convince me otherwise.

Doesn't Matrix leak a soykaf ton of metadata. Fail to see how it is good

>>50349 Sms verification for things is pretty much a standard buy law so it's not really replacing anything.

>>50351 tell us about it, also how is that a problem if you are hosting your own instance? whether metadata leaks propagate through federation depends on what exactly is leaking, I guess

>>50341 you can make a p2p chat of thousands of users , no problem , but it's only irc , no voip or any of that other zoomie soykaf

>>50374 *zoomie soykaf i must be drunk as fuarrrk

>>50375 Kek, you're new I guess. That's the language enhancer (a.k.a W0rdf1lter), you'll learn to love it (or circumvent it) in time. Welcome to Lainchan.

>>50374 By DCC you can send practically each data thanks by SEND. But idk how create a DCC conference with multiple users. CHAT - sequential sending of subsequent lines of text from the client to the client is carried out - to put it simply, it simply allows a conversation without the IRC server - although it can also be used for other purposes SEND - continuous data streaming from client to client is carried out - which in practice enables file transfer, but it is also possible to send multimedia data streams in this way.

>>50336 Frequnecy range was quite short. LGR did a review on these devices. Claimed to have i think of range of 100 feet (roughly 35m), but he was struggling to get messages delivered more than 15 feet (5m). Neat idea for a drvice though, since it acted as a mesh network for longer range communications, but seems to be very impractical unless your in a big city. I wonder if anyone has stories back in thr day being able to communicate at over 1000 feet distance in a populated city, but i doubt enough were sold to make the network large enough

this is what my list of messengers looks like - phone - email (DeltaChat) - IRC - XMPP - SIP (kinda inb4 skype*) - Matrix XMPP have transport to Email and telephone operators allow send SMS via email. Also i have transport to IRC, which is better than matrix (i can connect with any IRC server) * skype i have for normal people, because it doesn't need even log in. Discord have strict censorship in practice i have total 6 IMs. and how many communicators do you use the least?

>>50494 >skype i have for normal people, because it doesn't need even log in. use jitsi meet then

>>50332 Matrix isn't perfect but I think that it's pretty great. It also looks like one of the most promising options because it's growing in popularity. The server and client implementations are constantly improving. I think the problem with XMPP is that there's just too much variance between client and server implementations, so the user experience can be quite inconsistent. IRC is fun to use, but I can't really see it becoming popular again. It's only really used by some niche communities and FOSS projects now. It's probably going to stay around till eternity, slowly fading into obscurity. I like it, but non-technical users find it too difficult and cumbersome.

>>50526 >the problem with XMPP is that there's just too much variance between client and server implementations, so the user experience can be quite inconsistent. You'd have the same issue with Matrix if it were more popular.

oh yay another one of these threads I'd love to replace Discord, iMessage, WhatsApp, etc. with decentralized, FOSS alternatives, but there aren't any, because not needing to badger and handhold my contacts through adopting a service is a critical feature, and no FOSS offerings have it; I checked. I guess I could try explaining to my friends that Matrix has a really good UX actually and it's all their fault and they're objectively wrong. Maybe send them some Luke Smith videos? Or maybe I should filter my social circles by computer literacy as defined by /g/. Jami looks fantastic, though, when it works, which it usually doesn't. But I hope it turns out. >>50343 lol

>>50385 it (biglybt/i2p) can do the first two , but the last one (data stream like video stream) , i don't think so you can try it yourself chat:anon:?lain

>>50526 Yeah, especiallg upgrade room, which is about creating a completely new room... > so the user experience can be quite inconsistent. > I like it, but non-technical users find it too difficult and cumbersome AtraChat and IRCcloud it's proof that it's possible Inb4 proprietary

>>50390 That's good to know but what actual frequency was it? Was it wifi or lower? I'd always wondered if it were possible to use lower frequencies for texting or even Internet but never understood how that works. Is there too much 'garbage' in lower bands so as to confuse computers and that's why microwaves are the only ones to be able to do it? Can't you use encryption so as to ignore all but the passcode accepted? Or something? I guess microwaves are very short so it must have been that but if it were fm or something then maybe that's why the garbage made them malfunction in populated areas if their receiver was meant to be deliberately short range? I've read that there is a narrow range on fm that 'is only suitable for text' on wikipedia before. "Digital services are now also available. A 57 kHz subcarrier (phase locked to the third harmonic of the stereo pilot tone) is used to carry a low-bandwidth digital Radio Data System signal, providing extra features such as station name, Alternative Frequency (AF), traffic data for commercial GPS receivers[25] and Radio text (RT). This narrowband signal runs at only 1,187.5 bits per second, thus is only suitable for text. A few proprietary systems are used for private communications. A variant of RDS is the North American RBDS or "smart radio" system. In Germany the analog ARI system was used prior to RDS to alert motorists that traffic announcements were being broadcast (without disturbing other listeners). Plans to use ARI for other European countries led to the development of RDS as a more powerful system. RDS is designed to be capable of being used alongside ARI despite using identical subcarrier frequencies." So it had me thinking maybe they were not wifi? Wikipedia does not specify. Does lgr? I don't know what lgr is.

>>50529 >You'd have the same issue with Matrix if it were more popular. Not necessarily, because in xmpp many features are just extensions, but matrix has a single spec that contains all features.

No one here's suggested Briar?? I'd highly recommend.

>>50577 Just why if you have DCC which is: - interoperable - p2p - send text (CHAT) - send audio/video (SEND) >>50385 - Encryption (SSL) The only flaw it's poor NAT traversal.

>>50579 You forgot the part where it's unusable over I2P or Tor without further extensions.

>>50582 I don't know what you mean. Basically, when you connect DCC via tor, you use relay and NAT prolem disappear.

>>50584 I can't seem to find any implementation of a server relay other than mIRC, and it is IP-address based, which means that unless you and all your contacts setup dummy address mappings in their Tor configs, it won't work. That's rather impractical, but I suppose it does mean it's not unusable strictly-speaking, just awfully unwieldy.

>>50617 Like each p2p IM so what the point. Client-server it's just better

Video on DeltaChat: https://delta.chat/en/2020-07-30-summer-update

I only use SMS lol since I only have an dumbphone

>>50332 I am moving away from Android phones, the only thing keeping me is the Whatsapp group I use to keep in touch with my parents. They are happy to switch to any other app, as long as it works on their iPhones. My issue is finding which one, FOSS/Privacy aren't my main priority. Just need something that is familiar enough to send baby photos and shopping lists to each other. I really did like the idea of Signal, but I heard they don't like 3rd party clients. (Which I would have to use on my linux device, not an issue for them). A couple weeks ago I was ready to switch to Signal but then an update broke the client I planned on using. Any suggestions would be much appreciated.

>>50811 Just say parents that should be contact with you by SMS and if they not, should use IM which you use. my parents also use whatsapp but i force sms and skype

>>50821 >Force Skype I'm happy to finally be rid of that software I'm asking which IM would be easy to use with a linux client for me, but have simple interface that just works for iphone parents. Texting isn't really convenient for either of us, we exchange a lot of photos.

>>50827 Movim? Too short too short

>>50869 Unfortunately not on the iPhone app store, so a no go.

>>50872 > iPhone app store lol. So back to skype, nigga

>>50874 The iPhone client can be straight up spyware I don't care, as long as theres a foss linux client.

I joined Telegram some time ago and I had a username set as a handle I used online; this was intentional because I wanted the same handle I used on a platform. Then I learned the undisclosed fact that Telegram sends a notification to everyone who has your number saved in his contact list, even if you have deleted that person's number, telling him that you joined the platform. Did these people see my handle if they got a notification? What do they see? This crap is fcking awful. Signal does it too, it broadcasts that you joined the platform to every single person who has your number, even if they are not on your contact list. So much for fcking "privacy" apps. I assume that I set all the privacy options to something pretty tight after installing but not immediately. Deleted this crap afterwards but I still wonder, since there are people I know who are malicious and may have an interest in stalking me if they got a hold of one of my online handles.

>>50946 > 2021 > they still using instant messengers which phone number required what's the point? If I have a phone number, why do I need messaging?

>>50953 because SMS is one of the most insecure and unreliable messaging architectures there is

>>50954 then you use OTR like silence.im lol but seriously, the only things SMS / call can't it's group chat and encryption. XMPP and other mentioned by OP is enough for this purpose. I see that the context was not obvious, I didn't mean to give up communicators at all, only those that require a phone number.

>>50946 >Registers at a service that requires phone number. >Uses real number Are you even trying?

>>50953 Why do people answer clearly laid out questions with stupid inconsequential proselytizing?

>>50956 Whatever. fuarrrking worthless tranny site as always.

Any thoughts about Threema?

>>50958 You're being shamed for outright stupidity. If that doesn't put you on track, that means you didn't have a stupid moment, but you're stupid in general. In that case: >If you're asked to provide a phone number to use a service, try to find out if the service requires it only for verification or for active usage too. >If it only uses it for verification, use a burner or SMS receiver service. >If it's required for active use, burner or don't use it at all. All of this post would have taken 5 minutes of brainwork, and a few minutes of search engine riding to find out. Holy fucc, why do I need to spoon-feed you this sh!t?

>>51009 > Shit tier SPOF Paid

>>50332 You can add Mattermost and Nextcloud talk to the list, OP

Should I even try to get back into IRC? I did a few years back and most channels are idle or off topic circle jerk

>>51052 ##politics #fsf #English or even obscure like #hamradio are very active, what are you interest lanion

https://telegra.ph/Why-you-should-stop-reading-Durovs-blog-posts-11-25

>>50390 >>50567 Ham radio has APRS, which is a mesh network of digital packets passed from one radio to another. It has several uses, sending text messages from one mam to another is one. However, your messaging address is your callsign, which requires a license, and doxes your real name and address (you can at least register a po box for the address part).

>>51238 Should also mention that encryption is derezzed on all amateur radio frequencies.

https://www.gnu.org/philosophy/no-word-attachments.html > You sent the invitation on IM which i don't have, so I cannot join it. If you send me the email, SMS or IRC/XMPP/SIP then I could communicate with you. I ​don't know, maybe it can be better paraphrased? Sometimes some people press it to me, then i say that I will not give the application a phone number or that I am derezzed

>>50526 XMPP is miles easier to implement and use compared to Matrix/Synapse. I just deployed one in a measly 1GB RAM VPS a few weeks ago as a private chat network for me and my friends and I literally just had to install a program, symlink a few files and change some config. Compare that to synapse where I have to make sure that certain things are where they are and that I have a database backend running as well as a web server and that my VPS has to be sufficiently beefy, probably atleast 4GB of RAM. So yeah, while synapse might have some advantages compared to XMPP, the latter is so easy to implement that it becomes a no-brainer for a casual end-user that wants to have a private chat network.

facebook, whatsapp and instagram is down now

>>51519 That's got more to do with Synapse being a soykafty implementation all around than anything Matrix-specific. There's no reason for example that it can't use sqlite as a database, except perhaps that Synapse is useless.

>>51602 I keep seeing this soykafty "global internet outtage" "half the world is disconnected" headlines. Yes, you are disconnected if you fuarrrking rely on these soykaf companies for basic comunication. People need to stop using this garbage.

>>51605 yeah, lmao. I find it hilarious. I didn't realise zuckbook crashed till my mom called that she can't call me on whatsapp.

>>51602 If Facebook will stay this way for a relatively long time, what should I tell my normal person friends to use?

>>51605 How much is this facebook downtime in comparison to downtime of average freeetard-tun matrix server, in percentage of it's total uptime?

>>50332 Hey guys, any clue why none of the xmpp tech got any traction? I'm kinda thinking of making my own client and maybe hosting for it once I'm done with other projects. But for it to have any sort of traction it has to be better than what the messaging software that's availalbe now has to offer, and it being more secure or privacy oriented while important, is not enough for people to start using it on a daily basis. Any ideas?

>>51612 XMPP is like kicking dead whales down the beach. You'll realise this once (if) you start coding your client. I would prefer to use that effort extending IRC to have the decentralisation and encryption features of XMPP without turning into the absolute soykafshow that is Matrix.

>>51606 LMAO I heard about this on the radio today, apparently is a lot of big tech... wonder if cyber habbening

>>51605 Lol yeah. Unfortunately that's most of the world. Gmail apparently went down too. The paranoiac in me wonders if it may have been a trial balloon for the internet off switch, give that a test run. Or maybe stealth downtime to apply new content monitoring and censorship algos. I certainly don't use these services, wouldn't touch them with a ten foot pole launched out of a ballista. But it could be a canary. Perhaps just some standard screw-up as well. I have to remember I'm paranoid.

>>51519 >>51612 >>50526 >too much variance between client and server implementations, so the user experience can be quite inconsistent. I can't even send a group chat invitation between different clients. It's also hard to exchange OMEMO keys.

>>50548 >I'd love to replace Discord, iMessage, WhatsApp, etc. with decentralized, FOSS alternatives, but there aren't any, because not needing to badger and handhold my contacts through adopting a service is a critical feature, and no FOSS offerings have it; I checked. https://cwtch.im is an overhauled Ricochet fork with group chat and a "normal"-looking interface.

>>53286 >can you guys give me a quick rundown on threema, briar and session? Threema: One-time-payment E2EE service with good pseudonymity. The good: Open source clients under the AGPLv3. Runs on tons of platforms. Based out of Switzerland. Clients seem to be based on good audited technologies. The bad: Closed server. Non federated. The service itself works without a phone number, but the service requires a one-time US$2.99 fee payable via the Threema Shop which requires a phone number to create an account, or through the Android play store or IOS app store which also require phone numbers. The GIANT RED FLAG: Threema offers an officially-supported download via the Huawei app store (https://appgallery.huawei.com/#/app/C103713829). Yes, the same Huawei that's basically a subsidiary of the Chinese government. Want to roll the dice on how secure an allowed-in-China secure messaging app really is? I don't. Briar: It's basically a mesh network for E2EE messaging, it's truly decentralized. It uses other people's Briar-installed devices over LANs or bluetooth if there's no internet service. Has a built-in Tor client, all messages over the internet only go over Tor. GPLv3. Has forums, private groups, a built-in blogging platform. This is a messenger designed for "the government shut down the internet, we need secure communications and uncensorable publication of breaking news" situations. The bad: Android only. No desktop, no commandline, no IOS. Can only have a single ID signed in at any given time. The unknown: How well it can scale in an emergency situation where mass numbers of people are using it. Maybe that makes it work better since more interconnections are available. Maybe not. No way to tell until such a situation happens. Session: A fork of Signal with better decentralization. The good: They took out Signal's cryptocurrency scam MobileCoin. The bad: They added their own cryptocurrency scam Oxen.

isn't it sad that the internet has been available to the public since 1993, 28 years ago, and we still don't have a good solution for chatting that doesn't hand all your data over to some company that will use it for profit?

>>53292 Any solution that uses servers in any way, even if just as a bootstrap mechanism for a decentralized network that use 100% volunteer-made libre software, needs someone to pay for buying and maintaining those servers. The profit-motive for messenger services can't be solved until the "who pays for servers" thing is solved.

>>53290 > The unknown: How well it can scale in an emergency situation where mass numbers of people are using it. Maybe that makes it work better since more interconnections are available. Maybe not. No way to tell until such a situation happens. https://monal.im/blog/xmppsignalbluetoothp2p-wifi-serverless-chat/ just use XMPP and don't think about the soykafty briar

Alright, let's deathmatch all XMPP clients on f-droid. We go to https://search.f-droid.org/?q=xmpp&lang=en to find these XMPP android clients: - Stork IM - yaxim - Quicksy - Xabber - aTalk - blabber.im - monocles chat - Conv6ations - Conversations - Bombusmod Now let's discard the ones who didn't get any updates this year: yaxim (last updated 2018) and xabber (2019). Then Quicksy bites the dust: > Anti-Features: > NonFreeNet - you can't change the server where the accounts are created > Tracking - uses a 3rd party service provider (Twilio or Nexmo) to send SMS as needed for authentication And we nope out of BombusMod because there's no good documentation. Plus Bombus seems to be XMPP for java-capable dumbphones - why. So after this first round we're left with - Stork IM - aTalk - blabber.im - monocles chat - Conv6ations - Conversations Now here's all the incest: blabber.im and conv6ations are forks of conversations, and monocles is a fork of those two. blabber.im adds usability, conv6ations adds some ipv6 support, monocles adds more usability). I don't like conv6ations but can't point a finger at why. I'm discardnig it but maybe you can give it a try. Now we get ruthless. We can let Stork go because it can only send/receive text and images. That's not normy friendly enough to replace the mainstream alternatives. aTalk looks like soykaf, but may be a good fit for lainons who like the y2k aesthetic. Monocles is weird. Their website says (in pretty funny english) that monocles is a search engine. They make a suite of tools, one of which is Monocles Chat, >A monocles chat account with temporary storage for 2 month and access to a worldwide network. fuarrrk it. Conclusion: Conversations is good, but there's one fork that's even better: Blabber.im. They even have a handy tutorials page that even includes how to set up an XMPP client on linux (dino.im) and windows (gajim). https://f-droid.org/en/packages/de.pixart.messenger/ https://blabber.im/ This seems to be it, share your experience with Blabber here, lainons.

>>53352 I'm using Profanity btw

>>52699 >How is Cwtch different to Signal / Whatsapp / iMessage? >Can I share a profile across multiple devices? >Not yet! We are currently in the early stages of designing multi-device support. You can help support this effort by donating! >Why doesn't Cwtch support images/file sharing/stickers/video calls etc.? >We would love to be able to provide surveillance resistant forms of those features, and we plan to! However we are a small non-profit team with limited funds. You can help support our work by donating! >We would love to offer an iOS however there are several limitations of the platform that make this difficult. If you would like to support this effort please consider volunteering or donating.

I'm skimming through the matrix specification and saw this >This specification defines the following auth types: > > m.login.password > m.login.recaptcha > m.login.sso > m.login.email.identity > m.login.msisdn > m.login.dummy > >Password-based >m.login.password | The client submits an identifier and secret password, both sent in plain-text. https://spec.matrix.org/v1.1/client-server-api/ The relevant portion being that passwords are sent as plaintext for authorization. The specification elsewhere states that HTTPS is preferred but allows for HTTP communication between clients and servers. So if I'm not missing something (and please correct me if I am), this is really fuarrrking dumb. Surely it would make more sense to specify that clients have to hash the password before sending it. Does anyone know why auth via pub/priv keys isn't in the spec? Surely that had to have been brought up early.

I use Signal with people I know IRL. I haven't found a good alternative for people who I don't want to share my phone number with. People recommended me Matrix, but none of the clients have been audited and encryption is optional instead of required. I saw an instant messaging service that was open source and based on Signal's protocol, but also used some of the quantum-resistant encryption algorithms. I'm thinking of switching to it, or similar, once the NIST has finalized recommendations for the industry standard quantum-resistant algorithms. Unfortunately, I can't remember the name right now. I'll search for it after work and report back if I find it.

I use XMPP and matrix, xmpp is a messaging protocol so you can use anything you want with it, if you have at least 10 braincells you use XMPP with OMEMO/OTR/OpenPGP If you believe the people who audit then think about who those who audited it are and maybe audit the client yourself

>>55512 Because most people aren't criminals who use Tor to hide their illegal activities, because most people aren't journalists or whistleblowers who require anonymity, and because most people aren't internet trolls. They are comfortable with using their real name on the internet because they know as long as they aren't doing anything they aren't supposed to do, they will be fine. We are no longer in the year 1999.

>>55518 >because they know as long as they aren't doing anything they aren't supposed to do, they will be fine. very good! Just keep repeating that while we slowly make it impossible to be anonymous for any purpose at all. BTW, wouldn't you feel safer if all encryption had backdoors? Think of the children!

>>55518 >because most people aren't internet trolls But there are internet trolls and nutcases who will harass you "for the lulz bro" or commit violent against you IRL. Two friends of mine were stalked IRL by someone who doxed them.

>>55469 I use Signal with all of my meatspace friends and family. I text exactly one (1) person without Signal and that's my boss, because fuarrrk that dude. With all of my cyberspace friends I use Jabber and IRC.

XMPP is notoriously insecure and was not designed with privacy in mind. Like email, encryption is optional and can only be used if both the sender and recipient supports OMEMO encryption. XMPP stores everything including your passwords in plaintext. Most XMPP clients leak your timezone and system information which can be used to identify you. Stay away from XMPP and stick with reputable messengers designed for privacy such as Signal. https://infosec-handbook.eu/articles/xmpp-aitm/

>>55518 I like to talk to online friends about cryptocurrency. I have found that even after talking to someone for years, they can end up being psycho and dangerous (same can be said for IRL people). Not being anonymous in such situations is a genuine danger. https://github.com/jlopp/physical-bitcoin-attacks

>>55720 >You mean the one that uses a very identifying bit of PII as its fundamental authentication token? It's also quite unimpressive. I don't really use Signal to talk to people who don't already know who I am.

I use whatsapp because the people I talk to use whatsapp and I don't have the wherewithal to convince them otherwise. It's not like I'm doing anything illegal over whatsapp, so I just don't care. If I wanted to communicate sensitive information that may indict me, I'd probably do it over Matrix with PGP signatures. But I'm not cool enough to be a cybercriminal so I will languish in the botnet for now.

>>53352 Blabber is unusable and looks crap. Just use the stock conversations with your own server.

>>56028 Self-hosting an XMPP service requires a lot of maintenance and IT experience. You need to constantly add and maintain security features. XMPP, unlike Signal, was not designed with privacy in mind. For these reasons, self-hosting XMPP is actually less secure and private than Signal or any other instant messenger. Signal and ProtonMail are all trusted providers because they build their services with the user's privacy in mind. They constantly innovate and enforce security and privacy features such as E2E by default. XMPP doesn't use E2E by default and it never will since all XMPP clients and all XMPP providers would have to support OMEMO, and most clients do not have it available by default. Without E2E, XMPP is potentially worse for privacy than WhatsApp. With E2E, it's mid tier at best.

>>56066 Shiiet man, you should tone down your LARP. It's getting annoying after a year.

session looks kind of weird to me because there's a crypto token attached for some ungodly reason. It has something to do with "you get crypto from running a node but you need crypto to run a node"

>>55720 >At the extreme end, XMPP would become nothing more than a transport for an entirely different application protocol on top of it. This is the thing, you can build anything you want on top of XMPP. I would love to see a tracking-fork of Signal, for instance, modded to use the user's own XMPP host as the backend instead of [strike]SMS[/strike] an AWS VPS rented by Moxie Marlinspike. But XMPP as-is is a miasma; it'll take someone making a "packaged product" and just saying "standards-be-damned; I trust Pidgin to track my changes for compatibility and the rest of you all can continue to rot as you are" if there's any hope of it being useful. (cf the relative success of Matrix.)

>>56111 You don't get arrested just for following a twitter account. The lad was outed by a journalist who used some OSINT tool and figured out his gmail account using that.

>>56140 >You don't get arrested just for following a twitter account. you do if it leads them to some actually incriminating evidence (i.e. if they can look up your IP based on twitter's data) >journalist who used some OSINT tool OSINT means exactly the kind of soykaf like looking at followers of an account.

>>56141 that would be circumstantial at best. what i am saying is the journalist talked about what he did and how he was caught. >OSINT means exactly the kind of soykaf like looking at followers of an account. Yes, but what I'm referring to is a technical OSINT tool that revealed contacts of protonmail account when you input a protonmail account. I don't know the name of the tool though.

>>56141 Besides, the police had arrested 3 people from different states for this case. 2 of them were wrongful arrests. the one who got arrested because he followed the app's twitter account wasn't even the person who created the app. Neeraj Bishnoi is the person who created the app and hosted on github. he only got arrested after a journalist figured out his personal gmail from his protonmail address.

also, making a bunch of money and retiring isnt as hard as it sounds if you move to cheap third world country

>>56145 it's not OSINT if it involved an actual hack, such as retreiving a protonmail user's contacts.

>>56066 > Protonmail > Trusted > "ProtonMail deletes 'we don't log your IP' boast from website after French climate activist reportedly arrested" https://www.theregister.com/2021/09/07/protonmail_hands_user_ip_address_police/ > "If you are breaking Swiss law, ProtonMail can be legally compelled to log your IP address as part of a Swiss criminal investigation." https://www.bbc.co.uk/news/technology-58476983

>>56164 All providers, including ProtonMail, Tutanota, CTemplar, Posteo, Mailbox.org, Riseup, Disroot, and Cock.li, must comply with court orders and their jurisdiction and this includes logging IP addresses. This can be mitigated by using Tor or a VPN.

XMPP is not a real technology. it's some wise guy wanted to implement "trivial thing" while making a business around it so he had to add as many features and bureaucracy (such as garbage long specs that don't actually formalize anything despite that sorta being the idea of why its long in the first place) as possible the purpose of XMPP is for garbage like fortnite to use to implement chat because it's """battle tested""" and """implementing trivial thing ourselves is too hard""" and still get everything wrong because you can't even integrate that crap properly because its API does not match your use case and as a result you get soykaf like: - people being able to change their names to something other than their in game name - people being able to join channels of other people - being kicked off chat due to some arbitrary policy of the XMPP server which is irrelevant to the game - quitting the channel due to disconnect (which itself can happen for all kinds of reasons other than the connection being bad due to the vast amount of bullshit mechanics you never asked for in XMPP), which wouldn't be a concept in an actual real game where chat is simply 1 line of code that sends it through the same channel you're already connected to the server with and takes a fixed amount of space in your client tick all of the above is the purpose of XMPP. it was never intended to be used as a real chat medium. it's an enterprise do everything package that some vendor will buy with their monthly budget they need to burn to make themselves look productive.

>>56176 So what's the point of ProtonMail, other than to attract attention to yourself?

>>56178 Interesting perspective, I used to think it was a freetard version of ICQ after every corp made their proprietary clone in the late 90's (kind of like 2010's whatsapp and it's derivatives), some XMPP clients still have those ICQ-ey email dialogs, looks derp. Also, early game session chats were based on IRC, is that not minimal enough? Here's more hilarious game chat stuff: some chink MMO has a whole fkin web browser rendering it's chat and it was rightfully exploited: https://www.engadget.com/2017-11-11-tera-mmo-chat-vulnerability.html https://web.archive.org/web/20180124210955/https://docs.google.com/document/d/1reZz6MGHQg_IFUfX__knCQVkvbDnGv384Afj1E3QU6E/edit

>>56290 irc based game chat is also braindamaged, and no, not every old game does that. both irc and xmpp based game chats are commonly exploitable too. web browser in game is the next level of braindamage

>>56406 IRC. Seriously, when some of the Derpibooru staff's accounts got derezzed they moved the discussion to a canternet IRC channel. IRC is hard to beat.

GNU/Jami is my favorite pick, since it gets rid of the middleman by being purely p2p and is endorsed by the GNU project. It's still rough around the edges but I love it.

Signal fuarrrking is like kicking dead whales down the beach it is centralized and requires your phone number you should use IRC or XMPP glitterboy >>56436 >Derpibooru fuarrrk no.

>>57650 It's an obsolete version of Ponybooru based out of Langley.

>>50336 >>50390 Manyverse could be considered a continuation of this idea. It uses Bluetooth and Wifi to connect to local users.

>>57650 >What's Derpibooru Some cloudflared mlp forum that won't function without enabling JS. Don't go on there. There is CP and incest on there.

>IRC Install weechat or Irssi. Use Hexchat if you want a GUI. >>57649 >>57650 >XMPP client >Dino In addition to Dino, there is Pidgin. >>57913 >>57650 >>56748 >>56436 >Derpibooru There is now https://ponerpics.org/ which is better.

I see I haven't mentioned Pest in this thread yet: http://www.loper-os.org/?cat=65 The basic idea of this is a UDP-based floodfill network based around a small Web of Trust.

>>56443 How's Jami for solely chatting? Trying to get the few people I talk to locally to move away from Discord.

>>57928 I'm glad to see Pest is actively being worked on still; I remember stan posting about it awhile back and expected it to just be a thing he was proposing as an idea for a P2P chat protocol. I might give it a go at making an implementation in CL.

>>57916 Konversation is decent if you want a GUI client. > ponerpics.org ponybooru.org is also a decent alternative run by ZizzyDizzy.

>>58121 >Ponybooru.org This one. It's the only one I could find that wasn't cloudflared. As long as you never post or do anything but read, no JS is required.

Ok why is everyone talking about pony image hosting sites? Top tier : XMPP High tier : IRC Mid tier : Matrix, Session Low tier : Signal Bottom tier : all other IMs

>>59179 You can always run a messaging server that is only LAN-accessible.

>>59179 https://en.wikipedia.org/wiki/Comparison_of_LAN_messengers

>>59401 There's also only one client. So it's centralized in that way.

>>59404 >>59427 >>59450 Signal has many clients. Molly and Molly-FOSS being the two most popular for Android. https://molly.im/download/fdroid/ (The difference being the use of Firebase messaging for lower power consumption notifications in the open source but non-FOSS version) I've used many different Signal clients, including a command line client for signal to signal E2E server notifications.

>>59633 Signal CLI command line client for libsignal: https://github.com/AsamK/signal-cli There's even complete forks of Signal client and sever which are also open source, like Mixin https://mixin.one/messenger (note Mixin is not compatible with Signal since it's an entirely different back-end server environment)

>>53352 Blabber is useless as are most of the derivatives for this simple reason. InputMice refuses to do the usability step all other popular clients do. https://github.com/iNPUTmice/Conversations/issues/3081 Unlike Gajim or Dino, if you cannot retrieve an omemo key from a user you are unable to use a MUC unless you go unencrypted.

>>61983 just don't message people you don't like.

>>61983 Why not Signal and Mastadon? If even those don't pass then write your own. I'll be working on a new social network shortly not based on anything pre-existing. fuarrrk data collection, you want to be stupid and put your real name somewhere you take responsibility because I'm not asking for it, and keep your email too, I don't care if you use my site, and if you use it regularly enough you'll either see the changes or read about them, you're not getting emails about updates or emails what your friends are up to, talk to them or read their posts. I've tried to use social media myself so many times and I literally have no idea what to do when I get there; I have basically no friends in the meatverse, all my real friends I've met gaming, so what am I supposed to post to nothingness? The cup of ramen I'm eating for dinner because I'm a wage slave? tl;dr use signal and mastadon.

>>62330 Try getting normals to use Session or whatever other leet hacker app you use. Signal is much easier because they're used to stuff like it. I use Signal as my main way of communication with them, it's certainly not perfect but much better than SMS or d*scord. These people already have my phone number, not having a username/address is one less thing for them to forget.

I think what's mostly missing from quite all the privacy-friendly messaging services is features. Discord is undeniably the best when it comes to this, but almost no alternative is like it; only Matrix comes close. Still, I personally do not believe the way Matrix or XMPP handle decentralization is the best, since it adds a lot more third party servers to the equation (even ones with undesirable privacy policies, such as matrix.org), which can potentially affect everyone's privacy, thanks to all the metadata available. I see P2P-based alternatives such as Briar as a much better way of doing decentralization. GNU Jami also looks interesting, though it works a bit differently. Anyways, what I wanted to say is that we already have strong privacy-friendly solutions. Now we need to focus on features (having multiple channels per server like Discord does would be a great start).

>>63263 This is a decent list of open servers: https://joinmatrix.org/servers/

Use IRC Get Hexchat (a GUI client) or Irssi and go to https://www.lainchan.org/irc.html Xchat is dead and Hexchat is better anyway (actually, Hexchat is the best GUI IRC client). Some IRC tips * Turn off automatic away messages. Don't constantly change your nick. Don't change your nick when you go away. * You can use https://netsplit.de/ (or a searx instance) to find networks and channels. Most FOSS projects use Libera network and weeaboos use Rizon (https://www.rizon.net/). * Request a cloak from the IRC network (check server's website, in the process is completely automated using a bot: https://libera.chat/guides/cloaks). * Don't ask a permission to ask. Don't ask if anyone is online. Just ask your question/post your message. * Don't flood, instead use a pastebin service (for example: https://dpaste.com/) * Don't use colors or bold (but some channels may allow these) * Don't use scripts that talk. * Disable auto-rejoin (there is a reason if you get kicked). * An IRC Network consist of many Servers that have exact same channels (with same messages and users). * For maximum anonymity, connect using Tor: https://libera.chat/guides/connect#accessing-liberachat-via-tor * Irssi can have multiple "windows" that can be cycled through with CTRL+n and CTRL+p Use ALT+n or ALT+p to scroll a window. PageUp/PageDown keys also work. some IRC commands that you need to know Whatever you type gets send to the channel by default (IRC commands start with a /). There are some IRC commands that you need to know. IRC commands won't be seen by other users. > /help [command] For example: /help me Displays the help. IRC clients have their own commands, too (for example: https://irssi.org/documentation/). You can use /help for both standard IRC commands and client-specific commands. > /nick foobar change your nick to foobar > /join #baz join a channel called #baz > /part disconnect from a channel > /quit quit IRC. /discon or /diconnect can be used to disconnect from a server. > /msg tux message send 1 private message to tux >/msg NickServ HELP get help with registering your nick (the name of the bot varies between IRC networks) > /away [message] mark yourself away (with optional message).

I need encrypted privacy respecting discord alternative for discord, for voice chat I tried xmpp, matrix, telegram their all voice chat is terrible

>>63754 >alternative for discord discord doesn't have any serious competitors at the moment >encrypted privacy respecting voice chat mumble

>>63761 https://midov.pl/ that server

>>63625 Note: If you are using irssi, /msg and replies to it won't start a new window, but will be found in the status window (`/window 1` or `/win 1`) and you will have to use `/msg nickserv` repeatedly. To launch a new window where you can simply type commands to nickserv, use instead `/query nickserv help register` or `/q nickserv help register`, or `/q nickserv` then type `help register` in the new window. also have some aliases https://termbin.com/jtnv

>>63625 Great intro and summary, lain. Any non-dead programming/security channels and servers you'd recommend?

>>63808 You can use https://netsplit.de/ or your IRC client's /list command for finding more channels. >Any non-dead programming/security channels and servers you'd recommend? Most FOSS communities use Libera (there are also channels for popular programming languages like #c and #lisp ). For offtopic chat, I recommend #archlinux-offtopic and #gentoo-chat and #linux I think you could also try #programming (irc.lainchan.org at port 6697) it definitely has some potential but it's pretty dead at the moment. The only security related channel I know is #security @ Libera

>>63863 I have not tried to setup or manage a matrix instance myself, but I can say that prosody was easy to setup and maintain. There are many guides on it, so even if you aren't particularly used to the command line, the guides can help you out. I will metion one gripe I had about XMPP and that is the lack of standardization. This could turn into being a real problem if any of your friend group decides to not use similar clients. For example, I was having issues using profanity (CLI) and ended up having to use Psi+ (GUI) just so I could have OMEMO, despite profanity claiming to support OMEMO. >>63924 Self-hosting XMPP and Matrix servers are always the best choice. The second best would be to find one that allows you to use tor, then just torify your usage of their service. >>63925 This is conflating privacy and security. The server may record your ip address and whatever else that can get through. >>63938 They seem about the same, if I'm honest. t. irssi user that uses weechat for other things

>>63863 isn't matrix a honeypot...?

>>63975 Sorry, let me rephrase: I am currently running an email server. I would like to add chat on the same server.

>>63971 Why do you say that? Lain is going to be self-hosting the matrix server so they'll have full control over the configuration and data. Matrix has some privacy concerns due to how it federates and bridges, but configuration can remove those concerns.

New paper on some gnarly exploits that left Matrix chats vulnerable to a hostile homeserver. The researchers contacted Matrix in advance, and the worst holes have been fixed (matrix org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients). Not educated enough to read anything critically, but it seems to have been managed pretty well, more of an embarrassment than anything. >>63971 everything is a honeypot. theres actually zero difference between good & bad things

Is using molly.im a good idea? Am I opening myself up to further attack vectors by not using the official client?

So I am curios , is there a way to chat without Whatsapp? What I mean is that I want to keep contact with a friend of mine and delete whatsapp. I know SMS exist but it is filled soykafty notifications I couldn't care less about. I need to way to chat with a friend without Whatsapp.

>>64359 So if I have his contact number I can use XMPP to talk to him? Doesn't he gonna need XMPP as well?

>>64369 Meh , most friends are lazy af. They have a habit of using WhatsApp so transfering to XMPP is gonna be a pain in the booty cheeks.

>>64377 >Meh , most friends are lazy af. >They have a habit of using WhatsApp so transfering to XMPP is gonna be a pain in the booty cheeks. it's sad. but a reality. they can't understand or want to make sane choices of technology. the only downside to XMPP is that they have to pick a server to register with other than that, it's very easy and smooth sailing.

>>64385 the only modern xmpp clients are for android and linux so thats not optimal compared to even matrix having element availavle on windows

Why promoting XMPP which always need servers bc he is only decentralized, when P2P solutions exist (Briar, GNU Jami) ?

>>64465 Because you have to be online to receive a message. It works if you only use your pc to communicate but you already know most people use their phone.

I need a P2P/Federated E2EE IM App where i can find new friends (so not XMPP bc no one use this, and so with public groups to find people to talk with) because i don't have any even IRL. I don't care about VoIP i don't use that at all. I saw Session but since it depends on australian law i don't know what to think about it. Which IM should I use for what i search ?

>>64629 Matrix and Pleroma are the closest thing, but you should look everywhere, and if you find a good community of good people you should hold your nose and join regardless of whatever soykafhole hellsite it's on.

>>64834 "NOTICE: This document is Humorous. It MAY provide amusement but SHOULD NOT be taken seriously."

>>64932 lolispace.moe there's your list

>>65372 You need to use Tor or a proxy. >https://libera.chat/guides/connect

>>65372 Either what >>65383 said or use a vhost

How secure is Tox? What would you say is the most secure messaging app?

What should I look for in a secure messaging application?

>>65986 >What would you say is the most secure messaging app? Probably email+gpg (copy and paste the encrypted text to your client/webmail) but I have heard that Tox is good. I also recommend you look into OTR messaging. Is Cryptocat still alive and is it secure? (I remember it having a vulnerability but I don't know if it has been patched). Also, Signal and Matrix are pretty good for normal people. >>65989 * Is it open-source? Can you or someone else run a server/instance? * Does it use encryption? Can you generate your own key yourself? (important) * Does it use homebrew crypto? (very bad) * How much meta-data is sent or stored? * Does it require a phone number? (very bad) Does it require account or email? * Can you use Tor or proxies?

>>65991 How about sharing a 1GB random data block with the person you want to communicate with and then using that block as a One Time Pad and having literally perfect security?

>>66088 the only downside I could see is that it would be easy to verify who you were communicating with, because you would each have the same unique 1gig, but not what you were communicating

>>66088 no authentication upon decryption and you need a secure way to transmit the 1GB key in the first place. just use a modern AEAD for lain's sake.

For XMPP, is there a server that is the most anonymous, private, and secure out of all XMPP servers?

https://github.com/igniterealtime/pade/releases/

>>51612 - Lack of a strong marketing campaign: XMPP was developed by a consortium of volunteers and open-source enthusiasts, rather than a large corporation with the resources to promote it widely. As a result, it never gained the same level of visibility and recognition as other messaging protocols. - Limited compatibility with proprietary platforms: XMPP is an open-standard protocol, which means that it can be implemented by anyone. However, many popular messaging platforms, such as Facebook Messenger and WhatsApp, use proprietary protocols that are not compatible with XMPP. This can make it difficult for users of those platforms to communicate with users of XMPP-based systems. Lack of incentives for adoption: Unlike some other communication protocols, such as SMS, XMPP does not offer any direct financial incentives for adoption. This can make it difficult for XMPP to compete with other protocols that are backed by large corporations with the resources to invest in marketing and development. - Technical challenges: XMPP is a complex protocol that can be difficult to implement and maintain. This can make it challenging for developers to create XMPP- - Competition from proprietary messaging platforms: XMPP faced strong competition from proprietary messaging platforms, such as WhatsApp, Facebook Messenger, and iMessage, which have gained significant market share and have become the dominant way for people to communicate online. These platforms often have more features and a better user experience than XMPP, which makes them more attractive to users. - Lack of interoperability: One of the key features of XMPP is its ability to interoperate with other systems and protocols. However, this has not always been the case in practice, as different XMPP implementations have not always been compatible with each other. This lack of interoperability has made it difficult for users to communicate with each other across different XMPP systems, which has limited its adoption. - Security and privacy concerns: XMPP has been criticized for not providing strong enough security and privacy protections for its users. In particular, the use of plaintext XML for message formatting has been criticized, as it allows for messages to be easily intercepted and read by third parties. This has made some users hesitant to use XMPP for sensitive communications. These are just a few potential reasons why XMPP did not

Is there an official lainchan matrix server/room?

>>67436 No. We use irc with tls. Due to being asked multiple times about this, I'll bring this up in the AGM this year.

>>67442 >r/a/dio I prefer pre-2020 era. (fuarrrk doogle btw) I have the beyond the fallback mp3 still, and tricked trip into playing nigzbop while he was piss drunk lol >lainchan IRC Kino, most of the retards left so it's quiet and nice. Even N33R calmed down.

>>67538 P2P messengers without relays are useless (for day to day usage). Want to send something but the recipient isn't online? Ya better keep the program running until they do!

>>67538 Briar looks interesting at a first glance. I'll have to read more into it. Devs who have contributed to i2p and freenet. Do you know if there's been any code audits or cryptan-alysis of it? I was on /g/ back when Tox was born and the threads about it and some of the initial contributions weren't inspiring, so I have had it written off as meme software since. I may have been wrong to do this. I'll look further into the current state of it. Thanks lain.

>>67545 unfortunately i don't know, i just asked out of curiosity. i heard it the first time when documents "leaked" of chinese police sending people using it to reformation camps . but it's also recommended on prism break. maybe someone knows better here. and holy fuarrrk tox was born on /g/?? no need to thank me lain!

>>67550 One of the guys who made Tox was a staff member here... and 14 at the time.

>>67447 since you mentioned lainchan IRC, why is the server so slow? i've been trying to connect and it ends up not connecting fkr taking too long

I basically just want a good and secure way to communicate with friends and family without SMS, Discord, or matrix.org. Maybe I should self-host XMPP (though I've had issues before) or even use public XMPP instances?

People who self-host or use decentralized platforms, do you take any precautions to separate different parts of your life, or have "more official" instances?

matrix and xmpp are cool and all but it would be nice to have anyone to talk to

>>68567 Do you have friends you could try to convince to switch to XMPP or Matrix? If not or your friends refuse to use them for whatever reason there are plenty of public rooms to chat in with active users. This website has a list of XMPP rooms. https://search.jabber.network/rooms/1 And this site has a list of public Matrix rooms. https://view.matrix.org/

I used to think that XMPP and Matrix were the optimal messaging platforms, but it seems they both have some issues. Now I am thinking of settling on IRC and Jami. But it seems they both have the possibility of messages not being received... unless one has their messaging client running constantly, like IRC+SSH+tmux. (I assume one could also just have Jami running on a server/relay (I need to learn about those) at all times) Also, how does P2P like in Jami work, if there are not IP addresses with forwarded ports for others to connect to?

>>61983 >tox where do you get people's tox id?

>>68443 Phone number required, that alone is a huge problem for most 'privacy conscious' individuals. It's better than plain SMS though yea, or at least better if you care about spooks having the ablity to intercept and read what you send or receive etc.

>>71586 Same thing, it jus has 2 names

>>68443 I had messages just not get received by the other party and i didnt know. I confirmed this by seeing the other phone. Basic functionality catastrophically failed and damaged my relationship with the other person. This seems rare but it happened to me so i hate it

>>72044 hint: you will not body too short body too short body too short body too short body too short body too short

>>72643 ProtonMail don't support SMTP without paid. btw. anyone can suggest jitsi with JWT except official instance?

>>57928 >>57928 I messed around with some of the implementations that have been written, but I couldn't find any method of joining the currently active pestnest. (As seen by the logotron, and is said to exist by the v. 0xFB post) and the discord link is also out of date, if anyone has any knows how i could contact someone in the pestnest so that i could peer with them, that'd be nice

>>67436 cutefunny.art is pretty good. how popular is lainchan among notable internet personalities anyways?

>>74639 Hey. I'm still working on mine. Join the IRC channel and go from there. Here are instructions on how to join: http://logs.nosuchlabs.com/log/asciilifeform/2021-06-15#1039330

>>72643 Go to a public library/university and make a Gmail there. If they ask for a phone number then you might just have to drop $40 and a burner phone + 3 month plan

Haven't seen this news posted anywhere yet, but a few weeks ago Signal started publicly esting ephemeral usernames. With it, you can generate as many usernames as you want, share the username with people instead of your phone number, and the usernames themselves are never stored on Signal's servers https://community.signalusers.org/t/public-username-testing-staging-environment/56866

>>50341 According to the web search results, it is possible to connect several DCC users in one IRC chat, but not in the same way as group SMS. DCC stands for Direct Client-to-Client, and it is a sub-protocol of IRC that allows peers to interconnect using an IRC server for handshaking, and then exchange files or chat privately over a direct connection¹. DCC connections can be initiated in two different ways: using CTCP (Client-To-Client Protocol) to send a request over the IRC network, or connecting directly to the DCC server without involving the IRC network¹. To connect several DCC users in one IRC chat, you would need to use a DCC server that supports multiple connections, such as mIRC's DCC Server⁵, or a DCC protocol extension that allows group chats, such as DCC CHAT/SERV⁴. However, these methods are not widely supported by other IRC clients, and may not be compatible with some IRC networks or firewalls¹⁴. Therefore, you may encounter some difficulties or limitations when trying to connect several DCC users in one IRC chat. (1) DCC - mIRC. http://www.mirc.com/help/html/dcc.html. (2) mIRC Help. https://www.mirc.com/help/html/index.html?dcc.html. (3) Undernet IRC Network - Documents Project. https://www.undernet.org/docs/dcc-protocol. (4) Direct Client-to-Client - Wikipedia. https://en.wikipedia.org/wiki/Direct_Client-to-Client. (5) EmacsWiki: Internet Relay Chat. https://www.emacswiki.org/emacs/InternetRelayChat.

>>55518 >As long as they aren't doing anything they arent supposed to do Near word for word what the head staff at google had to say about internet privacy and security If you dont care about revealing personal information on a platform open to billionso of users, why are you on an anonymous image board in the first place? Besides everyone has a right to keep their personal business and comms away from the prying eyes of massive corporations and large governments. smh

>>74680 >pedo community is there a good matrix server that ISN'T for degenerates? Just for people who find discord too invasive/bloated/full of stupid furry children

>>67436 >>75365 no lainchan server. but the following are decent, and ran by people i met on lainchan https://pixie.town/matrix/ https://cyberia.club/matrix please don't be awful there. >>74680 >how popular is lainchan among notable internet personalities anyways? many are familiar. some claim they used it in "the good days" of 2014-16 but that's become the easiest thing to say so poseurs say it now too.

>>75366 Registrations are closed on pixie.town and cyberia.club seems to be down :( I just wanted to lurk somewhere nice

>>75368 There are plenty of instances of "audit" mentioned in this thread, lainon. For clarity, this is the same thing.

>>63854 >irc.lainchan.org at port 6697 how to connect? I keep receiving connection refused when try to connect to that irc

>>56443 what is character name on the pict?

>>75454 That's very vague, post a screenshot or copy the error text.

>>50334 I need to communicate with normal people, that's the problem, that's why I use Signal.

>>75758 >Behaviorally, almost every messaging program is used as a totally synchronous program. ?? Do you only talk to people with ADHD or something? I regularly read and reply to messages that are multiple days old

>>63771 anyone else using this? seems ok compared to signal, no phone number needed

>>50332 There's also https://delta.chat/ — IM over email. All messages are end-to-end encrypted by default, there's support for webxdc (html "apps" that are bound to a specific chat and can only use that chat to communicate with outside world), there's a bot SDK. You can use your existing IMAP account, or you can join in one click using chatmail — community maintained email servers that allow anonymous registration, but prohibit unencrypted outgoing emails.

>>80999 This was changed earlier this year. You can now give out a "username" (it's a contact code, not a username) instead of your phone number. You can also block people from looking you up on Signal using your phone number. https://signal.org/blog/phone-number-privacy-usernames

Why is nobody talking about RetroShare? http://retroshare.cc/

Why is noone talking about SimpleX? It's perfect

>>81323 SimpleX is perfect apart from >limited text formatting (no code blocks, no latex) >messy UI (rooms and friends on the same menu) >little to no spam protection (afaik) >no way to search for rooms apart from using the soykafty directory bot >having to create separate profiles for each of your devices >needing to wait for any group owners to be online before you can join yourself

RCS is great in that it just works, but terrible in that it only works with servers run by the duopoly of Apple and Google.

>>81327 >Seperate profiles. You don't understand clandestine cellular organisational structure and Counter-insurgency metadata linking intelligence SOPs.

>>53352 cheogram is one of the better XMPP clients out there

>>81323 just be careful not connect to their own servers, lest they use a bot to infiltrate your group, and ban you without even being able to see (supposedly) what you posted https://simplex.chat/blog/20250114-simplex-network-large-groups-privacy-preserving-content-moderation.html https://github.com/simplex-chat/simplex-chat/blob/stable/docs/rfcs/2024-12-30-content-moderation.md >>81327 and the funnies one yet >nO uSeR Eye dEez wow, very useful, so now I have to send the temp link over insecure channel, or go in person from Italy to Singapore in order to establish secure communication but here's the funniest part: you CAN get an ID, one click in the settings, but no human readable one; those are le evil. Jami has them >>81329 yeah the buzzword bingo doesn't inspire confidence either What simplex has done is instead of finding a way to fix Session's last encryption hole/blind-spot and find a way to encrypt the "to:public_key_here" header, instead opted to create a new pair for each chat, which sounds brain-dead, because it is.

>>50869 not that lain but tried movim once, very interesting concept (can do screen sharing, voice calls, IM stuff, also works as a blogging platform somehow) but dunno how well it would scale up.

I live in country where you're basically forced to use whatsapp if you wish to participate in society at all. I'll be leaving for europe as soon as I'm done with college and one of the things I'm looking foward to is being able to use a flip or some other less intrusive phone and still be able to message people through SMS... People use SMS in europe, right? Incidentally, would anyone happen to know a way I could use whatsapp without owning a phone? Through my computer only? That way I could ditch the spying device that was coerced onto me while still maintaining a connection with the outside world.

>>85897 split your digital life in two: one with a smartphone, whatsapp, banking, and every other mobile garbage app; asume that one is being spied on constantly. Turn it off and wrap it in aluminum foil when not in use one with a laptop/desktop/USB, idc, one where everything is open source and trusted That's how I've been doing it for the past three or so years. Made an instagram account to have a way to message my friends and family without my phone. I know, I know Insta's not encrypted, but let's be real for a moment, neither is whatsapp. (derezzed for the admin changing a group name)

>>85900 Or get dumbphone and use it for govt soykaf and banking but then get a google pixel and use for apps. Then use desktop computer for everything else u need private or just use that over a computer phone ideally.

>>85900 As hard as they are trying, there is very little that cant be done vpning into an encrypted VM desktop clone you spun up on demand, on a fully disk encrypted machine, that regularly runs zero out or random out scripts to make any deleted VMs unrecoverable.

>>85902 >>85905 too much hassle, android phone for SIM calls, SMS, Whatsapp, banking, and taking pictures; offline win 7 PC for games; laptop running Manjaro (+OpenSnitch) for everything else That's my setup. Ain't no separation like physical separation.

>>74764 >the usernames themselves are never stored on Signal's servers According to https://signal.org/blog/phone-number-privacy-usernames/ usernames are stored, just hashed and hard to look up. They should have named it something else instead of having to explain multiple times that their "usernames" don't function like "usernames" everywhere else on the internet. >>57928 >>74639 >>74682 Maybe not relevant, but what's with these pest guys all refusing to use TLS? Seems like a red flag. What protections might they leave out of the protocol because "pshh, you don't need that"?

>>86446 >what's with these pest guys all refusing to use TLS Imy guess is that it's because TLS requires root certificates, ie trusted authorities >Seems like a red flag seems like a green flag to me. the I2P, for example, uses SSH, and is doing fine

>>86461 >the I2P, for example, uses SSH, and is doing fine You may notice that those are not I2P urls, or onion urls, but normal naked HTTP urls. That is in no way a solution to the problem of certificate authorities. So it's definitely a red flag for an impractical all-or-nothing mindset.

>>86462 gotta be honest, I hadn't heard of pest ever before and wrote that on a whim. >not I2P urls, or onion urls, but normal naked HTTP if so, then I'd rather not look into it; as it seems to be an amateurish waste of time

>>50827 You can use cheogram.com to route all of your sms to xmpp. You have to pay for a voip number, and contact management is a bit of a pita, but it's the only solution I know of that's cross-platform, client agnostic, and doesn't require you to onboard a bunch of tech illiterate normal people.

>what's with these pest guys all refusing to use TLS www.loper-os.org has TLS, if you prefer it set your browser to force HTTPS, it just works. logs.nosuchlabs.com, a public log of ancient dead public chatrooms, doesn't have TLS. >red flag Reading a small static website without TLS has little to no security and privacy impact. Green locks don't mean much, most servers are compromised by relying on third parties like the VPS provider with access to TLS private keys, TLS terminating proxies, certificate authorities. You only care about your browser yelling insecure, but this website doesn't need TLS that much because there are no credit cards, passwords, session cookies involved. TLS wouldn't prevent the ISP from knowing what you do, the server IP address gives it away. The only issue I see is leaking search queries to potential eavesdroppers. Should they turn on optional TLS with Let's Encrypt like loper-os.org? Yes, but it's fine without it. >>86461 >I2P, for example, uses SSH It doesn't use SSH. An example: ‣ b4da7403ea85e3564731f271a7d16d0e6aea93a6e7c46db05a126db4fa4168d1 is Lainchan's current TLS public key SHA-256 fingerprint for the secret private key stored on Lainchan's server. ‣ A public key and the fingerprint cannot be forged, nobody can create a private key that outputs the same public key. ‣ On the Internet we use third party certificate authorities to prove that b4..d1 is the lainchan.org domain's public key, because normals can't wrap their heads around a hex string. (They can't even tell lainchan.org apart from lainchan.lain.org but that's a different story.) ‣ I2P Lainchan's address that you put in the browser would be the public key fingerprint, b4da7403ea85e3564731f271a7d16d0e6aea93a6e7c46db05a126db4fa4168d1. The public key is the address itself. (Simplified but basically true.) ‣ I2P doesn't use the TLS or SSH protocols, it's a custom protocol with raw encryption. Verifies the host's certificate the same as TLS or SSH. ‣ I2P end-to-end encryption is built in and all connections have it. Unlike this Internet we're using where we have http/https ftp/ftps, on I2P there is no http and ftp, only https and ftps. http:// only means the browser is connecting to your local I2P node over http, but everything that leaves the computer is encrypted. ‣ I2P doesn't rely on certificate authorities or any other trusted party. To stay on topic, the most private and secure messenger is dead simple: connect to each other's IP, I2P or Tor addresses, authenticate, then send text. It's been solved forever, use Linux and Tox protocol, I2PChat, Ricochet, they're P2P and have no obvious flaws. Phones are all compromised because of the proprietary operating system and cloud integration, nothing on a phone is private or secure. It's that simple, but normals will use the soykaftiest corporate software imaginable because of marketing and convenience. Privacy larpers will fall for the latest leaky meme app they're vibing with on their Google or Apple phone, again because of marketing and convenience.

>>85897 You can simply use whatsapp web through your computer. Some guy made it work on old nokias, if you're interested : http://nokia4ever.com/ It's still a wip though. You'll still need a smartphone to log in, but once it's done, you don't need to touch it or keep it on at all.

>>86608 >most servers are compromised by cloudflare, the main malware infecting the web The communication programs you listed (Tox protocol, I2PChat, Ricochet), will never get any traction, because they're not convenient. Cope all you like, but unless your messenger has video calls, groups, and can be easily installed on mobiles, no one other than you and the devs will use it. "normal" "people", even the most privacy conscious of them, are technologically retarded. Why else do you think they convince themselves that it's not that bad and they got nothing to hide? are they really that bland, boring, and uninteresting? or or they telling themselves that in order to escape the fact that they are utterly powerless to do a thing about it, and the psychological toll that this realization incurs? I know I was like them once; but in refusing to turn blind eye to the blatant violations of my sanctity of thought, I find myself having no choice but to join this battle, and learn all that I could, all that I could. Most are not nearly as petty as me, nor are they as inquisitive. A bridge is needed between those of us who want to help, and the rest, who don't even realize that they need said help; and it is my earnest belief that by making that transition accessible for those filthmen, their stench will aid in making us less observable. There is strength in numbers: The Maharaja will always lose against the sepoys. In other words, we cannot blend in if it's just us few in there. In this regard Jami seems promising, P2P, optional usernames (hosted on server of your own choice), has calls, has groups

>>86609 It would have been nice to use WhatsApp on my N95, but when Novel-Professor3366 asked me to log in to his server, I gave up. Hell nah.

>>86611 not the anon you've been responding to but while I appreciate how dramatically you've worded this, I don't think installing a different program makes someone that much more tech savvy or really elevates you to some kind of enlightenment over the unwashed masses - its moreso a matter of how much time you're willing to spend installing software and worrying about it functioning, which i feel can be broken down into startup time, platform support and the friction of using it. to that end, the tox protocol was founded with the explicit goal of making privacy accessible in this way. while it doesn't seem to have panned out I'm glad the project is still going. I haven't tried jami at all but their forums at least seem somewhat intelligent.

>>86616 First and foremost, thank you for complimenting the way that I talk; but allow me to the back to the topic at hand. Of course, I agree that installing some programs does not making me better than anyone else; and neither does looking up configurations and settings. My point is that to the average user, these might as well not exist, therefore we need something that is secure be default, but also intuitive and somewhat familiar, as not to scare away the idiots. Tox (qTox and aTox) lacks calls, that's a regression for most people, dead on arrival. Forums are worthless, evaluate the application by trying it. It's what I do I'd like to eventually not a have an insecure messenger for "normal" people and a secure one for free speech "criminals", but only one secure decentralized (preferably P2P) program that can fulfill the needs of the everyman, thereby rendering the insecure one obsolete and redundant

just dropping this here, could be useful https://eylenburg.github.io/im_comparison.htm

I wish SimpleX were more popular

>>86624 come again? >>81327 >>81329 >>85876

>>85876 >now I have to send the temp link over insecure channel, or go in person from Italy to Singapore in order to establish secure communication How is this different from any other app? "Hey Lain, here's my XMPP/Tox/Jami ID" In fact it's better because the temp link can't be reused. >encrypt the "to:public_key_here" header Is that even possible?

>>86704 >How is this different from any other app? creates a MITM opportunity for EVERY new chat removes the ability to have someone else send you a contact and you still have a unique identifier, but now it's just for that conversation, so the server can still correlate metadata >Is that even possible? short answer: no, not yet long answer: yes, but the entire network then becomes an eternal DDOS attack on itself; making a message that would normal take seconds to reach destination take hours, if it ever arrives. The question then becomes "how is it possible to do that WITHOUT having to attempt to decrypt every single message?" There are works in progress, but it remains unsolved. One approach that's been proposed, for example, is to have that header xor-ed into the encrypted message and only try to decrypt when the result is a valid message results from xoring again; but that only creates a target that can unmasked rather easily, like having an image's negative. Others have proposed encrypting separately, using faster (ie weaker) encryption for the {send-to} portion. It will be solved, eventually. Remember, there was a time where it was thought that a computer program could not load another that is larger that itself, and now bootloaders are not only common, but a essential part of modern computing

>>85876 >just be careful not connect to their own servers, lest they use a bot to infiltrate your group, and ban you without even being able to see (supposedly) what you posted Someone has to report the public chatroom first. This is not any different than being reported and derezzed on an IRC server you don't own for posting stuff that is not allowed in their rules in a public channel. Your problem is actually with the laws in most western countries, the company can choose to be shut down or do this, they don't get a third option. If communities started moving there, they could set up their own servers because SimpleX is self hostable. >wow, very useful, so now I have to send the temp link over insecure channel, or go in person from Italy to Singapore in order to establish secure communication It's meant for people who actually have real life contacts obviously, not random hikkiNEETs on Lainchan. The 1 time link is secure. Using a longtime address is not as secure for the initial invitation as I understand it. >instead opted to create a new pair for each chat, which sounds brain-dead, because it is. If that ends up scaling for large chatrooms and works for multi-device someday then honestly I don't care how it works under the hood. I need some real competition to Signal/IRC/XMPP which all have unsolvable issues.

IM software isnt interesting. GUI toolkits are. the reason all IM software is soykaf is because there are no good GUI toolkits / reliable dependency stacks

If you connected to a bridged IRC or XMPP to Discord is that basically the same as using Discord just without their proprietary software? From what I understand that basically is what it is since it just uses a bot to repost what is written. >>86718 What about them do you think aren't good? How do you think it could be solved?

>>86719 >is that basically the same as using Discord just without their proprietary software? You would get some small amount of anonymity too, because the bridge is basically a one-hop proxy. >>86706 >creates a MITM opportunity for EVERY new chat I guess. The scenarios I can come up with in which MITMing a Simplex connection would be easier and/or more consequential than MITMing a normal username exchange are a little contrived, but not ridiculously so. Perhaps widespread adoption of persistent addresses would fix that issue (and destroy the whole point of Simplex, but whatever). >removes the ability to have someone else send you a contact Persistent addresses would also fix this issue. For me, these are minor problems compared to the slow and out-of-order message delivery, even in groups of less than 10 people. I would sometimes have messages from certain contacts just stop showing up entirely. And of course, the entire key exchange system/process is kryptonite to normal people. Someone has to really want to talk to you to go through all of that.

>>86712 >This is not any different than being reported and derezzed on an IRC how nice of you using such a low denominator for the sake of your argument, but real people use either Session or Briar, neither of which have this issue. >The 1 time link is secure no >Using a longtime address is not as secure for the initial invitation as I understand it. neither is "secure", according to your limited understanding, but a persistent identifier can be cross referenced and verified by trusted third parties. A one time link, by it's very nature, cannot. >works for multi-device someday oh yeah another reason to hate Simplex, thanks for remind me of their "the phone is the main device, please rely on Android and iOS" model https://www.reuters.com/technology/cybersecurity/governments-spying-apple-google-users-through-push-notifications-us-senator-2023-12-06/ >then honestly I don't care how it works under the hood. >I am okay with with being lied to weird hill to die on, but go on champ, >I need some real competition to Signal/IRC/XMPP which all have unsolvable issues. Session, Briar, Jami, and the voices in your head

>>86721 >The scenarios I can come up with in which MITMing a Simplex connection are they? just write a script in your messenger's code to look for simplex addresses and insert your own on the recipient's end automatically in place of the one they sent. keep the original one and only show it to the original person. Auto forward whatever you receive to the og address, but keep a copy. voila; MITM'd the only hard part is being in control of significant enough communication platform, which is a non-issue for twitter, instagram, facebook messenger, viber, and several others >and destroy the whole point of Simplex good riddance. it's effectively the instant messengers version of wayland, complete with security theater and the "you don't need that" mentality >the entire key exchange system/process is kryptonite to normal people yes, YES, YEEEEESSSS, FINALLY SOMEONE WHO'S FROM THE REAL WORLD! AT LAST, A PERSON WHO ACTUALLY UNDERSTANDS THAT NOT ALL COMPUTER EXPERTS! The normal person fears complexity; we either accommodate him, or remain obscure, forever

SimpleX leaks your IP. this is pasted from dread SimpleX Chat Fails at IP Protection SimpleX Chat doesn't take any action to protect your IP from prying eyes. Take a look for yourself: https://github.com/simplex-chat/simplexmq/blob/stable/protocol/overview-tjr.md#simplex-messaging-protocol-server SimpleX Messaging Protocol Server can: ... learn a recipient's IP address, track them through other IP addresses they use to access the same queue, and infer information (e.g. employer) based on the IP addresses, as long as Tor is not used. More Cases of IP Exposure This isn't the only case of SimpleX leaking user IPs when sending a link: https://github.com/simplex-chat/simplex-chat/issues/5122 Thankfully, SimpleX's founder, Evgeny Poberezkin, addressed the issue. However, instead of acknowledging it as a privacy flaw, he labeled it a feature, not a bug: "Given that it is a documented behaviour, it is certainly not a bug, and it is also incorrect to call it a leak – every server you connect to, be it your ISP, VPN provider or Tor relay, can see your IP address, as this is how Internet works." Deflecting the Issue Instead of resolving the issue, SimpleX suggests users take extra steps to mitigate the risk themselves, such as: Using a VPN Disabling link previews manually in settings But as one commenter pointed out: "It is important to state that no other messaging app that we know of considers this a non-issue. Not even Discord or Matrix – both ask a fully (Discord) or semi (Matrix)-trusted server to do the network request on behalf of the client." Strange Justifications for Avoiding Tor Integration SimpleX further avoids integrating Tor, claiming: https://simplex.chat/faq/#why-dont-you-embed-tor-in-simplex-chat-app "The last, but not the least, it would create an unfair competitive advantage to Tor. We believe in competition, and we want our users to be able to choose which transport overlay network to use, based on what network threat model works best for them." Rather than embedding Tor, they expect users to set up Orbot manually, arguing that if users can't manage this, they shouldn't be using Tor at all. At this point, users might be better off using Facebook Messenger with PGP keys. Dismissive Responses to Security Concerns When users raise concerns, responses often feel dismissive: https://www.reddit.com/r/SimpleXChat/comments/19efalx/can_i_really_pull_other_peoples_ip_addresses/ More comprehensive criticism of SimpleX’s privacy weaknesses: https://discuss.privacyguides.net/t/simplex-vs-cwtch-who-is-right/19256/29 Examples of user concerns being brushed aside: https://github.com/simplex-chat/simplex-chat/discussions/1431 Additional Concerns The company is based in London The project has received funding from Jack Dorsey Another discussion highlighting these and other issues: https://kiwifarms.st/threads/simplex-chat-discussion.203000/ Conclusion I don’t trust SimpleX to protect my IP address. Their dismissive attitude toward privacy concerns raises suspicion.

>>86772 """decentralized""" or federated doesnt mean p2p, an example of p2p would be something like onionshare. come back next time with a better chatgpt generated whitty line

>>86765 I read that whole thread and I don't see how he can be called dismissive. His posts are pretty thorough and address the points of the other posters. The people complaining at him seem like they're barely reading what he's saying. >My huge issue with SimpleX, is the CEO is vacillating between the positions of “Tor has vulnerabilities, therefore it’s not 100% solution”, and at the same time offering Tor as an opt-in solution for paranoid users (their words, not mine.) Vacillating is a weird word to use here. Yes, Tor is not 100% bulletproof, and yes, it can still help add more security if you use it. Where is the vacillating? >This is why SimpleX is like kicking dead whales down the beach compared to Cwtch. Cwtch uses anonymous Tor IDs, that are trivial to spin up, and take down. You can have as many user IDs as you want, even 1:1 mapping for all contacts to micromanage your online status for every contact. This poster completely ignores Evgeny's explanation of long-duration deanonymization and how Tor for web browsing has different challenges than Tor for messaging. Those are just two examples. If this is the kind of soykaf he has to deal with regularly then I'm honestly impressed that his responses are still so calm. It's mindboggling that they accuse him of "hostility". >Rather than embedding Tor, they expect users to set up Orbot manually, arguing that if users can't manage this, they shouldn't be using Tor at all. 1. Normal person installs Simplex 2. Normal person tries to make a call 3. It's slow as fuarrrk because it's running over Tor 4. Normal person uninstalls Simplex

>>86795 >Tor for web browsing has different challenges than Tor for messaging you are making a connection to send and receive packets. Just reset it periodically or whenever you open the app; retard >3. It's slow as fuarrrk because it's running over Tor my normal internet speed is below TOR's (120 KiB/s on average), and I can participate in multi four person Whatsapp calls just fine. I'm honestly impressed that his responses are so soykaf despite all the money mossad is sending him. It's mindboggling that he's so hostile, towards any criticism, and especially whenever other messengers are mentionned In conclusion, kill yourself Evegeny, you lying kike

what about SimpleX anon also soykaf tier messenger?

>>86732 >no >neither is "secure", according to your limited understanding, but a persistent identifier can be cross referenced and verified by trusted third parties. A one time link, by it's very nature, cannot. I don't know what your standard is for "secure". It's impossible to know unless you define it. If you give me the one time link over an insecure channel, then someone else could get it. If you give me it over a secure channel, then nobody else can see it in time. Otherwise you have issues with the one time link itself? You want some convoluted PGP-like system for one time links? It will trash usability instantly or the users will never use it if it's optional. The identity bit is figured out by the end user, like being in front of the person or having a secure channel that they trust. >oh yeah another reason to hate Simplex, thanks for remind me of their "the phone is the main device, please rely on Android and iOS" model It's whatever device generated the simplex address is the main device model. You can generate multiple addresses but you can't share them beyond some limited LAN based thing. Multi device is honestly hard and a lot of messengers that do it are basically proprietary, rely on phone numbers to do it, or are doing it in a way that justs leads to TOFU because theres tens to hundreds of fingerprints after a while. I've tested the desktop version and it's the full program, you can generate an address without a phone and you don't need to link to a phone, the problem is you can't have two devices on the same address and sharing profile/past chats permanently yet. Obviously SimpleX is trying to be a Signal competitor and they want to catch up to its usability in the end but without the phone number requirement, hence the links and QR codes to make up for the fact that theres no contact list autodiscovery via phone numbers. >Session, Briar, Jami Session was tightly integrated with a cryptocurrency last I heard, not going to be acceptable for everyone. The tightly integrated ones with overlay networks, it's kind of obvious they can skirt legal issues by claiming they simply know nothing usually, even moreso if it's peer to peer. They give up flexibility in exchange, with Tor it's their certain weakness in design and not being able to use UDP. With Lokinet it's that an extremely rich organization can simply buy their way into being most of the network, among any other issues that might be hiding (it's not like most people use it so it doesn't get analyzed much compared to Tor). I'm guessing Jami gets away with it because it's peer to peer and end to end encrypted. Being purely peer to peer brings its own set of issues, some of which are very hard. Have fun discovering them!

>>86856 >If you give me it over a secure channel If we already had a secure chanel, the simplex is beyond pointless. >You want some convoluted PGP-like system for one time links? read again, retarded nigger: a persistent identifier can be cross referenced and verified by trusted third parties. A one time link, by it's very nature, cannot. PGP keys are not one-time-use, which is precisely how they can be verified and why they are useful. Cope and seethe. >It will trash usability instantly or the users will never use it if it's optional. you just described the entirety of simplex as currently is. >It's whatever device[...] wrong again retard. try linking a device made from windows, mac, or linux, to a smartphone on a LAN. It treats the phone as primary device. If you read the article I linked you'd understand why that's problematic >last I heard >legal issues >Have fun discovering them! Ah, now I understand: you have brain damage. So sorry you had to find out like that lainon. Hopefully it's nothing permanant, tho it's not looking great...

>>86802 >despite all the money mossad is sending him Interesting how we can criticize any other messenger as long as we want, and only one or two anons defend, but the moment we say anything about SimpleX, entire PR teams come rushing out the woodwork. Funny how that works...

>>86858 >entire PR teams One person doesn't act like a hysterical 12yo schizo dishing out baseless accusations and racist insults so they must be a fed. The sad state of imageboard culture.

What about keybase <https://keybase.io/>? Seems pretty normal person friendly and it offers other things other than messaging that can attract people to use it. I never used it tho so can't talk too much about it.

>>86882 >"create an account" >centralized next please

What would make the ideal messenger if one existed? What would be perfect for privacy, security, ease of use, features, and aesthetics?

>>86882 Thought it died some years ago. New management?

>>86916 simplex man simple as

Is there any reason why I shouldn't use a disposable phone number to register for Signal? To counter the tiny chance that someone else tries to register a Signal installation with the same number, I can turn on Registration Lock in Signal. Phone number verification isn't required to switch devices, so I'll even be able to move my account to a new device later on. Am I missing anything here?

>>86916 Jami, but with better encryption and better group. It currently leaks some metadata, and last I checked groups were limited to eight people >>86935 nope. read the thread

>>86916 >>86935 Still missing some basic features like group calls and solid uptime. >>86946 >but with better encryption What does it use under the hood? What is it missing?

>>86952 It only encrypts message contents, but not who sent them, to who (which may not be possible), and at what time. here's a post I found about it's encryption if you're interrested https://security.stackexchange.com/questions/137937/how-does-jami-formerly-ring-cx-really-work-and-how-secure-is-it

>>86953 Interesting thread, thanks. Looks like they just use TLS. Kind of hacky. Although the thread is 8 years old, but on their site they still mention certificate authorities, so it probably hasn't changed.

>>86916 To clarify what I meant basically X feature like that from Y and Z messengers and B design from C messenger and so on till we get an idea of what would make a good concept to help build around and figure if anything that exists is close enough to use as basis or if everything would need to be from scratch. I know a lot of people hate Electron apps so it should not be that to satisfy those people. Im not sure if it is possible to have it all but would be nice if something could have most of everything in a nice enough balance it would satisfy ordinary people and most of the security conscious and become popular enough you dont have to beg people to use something only for them to ditch you later when they get tired of using multiple messengers. >>86946 > Jami, but with better encryption > It currently leaks some metadata Jami being P2P wouldnt that expose your IP? So seems incomplete in that regard too which means more than the metadata in a way since any average person can grap someone's IP and know a rough idea where they live which is enough to do things like SWAT them so it makes Jami as is only suitable to talk to people you already trust. Sure you can just run it through a VPN or Tor or Safing's SPN but it isn't optimized for that and if it can route itself any other way it leaves room for error. What about Jami do you like? >>86946 >>86952 >Jami needs better group >Simplex missing some basic features like group calls How many people use group calls other than militants, businesses and schools? Is it that important a feature? >>86952 >solid uptime SimpleX has down time? Is it because it uses a "relay"? What even is this relay for? From what I heard it doesn't really properly hide your IP or did I hear wrong? What if I2P was built in instead similar to how Session uses Lokinet and Briar uses Tor? Or would this be too slow for video and voice even with very good codecs used? I heard that I2P can sometime shave better speed than Tor and in theory could have potential to be more secure, though unfortunately not as security tested. Or is there some other issues with the security design of SimpleX ? Not making accounts like SimpleX has seems easy way to get someone into using a messenger but what happens if someone's device fails or they get a new one? How well does it backup and transfer that anyone can easily do it and remember? Could it sync profiles if someone wants to use multiple devices or is there any messenger that does this without accounts? Or are more traditional accounts better for contact storage? But thing that always worries me with accounts is some random hacker hijacking my account and impersonating me contacting my contacts and with cloud storage of logs they can read all my logs too so at least I know local storage is likely more ideal security wise but there also is issue of losing logs if someone wants to keep them if they dont back it up, yet then again same issue is case with cloud storage due to data loss elsewhere.

>>50336 >IRC is inconvenient Why? Because you have to log onto your computer to use it?

>>86957 >a lot of people hate Electron apps and rightfully so. shipping a goddamn browder pre loaded a page, and calling it an "app", disgusting >Jami being P2P wouldnt that expose your IP? yes, it does >any average person can grap someone's IP and know a rough idea where they live which is enough to do things like SWAT them only works in burgerland >How many people use group calls other than militants Christ almighty, how lonely can ONE person be. I pity you. I truly do. For your own sake, go out and meet some people. >Or would this be too slow for video and voice my home network speed averages 47KiB/s and I can still make audio calls fine; video calls, on the other hand, are horrible. Make of that what you will. I should've elaborated, my bad. What I imagine to be almost perfect is a messenger like Jami (with optional human readable usernames linked to your ID, and multiple profiles), but with Session's encryption (or better if possible); and make it function as an I2P-like mesh network, to solve the IP leak issue How insane is it that after all these years messaging remains unsolved.

I've been testing SimpleX chat, didn't see if it's been mentioned in here yet, just getting started from the top. It has an .onion only toggle right within the app to Tor-ify everything

>>86958 No, because even with a bouncer it's not a smooth experience. Much easier to use apps where you don't have to worry about such ridiculous inconveniences It's saying Flood Detected: Post Discarded and it's only my second post, wtf?

>>86972 I've migrated my friend group to SimpleX. It seems quite advanced, but the desktop client takes about a gig of memory. This is ridiculous. I hoped that the TUI client was better, but it's almost unusable due to poor interface. Also, the TUI client doesn't encrypt local message logs. Apart from that, everything works fine and I like the overall experience. Still, I'd prefer a decentralized p2p solution which would work over tor or i2p. We experimented with Retroshare over i2p, but it was unstable.

>>86959 >only works in burgerland It works anywhere. The accuracy of how close will vary by country and ISP. It could be just as vague as country or precise as near by city without having to get any info from the ISP itself. >Christ almighty, how lonely can ONE person be. I pity you. I truly do. For your own sake, go out and meet some people. Very but I've never heard of anyone using this feature outside of the cases I described. Not that I think no one uses it just how many? >my home network speed averages 47KiB/s and I can still make audio calls fine; video calls, on the other hand, are horrible. Make of that what you will. Just a matter of finding or making the right audio and video codecs and making sure streaming never exceeds resolution the camera outputs or the screen displays. Though would be difficult if not impossible to implement without risk of exposing that info to contacts on video call since all they would need to do is examine packet size even f it attempted to be hidden. Though maybe it would be fine to expose only that much if it isn't precise giving actual pixel count and window size. Unless there is some alternative where you can encode a video to be multiple resolutions at once with only the file size of the largest where the lower resolutions are prioritized in sending first and remaining higher resolution packets get dropped if the connection speed cant load them fast enough. >What I imagine to be almost perfect is a messenger like Jami (with optional human readable usernames linked to your ID, and multiple profiles), but with Session's encryption (or better if possible); and make it function as an I2P-like mesh network, to solve the IP leak issue I think usernames don't need inherently user readable. I don't know what it is called but have you ever seen how some sites have these randomized square shaped avatars with a sort of triangular fan like pattern that are used to identify users? I think something like that makes people recognizable even without names but if paired with a name that a small part is user readable I think that combination is enough unless someone has a disability this doesn't work for them. Though each user maybe should see a different name and identifier image to avoid being identified by name at least if choosing so. >How insane is it that after all these years messaging remains unsolved. Yes, I think it is largely people being complacent with what they are used to and due to the turning of FOSS into an ideological movement that holds itself back with dogmatism and virtue signaling. >>86977 >I've migrated my friend group to SimpleX. It seems quite advanced, but the desktop client takes about a gig of memory. This is ridiculous. Does anyone know why it is this large? That much RAM usage and it would never become something used by same kind of people that use Discord so then you wind up in same issue of different people using different programs so yeah memory needs to be considered as a factor to what makes a messenger that could be secure but popular outside if techie and ideological circles. >Still, I'd prefer a decentralized p2p solution which would work over tor or i2p. We experimented with Retroshare over i2p, but it was unstable. Using I2P should be possible there even is a tutorial here on how to set up an XMPP server over it. https://i2pd.readthedocs.io/en/latest/tutorials/xmpp/

>>86857 >If we already had a secure chanel, the simplex is beyond pointless. It depends on what is considered acceptably secure (and acceptably usable) to a random end user, not you. There are messengers that are encrypted but lack encrypted group chat, or are unstable, are proprietary, or are bound to phone numbers. Or there are those 5 people left using PGP in email. Or you could just meet someone in real life and use QR code links instead. >A one time link, by it's very nature, cannot. PGP keys are not one-time-use, which is precisely how they can be verified and why they are useful. You can use security code based verification of the one time links. From SimpleX Chat's site: >Connection security code is the cryptographic hash (SHA256) of combined public keys of both sides. >wrong again retard. try linking a device made from windows, mac, or linux, to a smartphone on a LAN. It treats the phone as primary device. I hadn't tested that use case yet, but it's pretty obvious multi device needs more work anyway. However it can be improved and the developers are aware of it. Having only multi device as the only major problem is why I'm interested though. I'll agree group calls are important but it's not a vital thing for me. >legal issues Every one of these chat programs has some sort of company, organization, or foundation whose infrastructure could be raided and taken offline for not adhering to the laws of their jurisdiction. It's not like the developers of any of these programs are all deep web Tor weebs like you, they can be found easily. You can self host a SMP server if you believe yourself to be completely beyond any of that though. >"brain damage" French people independently implementing a Tox or early Skype with double ratchet glued on doesn't change why P2P messengers have universally been the absolute losers in instant messaging, typically always in last place popularity wise. I wish them luck but I predict they will continue to struggle instead. P2P messaging that is usable, maintains availability, confidentiality, doesn't drain your battery excessively, and somehow maintains open protocols that you can write a client for is a hard problem. >>86858 It's because everything so far is made for the kind of person who uses PGP in emails or is so obviously a dangerous mess and a grant sinkhole (Matrix), or it uses phone numbers in some way, or is tightly bound to one overlay network (leads to long term issues, stuck as a kind of one off program), or in practice has no E2EE in group chats (XMPP) and makes security compromises in favor of flexibility (XMPP). Right off the bat I can see they're using DNS for user meaningful names (metadata leakage, server hosting burden/infra that could be raided), a OpenDHT proxy in reality because the majority of their users don't want to drain their battery to nothing (most people don't really have anything other than phones, laptops or tablets), a TURN server because it's not 1990 anymore, Apple/GCN push notification servers because of course they use that, otherwise they'd drain all their users battery life, and a bootstrap server. Bonus metadata leakage points for storing all the meaningful user names and their public keys on a blockchain for some reason. Extra bonus points for leakage because your contact list is leaking through these servers. There's no way their DNS based system improves at any point until people adopt the GNU Name System (pigs flying included) which would still be leaking metadata anyway because they just hand it to you on request, or they toss the idea completely. Gee, why's it got so many servers if it's supposedly lean and P2P? Because it's a fuarrrking P2P program and everyone's had these issues with them for decades. There's just one server required for SimpleX in comparison, a SMP server. That and I'm pretty sure every distributed messenger known to man has issues with spam and Jami's not going to be an exception if they want to publish usernames and public keys of everyone themselves. >>86957 >>86959 >>87002 >Group calls I'd say it really depends on how you live your life if you're using those outside of work/school/uni/interviews. Some people aren't really into looking at a grid of faces all the time, they just meet in person or talk via voice calls or group chat. But I can understand if people are trying to talk to their family or close friends on the other side of the world or something and can't meet physically.

Is there a mod log on this chan? I was looking for a critical post on one of the chat apps advertised in this thread which I'm sure I saw here, but now I can't find it.

>>86973 It's pretty damn smooth for me. I set up my bouncer years ago and it hasn't stopped working. It's the same for everyone else I know. You sound like a video-essay watching zooemr who "checked it out" and got fed up after maybe a day or so.

>>87006 Are you sure it wasnt posted in the /sec/ thread on messengers?

Club cyberia Tox ID? I lost it all so help me god.

https://simplex.chat/blog/20250703-simplex-network-protocol-extension-for-securely-connecting-people.html New SimpleX version 6.4. Main improvements are shorter invitation links/smaller QR codes and new anti-MITM handshakes. A potential MITM would now have to compromise the SimpleX relay server as well. >all the keys are now included in encrypted link data on the server, and not in the link itself as before >if somebody retrieves the associated data of one-time invitation link they observed in transit, this link would become inaccessible for the intended recipient, so the recipient would know that the connection was potentially compromised, and would alert the contact that sent the link.

>>86957 >SimpleX has down time? Is it because it uses a "relay"? What even is this relay for? From what I heard it doesn't really properly hide your IP or did I hear wrong? If you add the status/releases bot you could see relays going down for "maintenance" for 15 minutes or more, even in the middle of the US/EU day. It wouldn't be a problem except that there still isn't fallback relay functionality in the clients. So if anyone tries to contact you while your or their relay is having "maintenance", it would be unavoidably delayed. I haven't been paying attention lately so I don't know this is still an issue.

Anyone have an invite to the Lainchan Tox?

>>87850 lainbot's id is 2167ED20D40E1A5557A7AEFE16D0E110920382A9F3AA6C6597EA71DF4E499C5942CD0768F260 if you mean club cyberia all* are welcome but its been slow lately some exceptions may apply

>>86802 >my normal internet speed is below TOR's (120 KiB/s on average), and I can participate in multi four person Whatsapp calls just fine. Isn't there more to VOIP network problems than just bandwidth? Since TOR goes out of its way to send information through three random servers in addition to the regular routers a clear web request would usually go through, there will be some high latency. https://www.blueridge.tech/2025/02/01/how-network-issues-affect-voip-calls-and-solve-voip-problems/

Signal has a Registration Lock feature which is supposed to prevent your account from being hijacked. But how does it actually help? 1. Someone tries to register a Signal account using my number. 2. Signal forces them to enter my PIN. 3. They don't know my PIN and get it wrong multiple times. 4. Signal locks my account. 5. After 7 days, Signal unlocks my account and removes the PIN, allowing anyone to register an account with my number using just a verification SMS. 6. I end up losing my account anyway. This is clearly a ridiculous system, so can someone explain to me how it actually works?

>>87948 >allowing anyone to register an account with my number using just a verification SMS. the registration lock isn't to prevent someone who gets your number in the future from registering an account under that number. it's there so that when they register the new account under the number, they end up with a new account instead of your account. basically it's so that if you ever change your phone number (or get simswapped), whoever gets your old phone number won't get access to any of your profile info.

>the registration lock isn't to prevent someone who gets your number in the future from registering an account under that number. it's there so that when they register the new account under the number, they end up with a new account instead of your account. That's undermines the whole surveillance regime of requiring to bind a phone since one can use services providing temporary numbers to receive SMSes without the fear your account will be hijacked by a service operator or anybody else using the same service. Not entirely unfortunately since the temporary sim still becomes a surveillance anchor and all the services are just honeypots.

I feel like messaging is a lot more boring when you realize everything is just IRC but with gimmick, IRC and XMPP are literally all you need. I would only use the others if the gimmick is interesting enough like Session and SimpleX

Someone ever heard of Aether? https://getaether.net/ If it's as good as it sounds, it might be THE ultimate communication media, basically making email, chat, imageboards and social-media obsolete all at once. In fact, I'd say it even sounds a little too good to be true... where's the catch, if any?

>>89082 >JavaScript 41.0% >The current version is a developer preview. It collects usage metrics to help debugging. >This is a developer preview, a pre-alpha. It is unstable and untested. It is not production-ready.

>>50567 afaik, WiFis 2,4 GHz band was assigned for Wifi siply because the already was a bunch of noise from 2,4 GHz microwave ovens