best instant messenger in terms of reliability, speed and privacy

i heard matrix is pretty good, very familiar to those migrating from discord. session seems to be top notch for privacy/security but i dont know too much about jabber.

I feel like this question does not deserve it's own thread and I'm sure it's been asked here before. From experience, Matrix is pretty slow. That might be just their default Element client, but it's not like the alternatives are nearly as feature rich. Overall I don't recommend. Session indeed *seems* to be top notch. Personally, to me it always seemed too good to be true. I always assumed there was a catch. How the hell do they do voice calls? Magic! I know I can theoretically read their white paper and source code but pfffftt cmon. Use it if you want, IDC. I cannot speak for jabber. Remember, though. The hardest part is actually getting everyone to download the messenger... normal people are discovering Telegram due to weed shops being there, and honestly that's good enough for me.

>>24435 > The hardest part is actually getting everyone to download the messenger... This is why I am sad I can't program. I had the idea a while to try and make a messenger and video call program that will be designed with normal people in mind but with better privacy and security and open source and just better experience so it could become popular. I think one of the tricks is not advertise security so much as unique features like I would probably make it skinnable and Discord like but ideally id rather avoid the Discord server setup just because it is killing the internet. But i dont know if it would be a dealbreaker for normal people.

>Matrix slow as fuarrrk ugly ram hog, shady business >Session mandatory soykafcoin, removed deniability/forward secrecy for no good reason, based in Australia where they can legally be forced to add a backdoor and can't even have a warrant canary about it >XMPP admin sees everything lol

>>24437 How is Matrix shady business? Is Session hosted in Australia? Since even if the dev is from Australia they would have to find out, in which case I dont know why they would announce it. I havent heard that before about XMPP. I often see it along with IRC touted as superior to Matrix for security. How is it the admin sees everything? Who is the admin when it comes to XMPP?

what do you guys think of SimpleX? haveno-reto group uses it. simplex.chat

>>24456 There has been a thread on it before. Not many people know much about it and i cant kind wrap my head around how it works.

>>24458 sorry I should have checked the catalogue.

>>24456 I've been using it for a few months and I'm very impressed. It feels great to have something that's secure AND isn't a struggle to use.

>>24438 >>24437 >XMPP Considering that XMPP (formerly Jabber) powers pretty much every single IM under the hood, including whatsapp, its probably a pretty safe base to start building on. Don't listen to the privacy FUD, XMPP is as save or as unsave as you want it to be.

>>24643 Is there any advantage to using XMPP over anything else?

>>24577 I like it too. But don't like I'm forced to use a browser for video/audio. On desktop that is. Maybe it's secure. I don't know enough about webrtc.

>>24646 OMEMO: the Signal protocol implemented for XMPP. OTR and PGP are also available, but OMEMO is far and away superior. You can also access XMPP servers on various darknets, or connect to a clearnet one over Tor.

>>24646 Its one of the few truly original messenger protocols out there, most messengers, like I wrote, use it or its derivatives in one form or another. It supports pretty much everything, and the things it does not support (natively) can be tacked on without much trouble, like encryption. Con: It really does not have many books on it. There is one by Wrox from 2009 (!!) and 1-2 others that deal with using it under iOS IIRC. But since its an open source standard, you can just read the reference documentation.

>>24438 >IRC >security Whoever told you that is insane. >How is it the admin sees everything? Who is the admin when it comes to XMPP? The admin of the server where your account is hosted. They can't see the content of OMEMO-encrypted messages, but XMPP has no metadata protection at all. It even logs passwords, in plaintext. https://web.archive.org/web/20211215132539/https://infosec-handbook.eu/articles/xmpp-aitm/ https://web.archive.org/web/20211128142236/https://infosec-handbook.eu/news/2021-11-06-xmpp-aitm/ >Is Session hosted in Australia? It's supposed to be distributed similar to the Tor network. In practice it isn't, because of the soykafcoin mentioned. It doesn't matter either way because the law isn't about servers. Any developer who is an Australian citizen can be compelled to make secret changes to any code they work on. >Since even if the dev is from Australia they would have to find out, in which case I dont know why they would announce it. Not sure what you mean here. >>24653 >and the things it does not support (natively) can be tacked on without much trouble Tacked on is definitely the right way to describe most XEPs.

>>24659 >logs passwords in plaintext if your server logs them in plaintext, yes. but there are servers that hash. the problem is most use fuarrrking sha-1. but some use 256.

Signal I know some of you schizo will cry about the need of phone number to register but, face it, nothing can beat Signal at the time. Good luck asking people around you to download jabber and some obscure OTR/OMEMO plugin. Good luck asking people to use Sessions. Same thing with Matrix, the most popular choice of client is Elements and it's updated by a shady shell company in the UK. Signal is non-profit, used by highly targeted people (politicians, activists, journalists, etc) without much problems, and WAY MORE of a popular choice (some of my least tech-savy contacts were on it BEFORE asking them to register). Face it, none of you are important enough to be tailor-targeted by some government-backed intel agency. So stop the schizo talk and go use Signal with your friends and family. PS: If by any chance you are some kind of darknet market admin, well, why the fuarrrk are you reading this thread anyway lmao? Go back to your regular jabber setup with OTR behind 7 proxies.

simplex... just tested it.. no number needed. No username, or passwords. Cell based style chats. Gives you new IDs for all contacts... No more meta-data woes. Hopefully. As always, if you're at life or death levels, layer your encryption, pgp inside this is easy. My grandma downloaded it, sent me the link, it just works.

>>24745 >Gives you new IDs for all contacts Just want to point out for others that this random "incognito mode" is optional.

>>24456 I liked it and it seemed secure and easy enough. noone to talk to though

>>24757 There was a Lainchan group posted in this thread >>24090 https://simplex.chat/contact#/?v=2-5&smp=smp%3A%2F%2Fu2dS9sG8nMNURyZwqASV4yROM28Er0luVTx5X1CsMrU%3D%40smp4.simplex.im%2FBHhXf_DmqQBaT8hMWtIPr6C74t8RgDJN%23%2F%3Fv%3D1-2%26dh%3DMCowBQYDK2VuAyEABUE6BzWw6mWD-govxFbL0XOzT_azOagFEBAdXqyr2WE%253D%26srv%3Do5vmywmrnaxalvz6wi3zicyftgio6psuvyniis6gco6bp6ekl4cqj4id.onion&data=%7B%22type%22%3A%22group%22%2C%22groupLinkId%22%3A%22wZlXQ7LCrP99RftpAYUlYg%3D%3D%22%7D Try the public group directory as well https://simplex.chat/contact#/?v=1-4&smp=smp%3A%2F%2Fu2dS9sG8nMNURyZwqASV4yROM28Er0luVTx5X1CsMrU%3D%40smp4.simplex.im%2FeXSPwqTkKyDO3px4fLf1wx3MvPdjdLW3%23%2F%3Fv%3D1-2%26dh%3DMCowBQYDK2VuAyEAaiv6MkMH44L2TcYrt_CsX3ZvM11WgbMEUn0hkIKTOho%253D%26srv%3Do5vmywmrnaxalvz6wi3zicyftgio6psuvyniis6gco6bp6ekl4cqj4id.onion

>>24647 Doesnt. Webrtc have risk of leaking you IP address if you use a VPN or onion routing, or is that not a problem now? >>24757 How do you maintain contact if you were to have your phone break?

>>24437 >>Matrix >slow as fuarrrk >>Session >No mention that it's even slower Did you use both of them long term? Session is like kicking dead whales down the beach. Media never gets delivered about a fifth / tenth of the time. Messages always take more time to deliver, sometimes get stuck in limbo for a while. Multiple times I had issues where me and my chat partner would be confused cause some random message was still sending minutes later. Yes, it uses a tor like network, but it hinders it's usability A LOT in my experience. Also doesn't excuse media not going trough. Matrix can be soykafty sometimes too, but it's far more reliable and faster. Media reliably goes trough as well. It's a far better experience. >>24745 >simplex I tried it out some time ago, realized there was no way to have more then one device logged in at a given time, deleted it. I know you can use your pc, but then it stops working on your phone. I understand their idea that it is kinda bad for security reasons, but it feels like such an edge case, that it's really not worth hindering functionality over it imo. >>24666 >Signal I have to agree with this, Signal just seems to be the best bet for people actually using it, having it work reliably and actually be fast.

>>24851 Yup, Signal is the only realistic solution for now. I used every alternatives, yet I always come back to Signal. I've been using it for like 9 or 10 years now(?), never had any long lasting issue with it (maybe some downtime years ago, for a few hours max) Just be aware, sometimes (like every few months or weeks if you're unlucky) notifications won't work because of their protection for Apple and Google push notifications. ( https://www.reuters.com/technology/cybersecurity/governments-spying-apple-google-users-through-push-notifications-us-senator-2023-12-06/ ) When that happen, you will not receive notifications and will only see new messages when you open the app (which can be a pain in the ass, had a friend think I had a car crash because I wasn't replying..). So be sure to open Signal randomly through the day, and if you see "old" messages coming at you only after opening the app, click on your profile picture ---> Settings ---> Notifications --> And click the button at the bottom ("Reactivate Push notifications", something along those lines). They also have a quick option to transfer old conversations to a new phone, which is nice if you need to keep some "logs".

>>24852 Doesn't getting the apk fix this? If you don't have google play apps on your phone, signal detects that, and switches to using a websocket for notifications in those cases. (At least I think that's how it works, not 100% on that)

>>24849 >How do you maintain contact if you were to have your phone break? Export and backup your database. >Webrtc >Audio and video calls on SimpleX Chat are routed via a TURN relay server by default. Optionally you can disable this and use peer-to-peer (P2P) instead, when it is supported by your network. However, your IP address will be known to your contacts. https://simplex.chat/docs/guide/ >>24851 >you can use your pc, but then it stops working on your phone You can now log in on multiple devices as long as they are on the same network.

>>24854 >Export and backup your database. Seems a bit of a hassle but probably not too big a deal if you store on a microSD from the start so you can just swap it to another phone or clone it. Only issue is SD cards can fail too easily sometimes. Probably easier to do if on a computer. >TURN relay I see. I'm not too familiar with that kind of relay so I don't quite get how this differs from a central server.

>>24882 > Export and backup your database. > Seems a bit of a hassle but probably not too big a deal if you store on a microSD from the start so you can just swap it to another phone or clone it. I'm not familiar with the SimpleX app so I'm not sure if it supports automatic backups or not. Seems like it was proposed here [0]. If not, you could make a manual backup of your database from the app at scheduled intervals. You could then sync it from your phone to your computer or a server automatically with Syncthing [1], or via rsync using an Android terminal emulator [2]. I recommend this approach because not every phone has a microSD card and because it allows for you to have an always up-to-date copy of your database. > TURN relay > I see. I'm not too familiar with that kind of relay so I don't quite get how this differs from a central server. From the Cloudflare docs [3]: > TURN (Traversal Using Relays around NAT) is a protocol that assists in traversing Network Address Translators (NATs) or firewalls in order to facilitate peer-to-peer communications... [A TURN server] serves as a relay to traverse NATs and firewalls when direct connections between peers are not possible. In essence it seems that it's used to help route peer to peer connections, by passing along connection requests to and from peers. If you're worried about your IP being stored by their servers, they allow you to host and use your own [4][5]. Again, I'm not familiar with the app. I'm simply quoting their website and documentation. Hopefully it gets more attention and more scrutiny so their security and usability can be improved as time goes on. [0] https://github.com/simplex-chat/simplex-chat/issues/3966 [1] https://syncthing.net/ [2] https://howtos.davidsebek.com/android-rsync-termux.html [3] https://developers.cloudflare.com/calls/turn/what-is-turn/ [4] https://simplex.chat/docs/server.html [5] https://simplex.chat/docs/xftp-server.html

I just wish you could create aliases on Signal. At least now it doesn't automatically expose you to anyone who knows your phone number.

what do you guys think of SimpleX? https://youtu.be/0cRu98XSap0.

>>24895 whats the point of cross-platform if boom ur android/ios client is jbroken and all ur data is compromised. are they r*tarded?

>>24429 Tox. I think only the command line client is still being maintained. But it's still the most secure messenger and has good speeds most of the time.

???????????? How is SimpleX “safe” if it’s based on notoriously government-monitored Tor onion networks? Same with Session.

>>25033 >Doesn't understand how onions work lol Onions don't have IP addresses every user that visits a Onion site or service is 127.0.0.1 They way P2P networks are means you need something to hide your IP due to the way they work but that fine use your Kape Technologies Israeli VPN if you feel so inclined to do so >Same with Session. Session is Signal with Lokinet built in and it seems like is shifting gears (e.g Session Token)

>>25033 >How is SimpleX “safe” if it’s based on notoriously government-monitored Tor onion networks? simplex has nothing to do with tor

>>24920 You have to trust the other person is who they say they are though right? Or did they fix the IP leaking bug? It's been a while so I forgot the dramatics. I miss qTox >flood detected post discarded

>>25037 >IP leaking bug That's not a bug, it's how all peer to peer applications work. Tox was never advertised as having anonymity but it's easy to use it with tor if that's what you need.

Your opinion on privacy, security, anonymity, reliability & source code of BitMessage?

>>25046 The idea is good, but it doesn't scale very well due to its use of proof-of-work and the fact that you have to download the entire blockchain to read a message. Additionally, while the recipient is anonymous, the sender has much weaker anonymity guarantees. In terms of the source code, wasn't there a devastating vulnerability found like a decade ago?

>>24920 >still the most secure messenger lmao >Tox provides some strong security guarantees. We haven't got to the point where we can enumerate them properly, given the general lack of understanding of the code and specification. >We have a largely undocumented, untested, and not well-understood code base of about 19 ksloc (C).

>>25034 Does that make Session better than Signal or worse?

>>25049 session's code is based in part off signal, it is like a soykafty rip off. it used to be buggy, there have been issues with its implementation of signal's encryption too. lokinet itself is a crypto scam, maybe it works, maybe it doesnt, i dont trust it since the developers are money hungry.

>>25048 Go glow somewhere else Bill

>>25050 Which devs? Session or Lokinet?

>>24429 SimpleX reigns supreme!

>>24437 use omemo or pgp with xmpp admin sees nothing

>>25098 What do the yellow checks mean, and what are the little notations 1 and 2?

>>25098 I never heard of Cwtch and what is post quantum hybrid crypto even supposed to mean?

>>25111 Cwtch is similar to what briar does and Simplex builds off of these two with a focus on preventing linking so you don't get blade droned.

Maybe it would be better to discuss messengers based on threat type. Would this be the correct categories? >talk to people you know from elsewhere you trust but not have your ISP or other corporations know what you are saying to eachother >talk to people you know from elsewhere you trust but not have your ISP or other corporations know you even are sending messages or having video calls >talk to strangers but it cant be traced back to your IP if you're talking to someone trying to hack you >talk to strangers but it cant be traced back to your real location or identity by YOUR government or ones that work with it >talk to strangers but it cant be traced back to your real location or identity by ANY government because it just isnt known to be possible The later two is mainly to avoid guilt by association issues. Like maybe you run into someone talk about random stuff but layer they get arrested for a crime they casually mentioned to you and then cops looking for you for questioning or quietly investigate you just because they mentioned it to you. Then get to comparing each category split by features like if it does voice and cam and file exchange and order by how fast or how secure it does this.

>>24456 Simplex is genuinely underrated and ever since telegram got compromised by 3 letter agencies, I'd argue it's the new telegram. You can have a massive unlimited amount of users in a single group chat. It is open source and it's seems more secure than plenty of other messengers. More people should find out about simplex and donate some money to the platform.

I'm going to hesitantly say simplex chat too. I like it. It's self hostable (unlike matrix--too resource intensive and just soykaf). But if you're using libre software you could really use any of the offerings. You can side channel the encryption and simply use the platform as a delivery tube. You could have encrypted chats on irc for example. Shout out to gnu jami. often gets overlooked i guess

>>25120 >You can side channel the encryption and simply use the platform as a delivery tube. On simplex? How? That sounds very useful.

What does Lain think of… Meshenger https://github.com/meshenger-app/meshenger-android Snikket (xmpp client) https://snikket.org/about/goals/ Molly a Signal fork https://molly.im/

>>25137 >Meshenger Seems cool for a P2P-only situation like an isolated network, but not realistic outside of nerd-to-nerd communication: >Limitations: >no calls through firewalls / NAT borders >IP address change requires manual contact update >Snikket Not easy to find out wtf it actually does. Apparently backwards compatible with XMPP, but tacks on some custom extensions? Or is it proper XMPP? Differentiates "Snikket instances" and XMPP servers in the docs. Releasing both server and client is suspect too. If it's custom extended XMPP where outsider XMPP peers are lower class than native "Snikket" peers, if their client only talks to "Snikket" servers, then it's trash. If real XMPP client, then it might be nice. >The only supported installation method is currently Docker. A Snikket service is built from multiple software components, carefully configured to work together in a specific way. "Our software is horrible spaghetti." >Molly Same as Signal, therefore can't be trusted, like >>>/Ω/50332 says. Now with tinfoil bell and whistles. Better than the original client, especially the Molly-FOSS version, but the single-client proprietary centralized server design is flawed, your chat partners will likely be using the proprietary binary (yes) client anyway. Using Signal's server infrastructure too, leaking metadata the same way. https://blog.dijit.sh/i-don-t-trust-signal https://www.devever.net/~hl/webcrypto

>>25098 Where is that diagram from?

>>24659 >Any developer who is an Australian citizen can be compelled to make secret changes to any code they work on. Going by the letter of the law they can force a messaging service provider to make changes to their code which would allow them to share messages on request in the future. So their ability to enforce this would be based on where the owning nonprofit is located, short of just banning it from the country or seizing local servers. It also adds a clause that states they can't force the service provider to add a systematic weakness that affects the product as a whole, so encrypted messaging providers like Session would be exempt. There are many reasons not to use Session but the location of a single dev isn't a good one.

Found another one not brought up. Seems to be something p2p through tor? https://tryquiet.org/ https://github.com/TryQuiet/quiet Personally i wouldnt use it just from concern over the attention using the tor network can bring you. Would be preferable a similar but different network used and one faster to be able to handle video calls.

>>25185 Slack, Discord alternative, more group oriented than direct chat. I like the concept of Tor P2P, makes sense because you get NAT hole punching and encryption for free, messages don't use much bandwidth, Tor is a good fit. No relays, servers, avoids metadata collection, activity profiling, social graph buliding. Side-channel possibilities out the ass, which comes with the "we support everything" attitude. By default it's pulled into the web of backdoored infrastructure, spyware OS, app stores, Microsoft GitHub, Apple Push Notification Service. Apple can send arbitrary app updates to a member of your community, there's no way for the user to verify integrity of an app, not that it'd mean much running on a proprietary OS. Android is the same unless you run a schizo setup which nobody does. >Does Quiet use servers at all? >[...] Quiet also uses Github to deliver updated versions of Quiet. Other than that, Quiet is fully peer-to-peer. Thanks for continuously broadcasting that I'm a user, for no reason. Should be a hidden service update mirror. Unclear if updates are signed at all, and whether they're forced. >Don’t iOS push notifications require a central server? >For now, unfortunately, yes. We will provide push notifications on iOS for users who want to enable it. Android users will probably not need to use a push notification server. Super secret Tor message, To: Lainon, Cc: Applel Then there's the usual argument, if I have to trust the Quiet team, controller of the practically binary sole client, then why jump through all these hoops. No defined protocol. The Electron app is the protocol. Saving grace is that "Quiet is fully forkable", unlike Signal where server is proprietary, client too when they feel like it which they did for a year.

>>25051 https://github.com/TokTok/c-toxcore/issues/426 >>25107 Admin sees everything that isn't message text. Check the links in >>24659 >>25108 >>25111 https://simplex.chat/blog/20240314-simplex-chat-v5-6-quantum-resistance-signal-double-ratchet-algorithm.html >>25118 >compromised by 3 letter agencies When was it not? It didn't even have encryption for group chats. >>25112 Cwtch requires Tor onion services while Briar is designed to work offline and actively shares metadata, and Simplex has no relation to either of them because none of them have any relation to each other. >>25122 >On simplex? How? Lain's referring to "you could really use any of the offerings". Look into what OTR used to do. Imagine encrypting emails with PGP, but automatic and seamless over basically any chat protocol. Too bad it's way out of date now.

>>25256 >https://github.com/TokTok/c-toxcore/issues/426 >2017 That's already been fixed, and it was a non-issue to begin with. >oh no if someone gets your secret key bad things can happen

>>25256 > Too bad it's way out of date now. Did you mean OTR here or what Simplex does?

>>25257 It's about the attitude of the devs. It's insane to claim that your code is secure at the same time you say you don't even understand it. And the fix took 7 years. >>25260 OTR. There's a project to develop a v3 but there hasn't been any news for ages. It's a neat concept, but if your friends are crazy enough to install both a third-party client and an OTR plugin then they're crazy enough to install Simplex or Molly.

>>25262 You're the one who doesn't seem to understand the code. It's insane to claim that you know anything about secure software if you think any software in the world can or should protect you from your secret keys being exposed. That's not part of any sane software's software's risk model. >And the fix took 7 years. So your biggest nitpick with tox is that a trivial, theoretical vulnerability in the handshake protocol took too long to fix? You're glowing pretty hard right now, Bill. >plleeeeeease stop using actually secure software!!!

https://toktok.ltd/ >Neither the Tox protocol nor the implementation have undergone peer review, and its exact security properties and network behaviour are not well-understood, yet. We are actively working on improving that situation. Until said peer review, Tox is not recommended for use cases that require proven, high-assurance security. https://tox.chat/download.html >Keep in mind that these clients are alpha software under heavy development, and are probably not ready for day-to-day use. Because of how significantly the code is still changing, a professional audit hasn't yet been started. You will probably run into various usability bugs, and may even encounter dangerous security vulnerabilities.

>>25256 >Admin sees everything that isn't message text. omemo if properly configured also encrypts uploads

>>25264 Holy wowzers, the devs of security software are being transparent? Stay the hell away from their software. We should definitely all be using trusted software developed the professionals at Google and Facebook instead.

>>25262 Maybe there should be some funds gathering among the security community to help develop such projects like a v3 of OTR to push these things along?

If you want to donate to something worthwhile, donate to the Tor Project. They're squeezed pretty hard financially these days.

Make your own. All the basic programs have already been made. Glue it together with bash, python or whatever. They're all soykaf. Noone cares. Honestly, why are we still on ipv4. If we used ipv6 it would be much easier for everyone to host their own 'services'. fuarrrk the waste of money that's dns registrars and whatever tech corps are dragging their feet, clutching ipv4 to their money'd greasy fuarrrking hands. Computers are soykaf. Networks are soykaf. Long live irc.

>>25301 Yeah how after they back stabbed everyone with Team Cymru lol I still use tor but would rather donate to smaller projects that the funds dont go to subversion or pink hair dye to be honest

>>25302 Isn't IPv6 more security vulnerable ? Like with what happened with that Windows vulnerability was due to IPv6 being able to expose individual devices on a network directly. It's also not as human readable so unlike IPv4 you cant just manually type out an IP address to get around using DNS's

>>25374 >Isn't IPv6 more security vulnerable ? In a way, yes, but only because the IPv6 code is less tested, since most just use IPv4. The protocol itself is solid. I suggest disabling IPv6 on all devices you have. On Linux, it's easy as adding ipv6.disable=1 to kernel cmdline in bootloader config.