Secure chats

I'm using telegram but it's not private at all and since EU is doing terrible things im afraid to write on telegram. I tried using retroshare/tox but P2P protocols have many problems just because they are P2P like both you and your friend(s) have to be online to get your message. I was wondering if there is some private chat but not P2P that can be used daily. Do you know any?

https://docs.google.com/spreadsheets/d/1-UlA4-tslROBDS9IqHalWVztqZo7uxlCeKPQ-8uoFOU/edit#gid=0

>>6615 > both you and your friend(s) have to be online to get your message Of course, that's what chat is for after all. If you want to recieve message while offline, try e-mail.

irc/xmpp through the tor

>>6615 Signal works relatively well for group chats. There's a lot of controversy about it, as with all secure chat applications. But it fits my needs: Open source, secure protocol, cross-platform. The desktop client is electron based though so it's [objectively] soykaf. The only problem I have with Signal is it uses phone numbers as identifiers. This works well for people you know but it strips any anonymity away from it (unless you find a way to get a sim/phone number anonymously). For this you can use Wire, it's based on the same protocol as Signal and still open source. I'm not sure about what platforms it can run on though but the main advantage is that you can use email as an identifier instead of a phone number (however this requires you to register on a desktop).

I use Wickr Me

>>6791 Supposedly de-coupling of Signal from phone number is on the roadmap and under active development, for what its worth.

newest 2600 has instructions on secure counter quantum-cracking encryption

>I'm using telegram but it's not private at all and since EU is doing terrible things im afraid to write on telegram wtf are you talking about op... stop spreading FUD

>>6809 even with secure messaging apps, the device itself may be compromised, which negates the app security

>>6804 That's encouraging, but the phone number requirement is a symptom of a bigger issue: signal isn't federated.

>>6812 This is why I gave up on secure messaging apps long ago. It's practically impossible to convince someone to build an open source system (both hardware and software wise) especially if they didn't even hear about these terms before. The "nothing to hide, nothing to fear" meme was too real. Now I just self censor and avoid using dangerous keywords while chatting with my friends on WhatsApp.

>>6812 one should always have layered security, though. Leaving a big gaping hole in your security just because there is another big gaping hole so it's all pointless is silly.

>>6812 that has nothing to do with EU, though

>>6615 cock.li + PGP

Signal?

>>6615 Signal Tox and Jabber.

>>6615 Wire, it's pretty polished but my complaints is that it doesn't keep logs on other devices because muh security and it doesn't show when peoeple are online otherwise it's okay, been using it with my friends for a while

>>6615 Use XMPP. There's a spin off of Conversations for normal people - Quicksy. Both of those apps are free and open-source, available on F-Droid. You can also host your own (FLOSS) server that is as secure as you set it up. Communication is really secure with OMEMO encryption and XMPP is just a good and secure protocol overall. Federated networks ftw Honestly, neither Telegram nor Signal are really open-source or secure, as you can't really contribute or roll your own server. Telegram also delays source updates => closed source versions use different code, than what's available in the repositories. Being dependent on an untrostworthy server (to store your data) isn't secure.

Riot.im/Matrix.org is the ideal option IMO. It gets everything right: federated, multiple FOSS server implementations, multiple FOSS clients, no registration requirements other than an username and password. Riot can be used directly from the website. On Android I recommend the MiniVector fork (instead of Riot proper), which does away with some useless features and require fewer permissions as a result. Both options are available on F-Droid.

reasons why telegram is not secure 1. a computer can be infected with a keylogger, almost useless to use encrypted chats if this is the case 2. telegram is not actually encrypted 3. the government(s) can break encryption 4. phones can be tracked, so the mobile app is even worse choice 5. its monitored 24/7 - so if your goal is to get nice gore videos, its fine, but I ended up surveilled because of my habits on it.

>>6820 tutanota is better than cockli.

>>7492 Different use cases. Tutanota is more trustworthy as a service, but it requires JS and you're giving up the convenience of a desktop client that can integrate GPG. Cock.li has had to drop their canary, so probably the government can easily get to them, but they don't require JS and you can still use GPG. I use cock.li for throwaway anonymous email accounts and Tutanota for accounts where I communicate with multiple people.

Tox

>>7491 >a computer can be infected with a keylogger, almost useless to use encrypted chats if this is the case >the government(s) can break encryption Both of these apply to any and all electronic means of communication. The latter even applies to any form of communication, period. Unless telegram is through its design somehow more vulnerable to these than average, this doesn't work as a criticism of it. A problem that fundamentally cannot be solved can't really be seen as worth consideration.

Telegram is not as secure as alternatives such as Signal, however it has been so far suitable enough for the hundreds of thousands of Hong Kongers protesting against the PRC surveillance state. But some of you soykaffers will never be satisfied. Enjoy living a very lonely and isolated life where you achieve nothing and make no difference to the soykafty world you speak against simply because nothing is acceptable to you. >>7491 >1. a computer can be infected with a keylogger, almost useless to use encrypted chats if this is the case Why not just live in the woods and isolate yourself from all civilization if you have this soykafty defeatist attitude. >2. telegram is not actually encrypted Pls >3. the government(s) can break encryption If you take this stance, there is literally no point whatsoever in encryption except stopping others looking at your private collection of inflation fetish anime. >4. phones can be tracked, so the mobile app is even worse choice Yes and no. >5. its monitored 24/7 - so if your goal is to get nice gore videos, its fine, but I ended up surveilled because of my habits on it. Absolute nonsense

When you bring up charges it is customary to follow them up with evidence such as your PoC breaking of Telegram or relevant court documents.

This is interesting though https://status.im/

>>8500 https://security.stackexchange.com/questions/117858/why-does-telegram-not-use-end-to-end-encryption https://security.stackexchange.com/questions/57693/are-telegram-secret-chats-secure-assuming-mtproto-isnt if you use telegram good job on not trying to inform yourself, you're correct in that it isn't completely unsecure, but their implementation has very serious consequences that are for the most part kept under the rug: - group chats simply can't and do not use e2e encryption - secure chats (read, e2e encrypted chats) are available for person to person chats, but they do not work at all for people using telegram on different plattforms I use it exclusively on desktop, which has the effect of telegram not offering any sort of encryption. I used Wire before, and except for "usability" and glitterboy features, I would call it infinitely better. https://core.telegram.org/tsi/e2ee-simple#1-why-are-secret-chats-only-available-on-their-devices-of-origin https://core.telegram.org/tsi/e2ee-simple#2-why-are-there-no-secret-chats-on-desktop-apps Telegram does (not entirely incorrectly) state that desktops can be "much less personal", which would be true if you (for some reason) were to install telegram on some work PC in a monitored environment. But this assumption simply doesn't hold for all PCs. Personally, I do not think telegram is much of a right step in any direction. They appear to have superior ulterior political motives and you are at least not giving all your metadata to facebook for free, but it is like kicking dead whales down the beach nonetheless.

Hi lain, if you forgive me for the intrusion, I would like to offer a correction. >>6615 You write, >because they are P2P like both you and your friend(s) have to be online to get your message I know nothing about Telegram, but this can't be right. P2P is perfectly capable of transmitting your chats without your presence. I would say it is designed to transmit your data without your presence. What you are seeing here is most likely Perfect Forward Secrecy, or PFS. The goal of PFS would be to make decryption only possible as long as both users are online. This is done in order to fix a not-so-popular problem common in all known encryption. If the decryption keys are stolen from your device on Friday, and somebody has your encrypted messages from Monday on record somewhere deep in Utah, suddenly those recorded messages would be revealed to them. PFS technology erases the Morning decryption keys on Monday to prevent this, but this forces both of you to be online at the same time. I think Telegram is indeed using PFS on purpose: https://en.wikipedia.org/wiki/Telegram_(software)#cite_note-74 I wish all this was clear from the apps. In the meantime I can only offer this little fraction of knowledge. I would like to humbly ask for your consideration. Please don't confuse P2P technology with PFS. I think of P2P as sharing the load of transmission by sharing the right to do it. I think protection against stealing decryption keys when thinking PFS. Forcing you to be online at the same time is PFS's way of deleting your keys as soon as possible. When you don't want PFS you would need an app that lets you disable it.

What do you guys think about tox? It sounds pretty good but it hasn't really been tested and is still in heavy development

>>8882 why not set your own XMPP server with OTR

>>8889 >OTR Is OMEMO was considered better? I don't know soykaf about XMPP's innerworkings though the most I've done is set up a simple bot

>Is OMEMO was considered better? OMEMO has more capabilities (group chat, offline messages). The actual algorithms that OMEMO uses are stronger, but the developers of OTR have stated that group chat weakens the overall security model. Whether that amount of weakness makes any practical difference, I don't know.

>>8882 tox was a popular alternative to programs like skype a few years ago but i don't know if it's actually still in development. wasn't there a lainchan chatroom?

>>8893 >wasn't there a lainchan chatroom? Still, heres the bot id. 2167ED20D40E1A5557A7AEFE16D0E110920382A9F3AA6C6597EA71DF4E499C5942CD0768F260

I've been using matrix some. It's got e2e encryption, expiring messages, voice, video, and doesn't take anything more than an email and a username/password to get setup with. It's a bit clunky but seems very promising, especially since it's a federated solution. Signal is also nice but using cell numbers as an ID is just plain wrong. Otherwise I have no complaints, and e2e encryption works well. For something slower, maybe you want PGP encrypted email? It's pretty bad since it's easy to fuarrrk up and compromise everything you set out to do, but it's still an option.

>>8896 https://matrix.org/blog/2019/04/11/we-have-discovered-and-addressed-a-security-breach-updated-2019-04-12 I'm not hating matrix at all, just wanted you to know they had bad times recently

>>8897 Oh the irony. This speaks volumes for how important it is for more decentralization. If people had used a different home server, they would have been completely fine through this whole ordeal.

>>7491 >1. a computer can be infected with a keylogger, almost useless to use encrypted chats if this is the case so like, the only secure means of communication is by carrier pigeon?

>>8910 Carrier Pigeons can be intercepted

highly recommend Wickr as a signal alternative.

>>8920 >Wickr You're joking, right? Wickr is closed source. That's a massive deal breaker for a lot of people here (for good reason). Side note: their notifications are pretty broken IME.

>>8918 smoke signals?

Signal is almost definitely the best option for a secure IM, providing you only use the mobile app version on a hardened or stock device and stay clear of the desktop app. >>6813 I used to be onboard with federation but it does bring its own issues, https://signal.org/blog/the-ecosystem-is-moving/ I find it pretty hard to disagree with this to be honest, if you want to maximize security for a solution like this federation will just bring too many problems

>>8925 Whats wrong with the desktop app?

>>8939 Here >>6791 Also rumored to have been compromised >>>/Ω/10556

>>8924 Packet loss due to weather conditions, also not encrypted anyone that can read smoke signals will know what you're saying.

>>6791 look up "signal broadcasting board of governors"

>>8945 >>6791 No relevant results... If you swap "signal" with "textsecure" though

>>8945 Nothing very relevant shows up except a brochure the BBG put out saying it's one of their projects (dunno if that's the right wording)... Not sure what point you're trying to make. If you're saying "because BBG supports it, it cannot be trusted". That's not true. K-9 mail is on the same brochure, so is Tor and TBB. >>8987 > No relevant results... If you swap "signal" with "textsecure" though Hmm. I'll have to check that out.

>>8941 how about two cans and a string?

>>9037 Someone could tap the string.

Signal works, Wire is fine. Wire allows for multiple accounts per client and allows registration with only username. Personally I use a Signal that I registered with a Twilio number.

Wire is fine, you can install it on your phone from their apk. You can also create groups and it allows multiple accounts

>>6615 >>9201 >>9235 I come with sad news. Wire is not "fine" anymore: https://blog.privacytools.io/delisting-wire/ Summary (read the whole post it isn't that long): > Earlier this year, Wire announced they had entered a partnership with FedResults, in a move that would bring Wire's secure messaging platform to US federal agencies. This raised a few eyebrows, but did not alarm the privacy community as Wire remained Swiss based and beholden to Switzerland's strict privacy laws. Today however, while much of Wire's business will continue to be run out of their Swiss offices, with new US-based ownership it is not entirely clear how much jurisdiction the United States will have over Wire data. > * This is alarming because it is well known that Wire stores unencrypted metadata for every user. * > In an interview with TechCrunch, Wire CEO Morten Brøgger said of privacy laws: “We are in Switzerland, which has the best privacy laws in the world” — it’s subject to Europe’s General Data Protection Regulation framework (GDPR) on top of its own local laws — “and Wire now belongs to a new group holding, but there no change in control.” > ... > Wire also quietly made an adjustment to its own privacy policy. A previous version of the policy (July 18, 2017) stated it would only share user data when required by law. Now (Updated September 1, 2018), it reads they will share user data when "necessary." What does necessary mean, and necessary to whom? Necessary to law enforcement, shareholders, or advertisers? The word "necessary" is an alarming change because "necessary" is purposefully vague terminology that could conceivably be used as a tool to justify any action. This change doesn't leave the user with much confidence as to when the company may share your data.

Go buy a Raspi and run your own jabber server

>>9237 Thank you very much for warning us, I used Wire but I think to change for another software. What do you think of NextCloud Talk ?

>>9237 oh...shame on Wire. thanks for letting me know >>9238 Jabber really is like kicking dead whales down the beach and there's no way you can realistically convince normal people to use it. Whereas signal on the other hand, I use it with my friend group and several of my colleagues. **Adoption is the most crucial part of any messenger system no matter what.** Otherwise you end up like the crypto nut in this xkcd https://xkcd.com/1269/

Ricochet is secure, anon, and has had a security audit. Just no phone only desktop

>>10689 Looking on the project it seems in hiatus. Is it still good? Was is audited recently?

So, I want to use XMPP, anyone knows a good server?

>>9251 >there's no way you can realistically convince normal people to use it idk why people always come at this problem as if you have to pick just one chat service and use it exclusively. i'll use xmpp to talk to people who are willing to use it (or already use it) and i'll downgrade to signal for those who wont. if they won't use signal either i'll talk to them over sms. mass adoption and security/privacy are contradictory goals, and will remain as such for the foreseeable future, so you use the right tool for the job. i'm not going to use tox to talk to my grandma, just like i'm not going to use signal to talk to a darknet vendor.

>>10951 >mass adoption and security/privacy are contradictory goals I'd just like to interject for a moment. What you're referring to as contradictory goals is in fact, something the unexperienced masses won't do, or as I've recently taken to calling it, social laziness. Anyway, I understand what you mean. Before I begin, I'd just like to remind you of these (the list is non-exhaustive): >STARTTLS Everywhere, Let's Encrypt, Certbot and other projects >Lots of old protocols have been replaced or updated by other more secure ones (i.e. telnet -> ssh, http -> https, ftp -> sftp, ftps) They are not contradictory goals, their implementation is just very problematic and quite clusterfucky. And as in many other cases, we can partially blame it on capitalism. For-profit companies are made for the purpose of profit, clearly, and if they can profit off of something, they will most likely try to do so. The protocols and projects I've mentioned earlier are an example of secure solutions being successfully adopted by the masses - most of the web has been replaced by https and the users don't even know it. But then you have the corporations. They don't make insecure applications by default - no, they even use their security to advertise their soykaf, even if they're lying - the problem lies in the profit. They can profit off of your data, so they'll simply collect it and sell it (this doesn't mean that a user's connection isn't encrypted, it's just that they can decrypt it), and their users won't usually care, for one of many reasons: >they are unaware that their data is being collected >they are ignorant and "they have nothing to hide" >it's convenient and easy to use >alternatives aren't used widely, iow. "but no-one does/uses <insert alternative here>" or "everyone else uses this" >for some reason, they try to support the corporation I won't talk about the last reason because that is just retarded. The first two are problems which lie in the users (you can try and solve them by informing the users, but fighting ignorance is exhausting). But then you have the convenience and wide usage - that's a problem that won't be solved easily. First, convenience; if something is too hard to use, the masses won't use it. This is the reason why people don't encrypt their emails manually - it's not very convenient. You might have noticed that lots of popular applications are very easy to use and they practically hold your hand in everything you do. Second, wide usage; imho. the biggest problems secure alternatives face is the fact that everyone else uses something else. Lots of people refuse to use anything other than discord and messenger simply because everyone they know uses discord and messenger. This is a circular dependency and circular dependencies are infamously hard to solve: >An ideal example: Three people use an app. You try to convert one guy, he says that he can't because the other two are using it. You try converting all three of them at once, you succeed. >A real example: Millions of people use an app. Now, why do millions of people use an app in the first place? Advertisement, it doesn't matter whether the product is advertised by the company itself or by its users. But if you want to be advertised by your own users, first you need a spark of recognition. For this all you have to do is put up an advert and you're good to go (if you're lucky enough you don't even need the initial spark - for example I believe the only reason why discord is widely used today is because their users advertise it, but I might be wrong here). In the end, it looks like this: You're a large-ass company -> You put up an advert -> Someone takes the bait -> Your application is easy to use -> The user tells his friends -> His friends join -> Their friends join -> Everyone joins -> Experienced people find out that you're a dipshit -> You lose a fraction of people who can afford to leave, but nobody else leaves because nobody else leaves... The biggest example of "nobody else leaves because nobody else leaves" is YouTube - there are alternatives, and some of them are quite convenient, but YouTube is simply too gigantic. Of course, you could state that the Facebook fiasco was a big hit for them. But did it stop them? fuarrrk no, they continued with their shenanigans in WhatsApp and Instagram. Now that we have consumers out of the way, how about us, the more knowledgeable ones? There's no way we could ever face the convenience problem and between the couple of us the circular "nobody leaves" doesn't matter either. We face something different - too many alternatives in use; one guy uses signal, the other one riot, another one uses IRC, someone else uses something else and so on and so forth. You can only hope that something feasible becomes a bit more popular. And in the end, there will always be IRC (xkcd: 1782). Bridges/gateways are a decent solution (I applaud matrix for its respectable efforts), though to work efficiently, they require some sort of standardization or cleverness.

>>10950 I've been using prosody. Just make sure to enable a sane hash algorithm. I didn't notice the default was to have plaintext passwords in users' dat files for a couple weeks.

>>7492 Tutanota is a terrible mail provider, insanely long data retention, dishonest marketing, blocks anonymizers, no mail client support. It seems like it is just a honeypot.

>>10953 >they are unaware that their data is being collected >they are ignorant and "they have nothing to hide" Everyone thinks these companies are shady, but social pressure wins. Advertising works so well because it's fabricated social pressure. Check the Milgram experiment. Human beings are not rational, and difficulty isn't a factor since everyone does complicated, risky things like driving cars but don't even perceive them as such because of social pressure. And social pressure in the end is what wins. Personally, I gave up. I'm on the public channels I need to be in. I talk with people I know via WhatsApp because I'm not going to convert them to anything else and the only alternative is cutting myself off. I'm slowly removing everything but the cancer from my phone and ideally I'll end up treating it like a WhatsApp client that makes calls and nothing else. I have tried Matrix, XMPP, Jami, Tox, nobody relevant to my life is on them or will be in the foreseeable future. People even question me when I give them my "weird email address" (= not google). Half the people who use these services are privacy hobbyists who install clients just to say how nice and secure they are on Reddit. The other half are degenerates or people doing illegal things, whom I'm not interested in talking to. That's without considering that when you use a secure app you still depend on the security hygiene of everyone else involved. Being in a work environment (not necessarily professional, it could be just trying to get soykaf done) adds a layer of necessity and inflexibility where you'd rather make yourself available than complicate everyone's life for the sake of privacy. In the end, you never use these alternative services in a scenario where they would matter. I always end up using them to chitchat, but I don't have the time or will for idle talk anymore. Communication isn't like choosing another brand of a personal product. It always involves at least two people. I simply think it's not an area of your life that you can control. I secure all my stuff otherwise and value my privacy when it comes to services that only affect me individually, but as far as communication is concerned I just gave up. This is in practice the same as saying "I have nothing to hide", the difference is I'm not fine with it, I just resigned to it. I think an even greater issue than that is that people abuse platforms that give them freedom, poisoning the well. And generally as these clients get more and more secure and private, people themselves have less and less to say. >>10951 I'm not going to run a couple extra buggy clients on my low hardware machine just to chitchat occasionally with a couple people I'm not doing anything meaningful with nor I will be in the foreseeable future.

The state of this problem is depressing. I've given up on finding a bulletproof-secure messenger, in spite of all the research and cool tech. There's little point to a messenger if there's no one on there to talk to. I use Telegram now, where I have >90% of the contacts that I would want to talk to. It's not E2E most of the time but if I need to give something confidential to someone I start a secret chat and the recipient usually has no trouble with it. It just never happens the other way around but I'll take what I can get.

XMPP with OMEMO is the best option. Option to self host, encryption protocol based on signal protocol, portablity, large amounts of clients and the fast usage make it superior to all other IM:s.

>>10957 >In the end, you never use these alternative services in a scenario where they would matter. Yeah, that's it. A depressing fact, indeed. I guess I'm lucky for being the >fraction of people who can afford to leave because of my solitary nature, but I understand that most people can't afford to not be in some sort of non-physical contact with others, especially if they depend on each other. But I don't lose hope; I know that sometimes just being there is enough, even if it seems that you don't help the situation at all. Lots of us are interested in our privacy because of our interest in technology (for whatever reason it may be). But I remember becoming interested in technology simply because I was interested in my own privacy in the first place. The fact that anyone at any point might be watching me made me feel like an exhibitionist and if it weren't for people like you, for those who chase after better security and privacy, I would have never known that someone was watching me or that I can fight against it in the first place. But again, this was most likely caused by my solitary nature and my wish for not being seen. One little argument against this "I have nothing to hide" is that in the end, we all wear clothes.

>>10953 Sure, I guess they aren't directly contradictory. My point was more that considering whether a given communication technology will be accepted by the masses is somewhat beside the point. We aren't "the masses" and there's nothing stopping us from using technologies that will never see mass adoption to talk to eachother. Using xmpp or matrix doesn't cut you off from talking to your family over whatsapp or sms. The idea that a communication protocol is useless unless it's ubiquitous is exactly what created this situation in the first place. As an aside, I think the fact that many of us seem to have "nobody to talk to" over xmpp or whatever is kind of bizarre when you look at how many people have posted that sentiment in threads like this. Like.. we could just talk to eachother. I'm being somewhat facetious, but I do think there's something about imageboard culture that either attracts or manifests this reticent attitude where nobody wants to try to connect with other lainons. That's definitely a topic for another thread though. >>10957 >I'm not going to run a couple extra buggy clients I'm not telling you to install software you aren't going to use. I'm saying if you have the opportunity to use them and don't because "all my friends use telegram/signal/whatsapp/etc. and I don't want to install another app :/' then you're part of the problem. If that doesn't describe you then you're fine.

>>6617 You ever heard of store and forward? DHT? There are ways to make clients that store general messages in the peer network for a certain amount of time before dropping them. Bitmessage is a clear example.

>>8549 It's worth noting the Double Ratchet Algorithm can alleviate some of the issue.

>>9037 Good for short distance but we're looking at severe signal degredation over distance. Train a pet cat (faster and more nimble than pidgeons) to deliver thumbdrives ( drives are stored in anus for transit )

>>10993 I've heard of people messing around with doing that on necklaces. Seems less likely to lead to legal liability than the far more troublesome internal storage option.

>>10964 >if you have the opportunity to use them and don't because "all my friends use telegram/signal/whatsapp/etc. and I don't want to install another app :/ Not really, I was the one who got that a lot. But it's not that normal people are unwilling to switch that made me give up, it's that the people adopting these niche protocols do not have anything better to say than the normal people. I never felt like I was accessing a better environment, it was just most of the time, a more lurid and less active version of thee normal person world. Great for tech/programming though.

Don't use signal. So far, Matrix is the best choice. Choose a non-electron client with E2EE support! Or use XMPP on Tor.

https://licky.org Something like this? Or make your own :)

>>11071 I've stumbled across someone who said that this website is allegedly a honeypot for collecting emails and passwords. I've not personally tried it out myself nor am I planning to.

>>11074 I've also stumbled across someone who said the earth is flat and orbits around the sun.

>>11001 >So far, Matrix is the best choice On which matrix servers would lains register?

>>11071 > Centralized service > Requires JS to even show me the TOS > Hip GUI; Discord ripoff Pardon, but exactly why should one even consider this? Especially on a so called /sec/ board?

xmpp and omemo. check out omemo.top. conversations.im supports pgp and omemo chats.

What lost me about Telegram was joining a group chat. I soon discovered every piece of media anyone sent was automatically saved to my device. But private chats with one person didn't have that effect. Still a terrible feature though.

>>6615 Matrix There's a number of clients. I like the Mirage client. https://github.com/mirukana/mirage/

Tails support uses xmpp over Tor. That's a good enough endorsement for me.

>>11001 Every Matrix client other than Riot is pre-alpha stuff and Riot/Element is awful. That's the biggest reason why I don't use Matrix. >>12066 Is there a descriptive list of XMPP servers? My biggest gripe with "decentralized" social media is that all servers have no clear subject outside of (obviously) porn. The reason why Freenode and IRC by proxy are still alive is that Freenode is rather specific to programming and technology. I wish more chat servers were like that.

>>6624 >through the tor >through the the onion router

>>6615 Sorry for off-topic, but what is EU doing? Seems to me I am out of loop on this. I live in EU, should I be worried?

>>12212 I am not even him, but >sage as dislike >doesnt tell memeing Wow.

yo debian/ubuntu fgts i think Jami/Ring msg client its cool what are your toughts? if you have bugs with it its because your soykafty distro. the best way to have it running without bugs is compile source code

in the past tox was running well i think some governmental organization ruined it

>>12222 You dreamed this or read it on qanon?

>>8891 When using xmpp with omemo, file transfer is unencrypted. Or so I've read. If that doesn't bother you, than it's free real estate.

>>12263 XMPP file transfer is kind of weird because there's actual peer to peer file transfer and file upload... both of which leave the details of whether/how the files are encrypted up to the client. I wouldn't be surprised if certain combinations of encryption method/transfer method/client result in unencrypted file transfers but at the same time if you need to send an encrypted file over xmpp there are ways to do it. Not ideal but not necessarily a deal breaker, especially if you run your own server.

https://loki.network/getstarted/ Thoughts on Session?

>>12230 dont know what are u talking about. i was a user.

>>12275 Sorry, I misread "tox" as "tor". My bad.

>>12276 tor was also exploded by guvs jeje but in a more direct way, and documented

>>12264 dosnt files get encrypted by OMEMO?

>>12300 citation or you're a huge glitterboy.

>>12264 12263 here, and yes , to avoid any problems that would arise from a fuarrrkup in a clients omemo implementation, I would encrypt the file with the pubkey of the person I'm sending it to. I would also assume that anylain else does the same. I wasn't saying it was a dealbreaker per se, but just putting it out there that omemo may not encrypt file transfer, for those who may not know.

I switched to Signal from Telegram a few years ago Can't remember why Did I fuarrrk up?

>>12372 Nah, it's a good switch. Signal at least uses good cryptography

>>6616 >google docs butchered at birth >>6791 >>6829 So does XMPP, just a bit of pain because someone needs a server and OMEMO is often hard to set up, but as long it's **your** server and the room is not public (only friends can join) it can be as secure as signal thanks to SSL >>6829 >>6821 Signal it's only popular because Snowden says its good. it. How come a "privacy app" depends on third parties https://signal.org/blog/signal-and-giphy-update/ (And I don't think Signal makes the requests to giphy using Tor)

>>12301 They do, yes, but i guess it depends on the client, Gajim, Dino and conversations do encrypt the files, using OMEMO or PGP, depending on what you're using

>>12619 >it can be as secure as signal thanks to SSL Sort of. It's not the same as e2e encryption but that might not matter depending on the circumstances. If you run the server you don't need to worry about the server operator spying on you, but if you host it on a VPS you have to worry about the VPS provider, whoever owns the hardware they're leasing, the datacenter they host it in, and on up the chain. Is this worth worrying about? Depends on what you're doing. These people aren't in the business of datamining which is some comfort but they will comply with LE subpoenas. You could run the physical server at home to mitigate those concerns (or pay for astronomically expensive secure colo) but anyone who gets physical access to the server can read everyone's unencrypted messages, including private messages. This would not be the case with e2ee.