I see Jami missing, though Briar is mentioned. Any particular reason for missing Jami? Perhaps because it doesn't use the double ratchet popularized by Signal? It does e3ee by default, and supports voice and video calls besides chats...
Privacy
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
matrix, jitsi, etc, are very different types if platform from signal. if you just want signal but without all the problems, it's Wire.
but if you want my opinion - the only thing that matters is bridging. none of these small networks can succeed unless they can bridge to the others and to email. bridging is subverting the network effect to combine the small players and help them destroy the big players.
A quick rebuttal of some points you made. Not going too in depth as I just want to provide my perspective:
- CIA Funding:
-
- This is a non-issue. The OTF also funds: Briar, Tor, Wireguard, Delta Chat, Bind9, CGIProxy, CertBot, K-9 Mail, Tails, NoScript, QubesOS, The Guardian Project, and a host of other essential privacy tools/software. You're telling me they're all compromised just because they're getting funded? I don't buy it.
- A Single, Centralized, US-based service
-
- The Code is open source and Android has reproducible builds, iOS would have them too, but it's impossible based on the way Apple's build process works. Lastly, Signal's devs/infra exist in the US, they have to exist somewhere, why not the country of origin? With the code being open/reproducible, you don't have to trust them.
- Phone # Identifiers
-
- This is to make onboarding easier and minimize spam - I got my grandma to install it and find the rest of the family on Signal VERY easily. Trying to get her onboard with Matrix/Element or even Briar would have been a struggle. I like Briar, but its not ready for mainstream yet. I also like Element, but I don't believe it's quite a text/sms replacement like Signal is - in addition to leaking metadata.
- Social network graphs
-
- Here you mention metadata, so I'll ask which other provider goes to the lengths that Signal does to minimize the collection of metadata? And please read over how Sealed sender works before you claim its easy to circumvent. You deride their implementation and claim how easy this is to collect without understanding what's going on under the hood.
- Abandonment of Open source
-
- This is a stretch. Signal is a non-profit. They don't have the same funding or staffing as their competitors and all their code is current. Yeah, they let it get out of sync for a while, they're human, not robots. Don't let perfect be the enemy of good.
- Bundling a Cryptocurrency
-
- What does a messaging platform have to do with crypto/payments? I don't know, you should ask every other big player who is also trying to get in on the game hoping to siphon even more data from everyone's purchases.
I do want to close by saying that Signal is definitely not the end-all-be-all of secure messaging platforms, but it is currently the best for mass adoption. I'm keeping my eyes on Matrix, Sessions, and Briar, but can't say they're ready to "go mainstream" yet.
"Signals database, which we must assume is compromised due to its centralized and US domiciled nature, has a few important pieces of data;
Message dates and times
Message senders and recipients (via phone number identifiers)"
I have a problem with the article's claims on metadata too, hasn't there been too many transparency reports and subpeonas that prove that they literally have nothing to offer to the government except the last time someone used signal and the date of joining?
- CIA Funding:
- This is a non-issue. The OTF also funds: Briar, Tor, Wireguard, Delta Chat, Bind9, CGIProxy, CertBot, K-9 Mail, Tails, NoScript, QubesOS, The Guardian Project, and a host of other essential privacy tools/software. You're telling me they're all compromised just because they're getting funded? I don't buy it.
Even if it were not the case, Signal was founded 3 years before it started receiving funding from the OTF.
Bind9
Damnit! guys and gals, the CIA is hinding in bind9
The same way you could (and in my opinion should) be wary of Briar too, not yet, perhaps, for technical reasons at least, but in regards to the sources of their funding (see the bottom section of https://briarproject.org/about-us) - OTF
Another issue is that you suggest using Matrix or XMPP, which take security much less seriously. XMPP is not encrypted by default, and Matrix has some serious issues regarding its trust model.
Just use Element (Matrix).
And what do you think of Molly? do you recommend it to replace Signal or is it preferable not to use Signal or any of its forks?
Federated / P2P is a must IMO for any messaging service, so that rules out any signal or fork, even if its self hostable, which I assume molly is.
Okay, I will keep that in mind. I thought Molly was the ideal alternative to replace Signal. I will try to use more Element or Briar.
No fixed account and really easy multi-server connection clients like with IRC kinda works also.