Best privacy chat apps

[robi]

@jdaviescoates it seems they are limiting voice calls with a subscription.

[rmdes]

@mehdi what do you think of Wire compared to Telegram ?

[mehdi]

@rmdes End-to-End encryption, not re-implementing their own crypto primitives, using a well known protocol, open-source ... On first glance, looks good.

[rmdes]

@mehdi I Also like that it allow people to get in touch and use the entire feature set without ever exchanging phone numbers

[murgero]

Matrix + Element is probably the best privacy focused app if I am being honest. Next is XMPP (With OMEMO or PGP).

Client side, each have multiple apps for Windows, Linux, Mac, iOS, and Android (Not to even mention Web Apps).

Matrix is probably the best option of the two as by default it can federate with other servers securely.

[marcusquinn]

Thoughts on Rocket.Chat security?

[mehdi]

@marcusquinn It's self hosted. So, on that point, better than most ^^ Otherwise, there is no special security feature, no end-to-end encryption, ...

[d19dotca]

@humptydumpty Not sure if that was really meant to be directed at me or not haha because yeah, I agree with your points on the "I don't have anything to hide" part, that's been something I've argued for years with people and fully support that it should never be about if someone has something to hide or not.

What do you prefer to use over Signal though in that case if it doesn't quite past muster for you? Always open to alternatives.

[marcusquinn]

@mehdi Cool, thanks, the scope of this post is for all chat apps, not just CLoudron ones, but insight into the Cloudron ones is always handy.

I guess the hope is to find what works best for family & friends to try and get them moving to that doesn't involve self-hosting or cost because frankly that's the benchmark from the no-so-private competition.

[marcusquinn]

Everyone here has A LOT to hide. If you're a Sys Admin, all those keys to kingdoms you have could yield great value or damage in the wrong hands.

Doesn't matter how secure we are if social-engineering can get to our stuff through our peers.

Aside from that, hopefully my blog post above explains a lot of other things to think about for how all our peers devices can gather data on us no matter how secure we are personally, so it will only be a whole society movement that plugs those holes, and I'm sure many here are happy to help friends and family do that if it is the seeds for a greater migration.

[d19dotca]

@marcusquinn Agreed. Everyone who says they have nothing to hide doesn't quite realize the potential that can come from companies having even just basic details on you.

[marcusquinn]

@d19dotca The most obvious one now is censorship, since your view of the curated online world is tailored to show you what you are most likely to engage with, and we're all seeing a different view. Add to that the profiling on how influential you are, so targeting the most influential people then turns them into propaganda gophers. We're all in database tables somewhere now as a statistically significant type of some kind or another.

[ruihildt]

The most perverse is that if you know you're watched, then you change your behaviour instead of behaving like yourself.

[humptydumpty]

@d19dotca lol no, it wasn't directed at you but that argument is what I'm used to hear when I try to educate my family and friends about data privacy. My first choice would be Matrix and Signal would be my second. But, I don't use my phone except for calling, 2FA TOTP, and email (Mail iOS app) so I never really bothered to look into it that much. I practically live on my PC so securing Windows (MS is probably the worst offender of them all) is my main concern. I'm forced to use Windows because of the CAD/CAM software that I have. I had no luck running them with Wine but I do have Pop!_OS on different drive and a stack of raspberry pi 4's for NAS (OMV5), PiVPN, PiHole, and one dedicated for fooling around with

[humptydumpty]

@d19dotca Yes! I scared the living **** out of my family when I asked them to search their full name to see what they come up with. Every few months, I do this and go through the removal process on all these sites for my whole family. It's a PITA since they try to hide the opt-out form but you learn their tricks and the process becomes easier. I wouldn't be surprised if these sites were all operated by the same scummy group because their websites have a lot of similarities with each other.

[A Former User]

@humptydumpty said in Best privacy chat apps:

I'm forced to use Windows because of the CAD/CAM software that I have

Hope this helps!
https://alternativeto.net/tag/cad/?license=opensource&platform=linux

[ianhyzy]

I would encourage you to give matrix another shot - it's gotten a lot better on mobile. My only remaining two gripes are the lack of multi-account support and the way threading works (I prefer Slack's method)

[humptydumpty]

@hillside502 Thank you but I wish it was as simple as finding an alternative CAD program. I have multiple plugins that are specific to the industry and software I'm using. Without these plugins, my work would take x10 as long to complete.

[robi]

@humptydumpty that's what VMs and containers are for. Containers run in Windows just fine.

[marcusquinn]

Wow - Elon Musk celebrated his newly found ranking with a nice kick in the Zuckerburgs!

Follow my tweets on Signal here if you care: https://twitter.com/marcuswquinn

[marcusquinn]

I reckon the fediverse is gonna get more interest following recent FB & Twitter self-determination as censors.

[necrevistonnezr]

@marcusquinn said in Best privacy chat apps:

following recent FB & Twitter self-determination as censors.

?
They are private companies and under no obligation to uphold the First Amendment (US). They are protected by Section 230 of the Communications Decency Act, which exempts them from being treated as publishers and both protects them from liability and allows them to regulate content as they see fit.

We can certainly have a discussion if (i) these platforms have reached a monopoly - and hence have an undue influence on public speech - that needs regulation and / or (ii) they should indeed be treated like publishers or the press with all the freedoms and obligations - such as fact checking - attached to it.

Don't get me wrong, I hate these platforms and what they stand for with a passion and am certain that we would all be better off if Twitter, Facebook, Instagram, etc. were turned off and deleted at once. Giving people and their opinions an unfettered platform has not improved the quality of opinion-forming and discussion but made it so much worse.

In any event, the "freedom of speech" is not an absolute right, neither in the US nor in most countries in the Western hemisphere. Like most constitutional rights they are - as a general rule - limited by the rights of your fellow citizen.

[robi]

Telegram seems to be upholding their censorship free platform so far..

[necrevistonnezr]

@robi said in Best privacy chat apps:

Telegram seems to be upholding their censorship free platform so far..

... and thus has attracted extremist, neo-nazis and covid deniers...

[marcusquinn]

@necrevistonnezr ... and thus law enforcement can learn, find and handle as-is their role.

I don't fancy law enforcement that also has a stock ticker to please.

[JOduMonT]

After watching a video of the Privacy Guy I started (WIP) a comparative of Android Chat/Call Application, my focus was privacy and anonymity.

• Potentially Dangerous Persmissions numbers comes from the project Exodus
• Pii: means you need to use a Personal identifiable information such as a phone number and/or an email

Proprietary Apps

Apps	Trackers	Potentially Dangerous Permissions	Require Pii	Note
Facebook Messenger	4	4	yes (email/phone number)	It don't just use Facebook tracker, but also Google Analytics
Line Lite	1	6	yes (phone number)	Use Google Firebase Analytics
Facebook Messenger Lite	1	7	yes (email/phone number)	Use Google Analytics
Google Duo	1	9	yes (email)	Use Google Analytics
Snapchat	3	10		Google AdMob
WhatsApp	1	13	yes (phone number)	Use Google Analytics and it is own by Facebook
WeChat	5	13		Use Google Firebase Analytics, Facebook Analytics, Facebook Login and Facebook Share
Skype	5	13		Use Google Firebase Analytics and Microsoft VS App Center Crashes, Microsoft VS App Center Analytics
Line	4	14	yes (phone number)	Use Google Analytics, Google AdMob, Facebook Login and Facebook Share
Telegram	2	15	yes (phone number)	Use Google Firebase Analytics and Microsoft VS App Center Crashes
Skype Lite	4	16		Use Google Firebase Analytics and Microsoft VS App Center Crashes, Microsoft VS App Center Analytics
Viber	10	16	yes (phone number)	Use Google Firebase Analytics, Google AdMob, Google CrashLytics, Twitter MoPub and Yandex Ad
Telegram X	3	17	yes (phone number)	Use Google Firebase Analytics and Google AdMob

Open Source Project to consider

Apps	Trackers	Potentially Dangerous Permissions	Require Pii	Note
Briar	0	2	no	Probably the best one for pseudo-anonymity.
Jitsi Meet	0	4	optional	Great alternative to Zoom
Nextcloud Talk	0	4	require login (username, email)	+ server side could be self-hosted
Jami	0	5	optional
Element	0	8	require login (username)	+ server side could be self-hosted
Linphone	0	9	yes (phone number)
Signal	0	19	yes (phone number)
Mattermost	1	3	require login (username)	+ server side could be self-hosted + could be use as a gateway to others services.
Wire	1	7	yes (email)

At the end, the best is to host your own Nextcloud and convince your friend to come on your Nextcloud Talk

[marcusquinn]

Someone just pinged me this link on Twitter, seems to be reasonable info:

• https://privacytools.io
• https://privacytools.io/software/real-time-communication

I saw someone saying the old "I have nothing to hide", although the obviously creep-ware that all these things do help hide is targeted advertising.

Who wants to be "targeted" and have others pay to directly target them with a calculation that makes it more probable to profit from that targeting?

Admittedly, I used to see this as legitimate business but the balance of cost and value to society doesn't seem to be in-line with efficiency and balance in relationships, so I'm personally backing away from all business that is dependent on paid advertising in preference for focusing on editorial value and self-challenging communities with a common interest in value over sales.

[mehdi]

@jodumont you comparison does not take into account whether or not the messages are encrypted. I personally think it's the most important feature to take into account.

Also, take a look at Olvid. I don't use it personally, but I heard good things.

[robi]

@jodumont thanks for the table!

for Mattermost, what is meant by 'gateway to other services' ? API integrations?

[robi]

@marcusquinn said in Best privacy chat apps:

Admittedly, I used to see this as legitimate business but the balance of cost and value to society doesn't seem to be in-line with efficiency and balance in relationships, so I'm personally backing away from all business that is dependent on paid advertising in preference for focusing on editorial value and self-challenging communities with a common interest in value over sales.

In another project we've come up with a business model that preserves privacy yet allows for getting paid for receiving advertising that is relevant to ones interests, if so desired.

If everyone participated, it would be akin to a UBI with abundance.

[d19dotca]

@marcusquinn said in Best privacy chat apps:

Who wants to be "targeted" and have others pay to directly target them with a calculation that makes it more probable to profit from that targeting?

As must as I hate any kind of privacy-invading workflows, I must confess that (specifically) targeted advertising doesn't really bother me much at all. The fact is those ads are going to be present in that spot on a webpage regardless of whether it's targeted or not. So why not at least show me relevant ads based on search keywords in the tool being used?

To me, the only time I get creeped out and think they've crossed a line for me at least is when they start getting overly sensitive to the ads (such as Facebook) where you're not just being targeted based on a couple of data points and instead you're being targeted based on like a 100+ different data points on data they ideally shouldn't even really have in the first place.

I think it's all a balancing act. Everyone's comfort level is a little different. Just my opinion anyways. But I totally hear ya on the "I have nothing to hide" point, those statements always irritate me when I hear them from people, shows they're completely missing the point when they say that, IMO.

[JOduMonT]

this table was for my own personal use

@mehdi said in Best privacy chat apps:

I personally think it's the most important feature to take into account.

this is true this feature should be considered,
but also who own the encryption key, the user or the provider ?

because most of these service yes you could encrypt a message but the provider (example Telegram) have the 2 keys so technically they could decrypt the message on the server side before forwarding it to the recipient.

Sometimes a function is just an umbrella to make a shadow theater where we are the puppet.

[JOduMonT]

@robi said in Best privacy chat apps:

for Mattermost, what is meant by 'gateway to other services' ? API integrations?

Yes; but I'm not a Mattermost expert

[JOduMonT]

@mehdi said in Best privacy chat apps:

Olvid

Olvid sound promessing, we cloud also talk about Threema which is more or less the same but developed in Switzerland. but at the end I took my list from AlternativeTo.net and took the top 10.

Beware most of VOIP use opportunistic encryption mainly because of issues with NAT so trusting a 3rd party for that is a big mistake for your privacy.

These days everything is secure like email aka the authentication use SSL than the message follow in clear text.

It would be interesting to find how/if Olvid encrypt their VOIP and which part ANSSI complement.
for now I only see the text message being encrypted.

[mehdi]

@jodumont I am of course only talking about good end-to-end encryption, like Signal or WhatsApp (yeah, WhatsApp has many flaws, mainly their owner, but they do have good encryption).

I don't know about Telegram's encryption, I never looked into it. I just know they don't use any by default (which, in itself, is bad)

[mehdi]

@jodumont about Olvid, from what I know, yes their calls are also encrypted, but they are only available for paid users.

[JOduMonT]

@mehdi said in Best privacy chat apps:

I don't know about Telegram's encryption, I never looked into it. I just know they don't use any by default (which, in itself, is bad)

we probably don't talk about the same phase of encryption, you seams focusing on the message (which obviously it is important) and I'm talking about the transfer

anyway good thing this forum is encrypted by a SSL

[mehdi]

@jodumont This table seems to be either outdated severly, or just plain wrong. Whatsapp does use end-to-end encryption, and has been using it for years.

[JOduMonT]

@mehdi said in Best privacy chat apps:

This table seems to be either outdated severly

fair enough

[jdaviescoates]

I came across a couple of nice chat comparisons recently.

First of all there is this nice infographic by niboe.info

Sadly I've been unable to find an English version of the other nice infographic in this accompanying article of theirs in Spanish.

I also came across this handy table from DivestOS (a privacy focused Android distribution):

https://divestos.org/index.php?page=messengers

Both of these make we wish Cloudron had an XMPP server like ejabberd so we could get our friends to try out Conversations and Movim (I mean, both Yunohost and HomeLabsOS have an XMPP server, and they are both fully open source and run by volunteers - whereas Cloudron is the one with a business model and full time paid @staff - and yet they've got XMPP and we don't! )

[JOduMonT]

maybe me, but personally I make a difference when you are able to generate or add your own key to encrypt versus the "platform" provide you the public and private key

[mehdi]

@jodumont The key is always generated on your own device. There is zero reason to allow users to import an external key. If you don't trust the local app to correctly generate a keypair, you have no reason to trust it to correctly perform the encryption. So importing a key brings nothing.

[robi]

@jdaviescoates time to host an event, start packaging and get help finishing it!

[jdaviescoates]

@robi I've often thought of learning to code. I loved maths as a kid. But now isn't the time.

[robi]

@jdaviescoates there's no real coding involved.. it's mostly stitching things together and adjusting configs. You'll have help too.

[marcusquinn]

Looks like Signal App's addition of payments using MobileCoin ($MOB) has struck a raw nerve with many.

Another alternative that seems to come up regularly on the comments underneath their Tweets is this Session App:

• https://getsession.org

YMMV but another one for the list and your esteemed critique.

[jdaviescoates]

@marcusquinn see also Snikket which seems like a great option too (and gets my vote for the XMPP that ought to be first added to Cloudron).

[atridad]

I'd still take Matrix over all of those for its decentralized and federated nature. It is incredibly secure and their Element client has truly come a long way. I would love to see Snikket and Oragono though. I tried packaging Oragono but lost the motivation part way through as I usually do.

But my vote for matrix comes in here: Me and a friend could both have our own homeservers and still chat in a secure manner. If we're talking privacy, I'd say its at the top for sure.

[jdaviescoates]

@atrilahiji true, although I find Matrix to still be somewhat of a UX nightmare. It's often very confusing, even for geeky people.

[atridad]

@jdaviescoates I mean, I wouldn't say I'm an expert in UX so I can't speak to that but I can say that for me I found it fairly intuitive. I know that this may not be everyone's experience though.

I also am wary of UX issues or incredibly pretty apps sometimes because I find that a lot of apps seem to go 110% in on beautiful and intuitive UI while compromising on core functionality.

[marcusquinn]

I think any app requiring a central server will remain niche.

Signal took a long time to persuade people to switch with very low signup friction.

User experience is as fundamental to security as shoes are on gravel.

If the experience doesn’t factor-in user onboarding time & friction, then it becomes a security issue in itself, by discouraging critical-mass adoption to be more useful than the ad-tech alternatives.

[atridad]

@marcusquinn said in Best privacy chat apps:

I think any app requiring a central server will remain niche.

Did you mean apps not requiring a central server? Looking at the current abysmal state of the internet, apps requiring central servers dominate.

Signal took a long time to persuade people to switch with very low signup friction.

User experience is as fundamental to security as shoes are on gravel.

If the experience doesn’t factor in user onboard IG time and friction, the it becomes a security issue in discouraging critical mass adoption to be more useful than the ad-tech alternatives.

I think this is a good ol' agree to disagree situation. I'm of the opinion that if someone needs to be coerced into caring about security they may as well stick with selling their soul to Sundar Pichai and Zucc. As far as I'm concerned the best privacy chat app is the one that best protects privacy. Simple as that.

[marcusquinn]

@atrilahiji The family reeeeeeallly resisted the push to Signal for months, these are people that care, and I care about, but the "why should I?" brainwashing runs deeper than personal and relationships nowadays.

That's the power of user experience and trust in exchanging effort for that.

For business and professionals, sure, we have some influence, but for personal, I'm afraid the user statistics speak for themselves.

[marcusquinn]

@atrilahiji Moral hypothetical; mental health is an issue, I think we can agree on that?

How do we reconcile having capabilities to improve user experience and adoption, against having people we care about unnecessarily unhealthy in mind because they "sold their soul", or more likely it was bought and sold for them?

[atridad]

@marcusquinn I mean yeah, for a number of people the security aspect is something of a non-issue. What moves them is the UX. But I'd argue that most, if not all, open-source chat apps that allow for self hosting simply cannot compete with Signal because people move to the shiny thing. You and I know that there are better options if privacy is the concern, but for the majority of people privacy truly is not a concern. If it was, we wouldn't even be having this discussion and everyone would use Matrix.

But where I'm coming from here is solving the core issue of the best privacy chat app, which I still argue is Matrix. I would not say it is the best chat app. But again its a matter of what one prioritizes.

[Robin]

@atrilahiji Well, you also don't really need to compete with Signal if you can use it as a trojan horse using e.g. https://docs.mau.fi/bridges/python/signal/index.html. Of course, this comes with its own set of challenges: making a good experience with many moving parts is not easy - and bridges are inevitably another moving part, often of questionable quality since they aren't a primary focus.

[marcusquinn]

@atrilahiji Yeah, it's a compromise step I feel. Secure enough to be better than ad-tech's conflicts of interest, but still aware that the metadata for who's chatting with whom and when still has some potential value that one wouldn't want to share if given an assured choice.

Matrix I love the ideals and successes of. Element seems the best of the bunch. So for this audience, certainly the best we have.

For my entire social circle, well I can't see it happening but would be happy to see otherwise.

I guess the original point of the post was non-Cloudron specific, and potential for mass-market.

I guess we have to wait and see what Elon Musk shills next if Signal's MOB payments sour the new kid capturing mindshare.

[atupuxi]

The Very Best Encrypted Messaging Apps:-

1. Signal
2. Wickr Me
3. Dust
4. WhatsApp
5. Telegram
6. Apple iMessage
7. Facebook Messenger

App to avoid: Google Hangouts. Despite being available for free on both iOS and Android, Google Hangouts is riddled with privacy and security concerns. Though it does encrypt hangout conversations, it doesn’t use end-to-end encryption — instead, messages are encrypted “in transit”.

[atridad]

@atupuxi Good to see Signal on there but WhatsApp and FB Messenger are suspect. I'd probably put something like Matrix (Element) on there. Probably even above Signal since you can't quite self host Signal.

[necrevistonnezr]

@atupuxi said in Best privacy chat apps:

The Very Best Encrypted Messaging Apps:-

1. Signal
2. Wickr Me
3. Dust
4. WhatsApp
5. Telegram
6. Apple iMessage
7. Facebook Messenger

Wickr was just acquired by Amazon (!) of all companies: https://www.theverge.com/2021/6/25/22550361/amazon-wickr-aws-secure-messaging-encryption