About Threema: Anyone using it? Is it as safe as they say?

cdflasdkesalkjfkdfkjsdajfd

I'm thinking on move from Telegram to other communication app more safe/private and read about Threema.
Anyone is using it? Is safe to use it?
Thanks

DeletedUser69

cdflasdkesalkjfkdfkjsdajfd when it comes to secure messenger, what is wrong with Signal? Compare the amount of downloads for the two on Play Store to see their popularity. Remember, your contacts will have to use it too.

Eagle_Owl

cdflasdkesalkjfkdfkjsdajfd
Hi,
yes, Threema is really safe and private.
I am using it since years.
Security experts worldwide recommend Threema.

If you can get your most important contacts to switch to Threema, that's a good solution.

However, if your important contacts use Signal and you would be alone with Threema, I can also recommend Signal if you only use usernames instead of phone numbers to establish contacts.
Setting in the Signal app or Molly app: Settings/Privacy/Phone Number
– Who can see my phone number? Nobody
– Who can find me by phone number? Nobody

Unfortunately, most people are not educated enough to understand data protection and privacy.
Therefore, you may not even be able to convince your most important contacts to switch to one really good and proven messenger like Threema.
Then it doesn't help to install at least two very good messenger apps to keep in touch most of your cntacts.
So in addition to Threema, you maybe need also Signal, because most people who switch from WhatsApp or Telegram at least choose Signal, if not Threema…

But if you need also Signal, then I can recommend to use Molly-FOSS instead.
It´s a great combination to use GrapheneOS and Molly. ;-)
You can obtain Molly-FOSS from Accrescent (see GOS-App “Apps”) or GitHub.

zzz

cdflasdkesalkjfkdfkjsdajfd
I highly recommend this guide comparing messengers, really helped me understand all the variables to consider:
https://www.messenger-matrix.de/messenger-matrix-en.html

Based on the link above, and without any personal experience with it, the only real complaints I'd have with Threema are that:
its centralized
(potentially bigger censorship / LE targeting risk)
and costs money
(potentially harder to convince contacts to sign up and use it with you)

Nothing is perfect though, and its pretty impressive that those are the only real nags I can see for Threema.

For example, Signal is also centralized.
Likewise, Signal is free, but you could argue its a bad thing because it means the bulk of their money comes from wealthy philanthropists, and maybe that's undesirable compared to a more "honest business model" approach with paying users.
Signal even has more nags besides these two variables (USA jurisdiction, no web browser support, big tech infrastructure hosting, no cross-platform restore from backup files, desktop client is far less secure than mobile apps, etc).
I still like Signal though, despite all the nags. It definitely hits a sweet spot for many folks.
Seems like Threema has a lot to offer too.

Of course usability / convenience features are also a factor. But I've never used Threema so I can't comment on that.

Berlino

Eagle_Owl
Which version of Threema do you use - Threema Libre with it's own push service or the one for playservices? If Libre, does it have an impact for battery life and how reliable is the push service?

troika

recommend: utox、berty、briar、status、session

stupidcreature

troika uTox (which is one of the many clients for tox) or the tox protocol itself have not been updated in ages. If you're looking for a proper decentralised messagin app may I suggest cwtch? Briar is also a good one as far as I am aware.

dokmaistr

I am using Threema since 2014 and can only recommend it. Also, a use case is to use it on a tablet where no SIM slot is available.
If you are interested to read more about security: https://threema.ch/en/security. There you will find information about security audits etc.
PS: with GOS I switched from the Google Play version to Threema Libre (available via F-Droid, needs a license from the Threema Shop) which does not rely on the Google Framework.
PS2: In addition, I am also using Signal to cover friends that are not using Threema.

Eagle_Owl

Berlino
Hi Berlino,
because Threema updates via external F-Droid repo are mostly delayed a few days and need a separate channel, I prefer “the real shop version” directly from the website of Threema.
This version supports also Threema's own Push service and in-app update support.
That's why you don't need GitHub or an app store to obtain it, so it's the safest source of supply.

Threema's own Push service unfortunately isn't so efficient as Signal or Molly with WebSockets.
Threema forces the user to set the ‘App battery usage’ to ‘Unrestricted’ and ‘Mobile data usage/background data’ must also be activated. This requires an unnecessary amount of energy.
But it's Push service is very reliable for a price of higher energy consumption and not using the very best methods of coding to save energy compared with Signal and Molly, see below.

The Signal and Molly apps can do this much more energy efficient:
The ‘App battery usage’ may be set to ‘Optimised’ and the ‘Mobile data usage/background data’ may be switched off and the app can still (!) even be reached for calls (Signal/Molly with WebSockets always and Molly-FOSS with UnifiedPush after the 2nd or 3rd call attempt if Molly-FOSS is not currently active).

Berlino

Eagle_Owl
Thank you for the information. So it is the same with both possible push services as WA. The only thing that keeps me away from Threema is the fact that you can only have it installed on one device until now (they are working on a version with sync).

dokmaistr

Eagle_Owl Threema's own Push service unfortunately isn't so efficient as Signal or Molly with WebSockets.
Threema forces the user to set the ‘App battery usage’ to ‘Unrestricted’ and ‘Mobile data usage/background data’ must also be activated. This requires an unnecessary amount of energy.
But it's Push service is very reliable for a price of higher energy consumption and not using the very best methods of coding to save energy compared with Signal and Molly, see below.

The Signal and Molly apps can do this much more energy efficient:
The ‘App battery usage’ may be set to ‘Optimised’ and the ‘Mobile data usage/background data’ may be switched off and the app can still (!) even be reached for calls (Signal/Molly with WebSockets always and Molly-FOSS with UnifiedPush after the 2nd or 3rd call attempt if Molly-FOSS is not currently active).

Are you sure about the different implementations (I am not an expert)? I am asking since Signal tells me that battery optimization is active and how it can be disabled: https://support.signal.org/hc/en-us/articles/8170803067546-Pixel-Notifications

I agree that for Threema battery optimization needs to be turned off.

thure

Eagle_Owl Threema's own Push service unfortunately isn't so efficient as Signal or Molly with WebSockets.
Threema forces the user to set the ‘App battery usage’ to ‘Unrestricted’ and ‘Mobile data usage/background data’ must also be activated. This requires an unnecessary amount of energy.
But it's Push service is very reliable for a price of higher energy consumption and not using the very best methods of coding to save energy compared with Signal and Molly, see below.

In my experience, it's exactly the opposite. Threema is much more battery efficient compared to Signal and without Google services installed. Just as an example, currently Signal used 12% of the battery, compared to 3% for Threema. From the user experience I definitively prefer Threema over Signal.

Here's the Screenshot with battery usage for more details:
https://nowtransfer.de/5ba99607a088

Eagle_Owl

Berlino
Multi-Device: That´s why I like using Molly-FOSS together with Signal-Desktop on my MacBook.

Threema needs much more time to give us the ultimative Multi-Device solution with fully sync of all messages on all devices – with Perfect Forward Secrecy!

Signal synchronises the end-to-end encrypted data on the second multi-device device only from the time of the connection and all messages etc. from before are not synchronised.
That's the problem - the encryption keys of previous data are then already invalid because PFS is used. And Threema is probably in the process of solving this problem.

All other messengers do without this and can therefore already offer multi-device - with less security.

Example: Session had modified the initially used Signal protocol in favour of a quick multi-device solution and removed PFS in the process.
The Signal protocol is supposedly not optimal for decentralised solutions anyway and therefore had to be adapted by Session, but unfortunately the chief developer at the time also decided to do without PFS (in order to be able to offer multi-device).

Eagle_Owl

thure
Thanks for your screenshot.
But there is 14 minutes more screen time on your Signal app.

And yes, my experience is really exactly the opposite of yours.

I am using Threema's shop version, not Libre, because I avoid to use F-Droid and the long times for updates.
Although it is an external repository with Threema's own signature (i.e. more secure than F-Droid's uniform signature for all apps), the distribution of new app versions there is very slow (almost a week delay is usual).

If you use the Threema app directly from Threema's website, you have the choice between Google's push service or Threema's own. And you have in-app updating, which means you are notified by the Threema app as soon as Threema releases a new version and can initiate the update directly from their app.
So you don't need an external source, which is also better for security.

thure

Eagle_Owl

To be honest, I don't think the difference is entirely due to the 14 minutes more screen time. And I never had Threema use more power than Signal, not even close. And sometimes I use Threema more than Signal, depending on how active the group chats are. The settings are the same, both with unrestricted battery usage.

I update Threema via its own F-Droid repository, so the usual update delays caused by F-Droid's delay in building apps don't apply, and I don't have an additional source: https://threema.ch/en/faq/libre_installation

Exhort14

thure FYI, you don't have to use Fdroid for that repository. You can update via Obtainium.

dokmaistr

thure true, looking at the battery usage I also see that Threema is more efficient than Signal.

HomerJay

I'm using Threema libre (family an some Friends). In german schools, there is a rule that communication between teachers an students requires a safe (dataprotection) app.
A lot auf teachers do use Threema.

xuid0

HomerJay

Gee I hope Threema (the host of app) never does an Elon Musk. As in turns into a malicious host. It is my understanding they would have a lot of access so to speak (in theory).

Blastoidea

I have it on my phone, but have not used it yet.

I don’t know anyone else who has it.

Eagle_Owl

Blastoidea
What a pity.
But you have us here in the community, don't you?

If you want to try it out a bit, i.e. with real people and not just with a second smartphone and a second test account (if you have one), why not ask here if anyone would like to exchange messages occasionally?

I already do this with two people from two different countries.
It doesn't have to be all the time, but occasionally sending greetings at Christmas or New Year or other public holidays or on current occasions or to exchange ideas can be fun, even if you don't know each other personally.

Blastoidea

How would two such people exchange ThreemaID?

Eagle_Owl

Blastoidea
Sorry! Right, I forgot: in this forum here personal messages are not possible like in some other forums.

I did this in the public community of another messenger, Session: there is a community for discussing ‘instant messaging devices and protocols’.