About Threema: Anyone using it? Is it as safe as they say?

xuid0

Gee I hope Threema (the host of app) never does an Elon Musk. As in turns into a malicious host. It is my understanding they would have a lot of access so to speak (in theory).

dokmaistr

xuid0 It's designed to collect as little meta data as possible, traffic is encrypted and you don't even need to provide a phone number or email. What makes you think they have a lot of access to data?

dokmaistr

thure true, looking at the battery usage I also see that Threema is more efficient than Signal.

Eagle_Owl

dokmaistr
No, it is not more efficient if your configuration is efficient:
Signal and Molly doesn't need “Unrestricted battery use” for background usage.
If you understand this and give it a try, then you will see the difference!

Murcielago

dokmaistr

Same here - the exact values differ but the result is similar:
Looking at my setup long-term view Threema seems to consume less battery than Signal although I use Threema more than Signal.

My setup:
Both apps run in a profile without Google services.
GrapheneOS build 2024123000

Threema (version 5.6.0):
Allow background usage: on
App battery usage: unrestricted

Signal (version 7.28.4):
Allow background usage: on
App battery usage: optimized

dokmaistr

Eagle_Owl Thanks for your suggestion but I don't see this behavior. I have Signal with restriced battery usage, Threema with unrestricted battery usage: Signal 13% vs. Threema 4%, see https://nowtransfer.de/2ef5fc4a6313
I can't judge if restricted battery usage for Signal had any impact/delay since I did not receive many messages for Signal (referring to comment: "Notifications may not work properly if any power saving mode is enabled, or if power usage is managed in the background.", source https://support.signal.org/hc/en-us/articles/8170803067546-Pixel-Notifications).

Xarcell

I considered Threema and even paid for it. I found out later that not all of it's code is open source, only part of it, therefore not open to a complete audit. Session recently moved to Switzerland and is now protected by swiss laws just like Proton. I switched to GrapheneOS months ago, but cannot get my friends and family to use anything other than Facebook Messenger, which I absolutely refuse to use and haven't used since it first came out. SMS text is the only thing I'm using at the moment.

that_guy

Xarcell I considered Threema and even paid for it. I found out later that not all of it's code is open source, only part of it, therefore not open to a complete audit.

Are you referring to the server code? It's not open source but even if it was, how does one guarantee that it's actually the code running on the server at any given time?

The apps are open source, audited by cybersecurity companies like Cure53 and have reproducible builds. This is the way I understand it, anyway. I'm open to (gentle) correction if I'm wrong.

K8y

Xarcell but if you download fb messenger through the graphene sandbox version wouldn't this help with privacy? Is that better than just downloading regularly?

I was under the impression Google maps, FB messenger, gmail are all more secure and private if downloaded via graphene's sandboxed playstore...or am I wrong?

Goswin

Eagle_Owl

Thank you for the explanation.

Do you know what would be the main reasons someone would use the Threema libre version instead?

dokmaistr

Goswin Independence from Google: "In Threema Libre, there’s no single line of code that would require a proprietary software library from Google or any other third party. Push notifications, for example, will only be delivered using Threema Push, and a fallback to Google’s push service is ruled out from the outset."
see https://threema.ch/en/blog/posts/threema-libre

Goswin

dokmaistr

So just to clarify.

If play services is not installed. There isn't much difference as there is no proprietary software to fall back on. (Unless the unutilized bit of code for google in the website version is somehow a risk)

Threema Libre will require either Obtainium or an Fdroid client for updates.
Updates will also be apx a week behind schedule.

Whereas Threema apk direct from website supports in app updates.
Updates will also be on time.

cdflasdkesalkjfkdfkjsdajfd

Finally I have uninstalled it.
I liked it, but the only contact I found was my wife, and because I installed the app for him, and I don't need a superprivate environment to tell him "I'll bring the bread tonight" ;)

Graphene1

K8y depends what you are asking? More private in what way? If you use Google Maps, Google will know this user travelled from A to B. If you use Gmail, Google can read your emails. None of this changes with GrapheneOS.

There are extra permissions you can lock down not found on standard android such as storage scopes but ultimately you can't stop an app that collects usage data about it's app usage unless you stop using the app.

schweizer

Threema is a giant leap in terms of security and usability if you move from Telegram.

Telegram's headquarters are in an autocratic country where things like being LGBTQ are illegal. You must assume a company will cooperate with their home government. And you must assume that government will share the data with friendly countries.
Standard Telegram messages are not end to end encrypted. So not only the government can read your messages but also the Telegram employees.
you can request e2e encrypted chats. But you can't backup them. You loose your e2e contacts if you switch phones.

I honestly don't understand why so many people are using Telegram. Signal can do everything Telegram does but it is e2e and super easy to backup. Threema additionally does not need identification via phone number so it is more private and better with smaller kids that do not yet have a SIM card. SIM cards are expensive in some countries.

DeletedUser431

There's a security researcher Soatok who doesn't recommend the use of Threema but instead recommends Signal. https://soatok.blog/2021/11/05/threema-three-strikes-youre-out/

that_guy

DeletedUser431 As always, things are not so clear cut. The official Threema account responded in detail to the blog post you mentioned in this Reddit post: https://www.reddit.com/r/Threema/comments/qn870u

Murcielago

Threema Libre will require either Obtainium or an Fdroid client for updates.

Threema Libre (the same applies to Signal, by the way) does not require Obtainium or F-Droid for updates. You only need to install the apk, both messengers can update themselves and automatically check for updates.

Goswin

Murcielago

I think Signal will require WiFi though. It won't update with mobile data.
Im not sure why WiFi is mandatory and not an option.

Eagle_Owl

Murcielago
Sorry, not 100% correct (it would be nice, but unfortunately…).
Quote:
“The main difference between store_threema and libre is that the former contains proprietary push services and a self-updater while the latter does not. Additionally, the libre version will use your system emoji, instead of bundling emoji graphics.”

Reference:
https://github.com/threema-ch/threema-android#build-variants

Goswin

"So just to clarify.

Threema Libre will require either Obtainium or an Fdroid client for updates.
Updates will also be apx a week behind schedule.

Whereas Threema apk direct from website supports in app updates.
Updates will also be on time."

This was also meant to be a question if anyone whos more knowledgeable wants to confirm?

dokmaistr

Goswin in addition to what @Eagle_Owl mentioned:
I don't see a delay in updates using the Threema F-Droid Repo and Obtainium.
Also, I don't see a use case using Threema (Google version) without Google Play Services running since you won't have push notifications (unless you want to manually check for new notifications I assume). Threema Libre does provide its own push service independent from Google.

« Previous Page Next Page »