Secure messager app thoughts

mrktmind

I have been researching secure messaging apps and I've narrowed down to pretty much the same one's everyone else does: Signal, SimpleX, and Threema. I think that SimpleX is probably the best but I don't think my family members could use it. The other two both have their drawbacks - Signal requires a phone number, is located in the US (Cloud Act). and is founded by someone I don't necessarily trust. Threema's drawbacks are proprietary code and I have yet to figure out the background of the owners. Threema also doesn't use any outside proprietary code and even has it's own push service. Whereas Signal uses Apple/Google for that. And Signal uses Amazon/Microsoft for their servers. Threema's proprietary code COULD actually be a benefit as well as a drawback - they MIGHT be keeping it proprietary as a method to keep it more secure? Both say they are not logging anything and with both messages are encoded on the phones rather than the server so how important is ability to audit the server code?

privacyisconsent

mrktmind and is founded by someone I don't necessarily trust

Signal was founded by Matthew Rosenfeld https://moxie.org/ and Stuart Anderson https://www.cs.cmu.edu/~soa/. So, curious which of the two you find particularly untrustworthy and why?

schweizer

There is Threema libre which is completely open source. Only the servers are proprietary but that should not matter because all the encryption is done on client side.

The biggest downside of Threema is that it can't do phone calls in the desktop version. It's biggest advantage is that it does not require a phone number so it is very suitable for smaller kids or people who want maximum privacy.

That said both Signal and Threema are very similar to use. Both have a reasonnably big community, at least in Europe. SimpleX has a very limited community.

JollyRancher

What's your use case and threat profile?

Signal is a great general purpose secure messenger. It honestly should replace SMS as the default texting app. Easy to use, widespread (relatively speaking) adoption, technically secure encryption, and just generally good.

If you don't expect major state actors to be your opposition and/or care about you then its fine. The weaknesses are generally in the OpSec realm and on the other parties you are communicating with.

SimpleX is superior if you want anonymity, not just security. Ease of use and discoverability suffer compared to Signal.

icarious

JollyRancher

I agree with the above comment. I use Signal as a general purpose secure messenger over WhatsApp/ Telegrem to keep in touch with people who are ok with using it and don't want to go down the learning curve of SimpleX. But at the end of the day I prefer SimpleX for more anonymity and overall design.

mrktmind

Thanks for the replies!

With regards to the use case/threat model question - I have often read that this is a good starting point and it makes great sense. But in my case I'm not looking for anonymity and security because I NEED it. I am looking for a secure messenger because I don't appreciate someone/entities lying to me, spying on me, and stealing from me (or anyone else). Plus I believe it is our duty to do this if we wish to preserve our freedoms - use it or lose it. Last but not least, while I don't NEED it now, I feel it is very possible we could NEED it in the future - I'd rather do it now than wait till I really do need it.

With regards to the question about the founders of Signal - I don't believe this is the right place for such a discussion. Suffice it to say that my opinion could be totally unfair - both of the founders could be great individuals with the people's best interest in their hearts. This is more of a "where there is smoke there is fire" / "better safe than sorry" thing.