Signal vs Threema as a Secure Messaging App

PintOfGuinness

Signal and Threema are both great choices as far as a secure messaging app is concerned. While ultimately it may come down to opinion, which is more secure: Signal or Threema?

Signal
Advantages: Well-known and thoroughly tested protocol; disappearing messages
(Potential) Disadvantages: Servers are on Amazon AWS; Questionable inclusion of MobileCoin crypto wallets

Threema
Advantages: Swiss-based with their own servers; No mobile number required
(Potential) Disadvantages: Latest "Ibex" protocol still in its infancy

jufstp

PintOfGuinness As far as messaging is concerned, Olvid is the best in security. Then signal. Its two messaging systems feature post-quantum encryption, have been audited and are widely validated.
A special mention goes to olvid, which contains fewer attack surfaces, as there is no telephone number library.

https://github.com/signalapp/Signal-Android
https://github.com/olvid-io/olvid-android

Max-Zorin

To me it comes down to how many of your contacts are actually willing to use the messaging app. The unwillingness of many people to "install another messenger" on their phones seems to be one of the strongest forces in nature........

Common excuses.

I'm already on Whatsapp.
I already use SMS.
I have an IPhone and use Apple Messenger. Maybe you should just buy a IPhone instead.
I don't want to pay for an app.
None on my other friends are on Signal, Threema ....

Trust me, it will drive you to drink. Good luck.

[deleted]

Max-Zorin same experience to the dot here, including the drink :)

User2288

Max-Zorin To me it comes down to how many of your contacts are actually willing to use the messaging app. The unwillingness of many people to "install another messenger" on their phones seems to be one of the strongest forces in nature

This.

xxx

Max-Zorin To me it comes down to how many of your contacts are actually willing to use the messaging app. The unwillingness of many people to "install another messenger" on their phones seems to be one of the strongest forces in nature........

So true.
I ended up with Molly and threema. People can reach me there or they should use Phone, SMS or mail.

Blastoidea

Take a look at Session before you decide.

Kottonballs

Blastoidea Yeah, I went through this as well. My rule was that I was not giving any personal information (ie phone number) to the app. I narrowed it down to Session and Matrix.

It seems there is no perfect app but Session seems to work the best for me and my family. There were some issues with prior versions where notifications weren't sent, etc but that seems to be fixed.

And yes, convincing people to switch is hard. So I took the stubborn approach: use Session or don't bother messaging me. I had one hold out friend who tried to convince me to use WhatsApp, she just calls me now. :)

inomfood

I like both but I have only ever been able to convince people beside my SO to use Signal because it is free. When you're trying to get people to use a new messaging service you want as little barrier of entry as possible and even just the small cost of threema is enough to turn folks away.

Graphite

inomfood When you're trying to get people to use a new messaging service you want as little barrier of entry as possible

Exactly. Now that Signal has reach a critical mass, they aren't really affected by a decision to not support SMS. But if SMS wasn't a feature back then, I wouldn't be able to invite many people.

spiral

People are not going to download and use Threema. I've gotten plenty of people to use signal, I suggest you concentrate your efforts with it.

Albatross

Yea, the answer is basically Signal at this point just from the perspective that people actually use. Whatever the argument you might be able to make for Threema technically, no one uses it that I know. It would truly be for a specific contact or few if you made a technical case for it.

dirksche

I was able to convince about 20 people around me to use Threema.
What I don't like with Signal: you have to solve a Captcha before using the app. So you have to connect Googleserver. I don't know what information will be transmitted, but this coercion is a pain in the a..

Graphite

dirksche
I don't remember any Captcha. Were you trying to register on a VPN or Tor?
It does require a phone number. From what I remember, Google is only used for low power push notifications, so it works fine without any Google services with just polling notifications.

[deleted]

dirksche What I don't like with Signal: you have to solve a Captcha before using the app. So you have to connect Googleserver. I don't know what information will be transmitted, but this coercion is a pain in the a..

If I am not mistaken, Threema is a paid app, so you have to actually buy it somewhere (Play store?), so there are some information about payment involved and also some e-mail account. If that is the case an user has to also get in touch with servers of Google. If all above is correct (I admit I haven't looked pass the payment info), I would be much OK downloading apk from Signal.org, than to provide all necessary information to buy "anonymous" app that in the process gathers even more information about the user.

Nevertheless, anything that tries to avoid Facebook, Apple and Google deservers (IMO) at least little praise :-)

dirksche

Graphite In the last month I installed different versions of molly and signal, foss and stock versions ( because of UnifiedPush testing).
And every time I installed molly/signal I had to solve a captcha. No VPN, no tor.

malatoi

Same here: I installed in the last months on several devices Signal and Molly and had to solve captchas (the ones with the "mark every photo with busses on it"). But I have always VPN on.

I use Signal and Threema (since it is FOSS): On Signal I have 70 contacts, on Threema 4. Nevertheless, Threema is a really good tool: It works really smoothly and reliable. I like the fact, that you can use it without a phone number.
As a third messenger I use the xmpp app Conversations. This would be my favourite, but I gave it up to convince people. ;)
I am happy when I can draw people to Signal which is not so hard.

LuckyLuke

[deleted] You can buy the Threema app from their own store and bypass Google completely. Threema also offers its own push service, so you don't need Google services.

For me, Threema is the only messenger with a transparent financing model. One-time payment from private customers and corporate subscriptions.

App developers also have to earn their bread and butter, and the server infrastructure also costs money. If you don't pay with money, you usually pay with something else (e.g., data).

[deleted]

[deleted] Every year you can win free Threema shop licenses by solving their easter egg challenge. You get three free licenses which are then delivered via a Threema private message, but you can use those free licenses to create a new profile that is not affiliated to your payment info.

psynusoidal

FWIW threema has had some serious issues in the past. They are supposedly fixed with their new ibex protocol, but their previous protocol was flat out broken in 5 or 6 different ways.

https://breakingthe3ma.app/
https://soatok.blog/2021/11/05/threema-three-strikes-youre-out/ (furry warning)

spiral

psynusoidal

psynusoidal
soatok crushed that blog. That was a great read, thanks for posting.

Themble

I think if you consider all the trade-offs between security, privacy and usability (which goes hand in hand with a decent number of users), these two messengers are the only choice. For Signal I have got a significantly larger user base which is probably due to the fact that it is for free and people get more pleasant features they like from WA (e.g. stories). Threema is a bit more sober. However, I like the polls there a lot. BTW: With Threema you can decide for every single contact if this contact recieves a "read receipt" or "typing indicator". And you still can see those receipts yourself if your contact allows you to see them. Even if you don't allow that contact to see receipts for the messages he sent to you. You can also tell Threema to search your own contact list for contacts who have Threema without the necessity to share your own phone number. So you can find Threema users from your contacts without telling them that you use Threema (unless you text them via Threema of course).

Blastoidea

My family and I switched to Session on the first of the year.

It works fine for us.

itsjpb

i never see element mentioned in these discussions. is it not up to par with the rest? always seemed like a good option.

treequell

itsjpb From what I've heard, the issue with Matrix (the protocol Element uses) is metadata.