I’ve been inspecting this topic quite a lot and I’m a little confused now. So, we have reasons not to use Signal, reasons not to use Matrix, there were also some claims about Session being a fraught. Briar is mostly activists related (not very suitable for daily use), XMPP lacks good clients and suffers from fragmentation of protocol standards implementation, SimpleX is too feature-incomplete (no UnifiedPush support, big battery drain on Android, very decent desktop client without any message sync). I can’t say a lot about Threema or Wire, as I’m not very familiar with them.
So, my question is — is there any good private messenger at all? What do you think is the most acceptable option?
EDIT: In addition to my post:
All messengers have their flaws, I’m well aware of that. I was interested in hearing users’ opinions regarding these shortcomings, not in finding the perfect messenger. I may have worded my thoughts incorrectly, sorry for that.
XMPP clients are fine albeit it all, as many as they are, slightly different as is the nature of the protocol. This just means there is value in contributing to existing clients, creating new clients, or embracing progressive enhancement (which most do for example with emoji reactions just being a quoted text reply & so on) & complete feature parity is a fool’s errand if you want an exensible protocol with diversity & experimentation in the community. With the broad exception of the Conversations Compliance, there isn’t a flagship client & instead the best ideas come to the most used or most innovative clients. I use Cheogram, Profanity, Gajim, Dino, Movim at different times (& would love to create my own). The protocol is stable, healthy, & ready for proposals for improvement.
If I compare this to the more-expensive-by-all-metrics-to-run Matrix, if it ain’t Element, you gotta problem since a vast majority of users are on it & using all of its features & no other client has anything near parity but are expected to have parity instead of allowing things to sometimes be gracefully missed or shown in a less than ideal manner as acceptable. This hurts experimentation. Good luck trying anything similar to GDPR when all nodes are design & required to duplicate all messages & attachments for all users to every server anyone in it comes from.
The only real gotcha is the same gotcha as Matrix when using multiple clients with double-ratchet encryption (ala Signal) is that clients will expire keys that haven’t been seen in a while & is hard to get both devices retrusting one another. Turning it off & on again rarely works & requires fiddling on both ends sometimes. I really should just use PGP for encryption more often…
The problem is that iPhone has some weird shit about push notifications and none of the high security XMPP clients I have tried seem to support them.
XMPP doesn’t need notifications per se since it already has a connection to the client. Since it works for all other OSs to hook into this & display a notification, I don’t even want to know what restrictions Apple has on iOS that prevent such basic behavior. Apple digs its own grave here. What’s worse is I want to say “go get a Android phone, dummy” to a ‘normie’ but the stock OS on any Android phone is going to be on aggregate a worse privacy situation unless you would have to be ready to teach how to unGoogle it to the extent they would tolerate.
Linux phone when?
You will always find problems associated with every thing but here’s some recommandations :
For a good start, Signal and his forks (molly…)
For daily basis and better than Signal, choose SimpleX (SimpleX is only feature incomplete for the mainstream app, but in it you can send texts, voices, photos, videos, live messages, have a PP, a alias for your contacts…)
Important stuff and activism, use Briar
Briar is really interesting but it doesn’t work as well for a casual messager. It is a bit complex to setup and very hard to understand unless you have strong knowledge on the subject. I think it is very powerful but breaks the standard convention most messaging applications follow.
Kind of limited due to there not being an iOS version, but Briar is pretty decent. It was made to be usable in repressive areas by press and other groups, as well as in areas where bad weather has taken out cell and regular wifi. Can be used with phone data, but also offline via ad-hoc wifi and bluetooth. But stuff like Signal and SimpleX are more overall useful to more people (and I think SimpleX also supports offline local immediate area of each other like wifi and bluetooth but I don’t remember atm).
If you really need it to be secure and private, and are communicating mostly with known acquaintances within a reasonable radius, with low bandwidth requirements, LoRA with encryption is the best bet.
It is a higher bar of entry but at least you can be confident your messages won’t be intercepted in any useful form.
Have you used it before? I’m curious about how it works. I don’t personally have a use case but it seems very cool.
I have 2 heltec v3 nodes, I setup an encrypted channel between them… I can get good distance but I have a very good network run by others in the area that I piggy back on.
If you have line of sight you can go pretty far
I don’t really have much of a use case though, it’s just playing around with the tech for fun.
I have been interested in trying out LoRA and just need to get some devices built. Though I am not as concerned about the super privacy part (thought that is nice). I am thinking that it would be good for emergency situations like shit that has happened with the south-east. Even if the communications would be limited to text, shit is good as long as I can use simple solar panels and battery banks.
Conversations for android is an example of a good XMPP client.
Motal is participating in GSoC this year to get some new features too.
But this is a wider issue that developing free software for Apple products is way too expensive (time & money) to be feasible while also going against the general free software ethos. It should be no surprise the walled garden of a proprietary OS that charges you to publish to their store has a severe lack of free or otherwise ethical software (which is important for security for something as important as a messaging app full of private data).
