Over the past few years I have gone through a bunch of different apps and protocols to find the best one for “securely” communicating with my family and friends.
I ended up with the amazing XMPP protocol and my family/friends frequently use its clients to contact me.
Monal for IOS and Cheogram/Conversations/Quicksy for Android. The android app I install depends on if I can get F-Droid on their phone or not.
It’s been great with OMEMO encryption and the clients/apps available for XMPP. But sometimes I have issues introducing people to it.
Jabber (friendly name for xmpp) sounds silly to say. The clients all have weird names. And after trying the Signal mobile app it feels more focused than what anyone in the XMPP community has whipped up.
But the capabilities of XMPP makes it better.
Signal Cons (immediete)
- Centralized
- Single app
- Phone numbers
XMPP/Jabber Cons
- Picking server
- Apps are sort of less friendly
What really scares me about Signal is the centralization. Any nerd can easily host an XMPP server these days. But Signal from what I’ve heard really wants us to use their server.
If XMPP gets more attention I’m sure we can get people supporting projects and creating better apps.
I keep seeing people recommended Signal instead.
This is a bit of a tired ramble. What I wanna know is why anyone is preferring Signal over XMPP apps. I assume it might be not knowing about it. Tell me what you use to message people.
Signal is the best intersection of genuine security and ease-of-use that I’ve ever seen. No choosing a server, no making an account. Just install the app, get a confirmation SMS, and now you can communicate with future-proof encryption and authentication right away.
For more technical people, who aren’t going to be intimidated by things like making accounts and secure passwords and choosing servers, Signal is not the best. But when I need to communicate securely with non-technical people, it’s a wonderful quick go-to solution.
I’m not going to push anyone who uses a secure decentralized FOSS chat already to signal, but someone who uses telegram/viber/whatsapp is easier to get gradually on signal, which is super low effort compared to the ones you mentioned.
I’ve tried. I’m happy that I got friends and family to move from SMS and WhatsApp to Signal. Some I got to move to e.g. matrix but that’s only a few.
Just my two cents since you asked. I agree with you but I don’t want perfect to be the enemy of good.
Why is your name red
It means they are your god and you should bow. (they’re an admin on your instance)
Ah… But there is another. The all mighty creator (app developer of voyager) whose name is in purple!
I’m guessing you are using Voyager app. It’s because I’m your instance (sopuli) admin :)
There’s nothing wrong with Signal’s centralization model in a worrying sense. It acts only as a clueless message relay, and it has near-zero information on any of its users, even as it delivers messages from person to person. The only information Signal knows is if a phone number is registered and the last time it connected to the server. There is great care taken to make sure everything else is completely end-to-end encrypted and unknowable, even by subpoena.
The only real issue with Signal’s centralization is that if Signal the company goes down, then all clients can no longer work until someone stands up a new server to act as a relay again. Signal isn’t the endgame of privacy, but it’s the best we have right now for a lot of usecases, and it’s the only one I’ve had any luck converting normies to as it’s very polished and has a lot of features. IMO, by the time the central Signal server turns into an actual problem we’ll hopefully have excellent options available to migrate to.
Also TMK, the only reason you still need a phone number for Signal is to combat spam. You can disable your phone number being shown to anyone else in the app and only use temporary invite codes to connect with people, so I don’t count the phone number as a huge problem, though the requirement does still annoy me as it makes having multiple accounts more difficult and asserts a certain level of privilege.
I totally agree with you. But!
But Signal from what I’ve heard really wants us to use their server.
Signal doesn’t have their own servers. Instead, they rent servers from 4 companies, 3 of them is Google, Amazon, and Microsoft. So Signal is relying on Big Tech and if Big Tech decides that enough is enough, they can easily shut Signal down.
THAT is what I find most terrifying. And why not use their own server? Not enough money, but they are working on it (good).
And to make it a little bit worst: Signal depends on a third party company for sending out SMS. Your phone number is therefore handled by not Signal, but by yet another company, highly likey an American company. And they are against privacy invading companies at the same time they are one. Oh, the irony.
You want sources? Sure.
- https://signal.org/legal/ (below “Information we may share”)
- https://signal.org/blog/signal-is-expensive/
Don’t get me wrong, I absolutely love the idea of Signal. But there is flaws that makes Signal more privacy invading than privacy friendly.
That’s the part that makes me nervous. If I get a bunch of people locked on Signal, then they take away services or change how they run the servers, then it would be a hassle to move people to a completely new interface.
Yeah. Let say Signal goes down because of Big Tech and lets say that 50% of their users use Signal as their only messaging app. What will happen then? Hysteria!
No, XMPP all the way for me until Signal becomes decentralized with zero external connections and when they also have removed the phone number requirement.
I’ve used XMPP since shortly after it was developed. I still use it today.
HOWEVER, while the clients are relatively good, as long as they support the extensions you want to use, I’ve found maintaining the server to be a royal headache. Between protocol and extension improvements, security updates and general server instability, I find that it’s a constant struggle to have it running and compatible with whatever client someone is using, when someone actually uses it.
Signal, on the other hand, pretty much always works, has a single client, and nobody has to worry about managing the server except Signal. So as infrastructure, it makes a lot more sense.
Because it’s nearly impossible to convince friends and family to use anything other than iMessage or “the text app” on their phone. The process you’ve described is basically akin to swimming the English Channel for the general public. I’d do it. But expecting anyone else to is just a pipe dream.
I’m already a social outcast and second class citizen for not using imessage. Asking my friends and family to install a whole separate app just to communicate with me puts me firmly in weirdo territory.
It can be tough trying to stick to good privacy and staying social. I can do it because I’ve set boundaries and have a passion for what I believe in.
If somebosy actually wants to contact me, they join a privacy friendly platform, or just take my email. Most people my generation do not use email for instant communication, and neither do I.
I’ve gotten myself to be someone people want to reach out to, almost entirely in an effort to promote/market FOSS. To be a likable, knowledgeable, and friendly resource. That’s how I managed to convert a lot of people. If I say anymore I really bet I could be identified from my post. 😆
Tough pursuits will never be a pipe dream. It just takes enough time and grit. And a little mojo.
I think this post is a noteworthy response. Against Silos+Signal
Signal is a much better recommendation when leaving Telegram. And the OMEMO implementation concerns are something I need to consider. That unprofessional response from one of the devs is not a good look at all.
Though as a comment pointed out, control of servers is like the one main checkbox that I really need filled.
On the point about clients not being OMEMO by default or enforced. This isn’t the biggest issue for me. I’m not doing crimes, but I still wouldn’t want my saucy messages to be read by server admins or third parties. Whenever I message somebody, I confirm that they are the proper recipient and are using OMEMO. And the clients I found myself comfortable with all support PGP key use instead. (That would be Cheogram & Gajim if anyone was interested.)
This was a great read though, at least to me. It gave me some thoughts to consider.
I’m gonna look into what kind of threats these improper dependency versions and such might pose. Hopefully by now most of these issues have been resolved.
The biggest thing is getting people into the loop of “secure apps” before they really need it.
I’ll be honest, most of the crypto/security jargon flies straight over my head, but Tim Henkes’ reply at the end, for fucks’ sake man. I don’t suppose xmpp has an alternative encryption to use instead of omemo?
Pretty much any encryption you can send over text. My favorite clients support PGP instead. But it’s up to the clients to implement envryption and not really the protocol I guess.
If I could get a single person to use Signal instead of Whatsapp… or even the nerds I know to use matrix instead of Discord…
There two kinds of nerds. Ones that are actually curious to try new things, and ones that conform and sully the name. It’s like tech bros vs real IT professionals.
I use Telegram. Eek? It’s just my wife and I though. All these things I’ve heard about Telegram? Never actually seen them in mine. I have looked at groups, but I’ve only seen memes, crypto crap, and what look like scams (“post this in 5 Reddit threads to get invited to the actual group”). There’s nothing of value out there that I’ve seen. So I just use it to message my wife, because texting wasn’t good enough when we started using it (both our phones have RCS now) and I don’t use Facebook, and she doesn’t have an iPhone (so, no iMessage).
I completely reject this notion that you have to pick one and stay with it. My messaging apps include iMessage, Session, Signal, and Telegram. I also have a fork of Telegram that lets me use it from my watch (as in, it has a watch companion; official Telegram does not). I also have Discord (need it for a couple things).
I used xmpp with otr encryption… maybe also omemo, it rings a bell. This was some years ago. But it was barely usable. Otr refused to connect at times and only unecrypted worked, messages were encrypted with wrong keys or something and history became unreadable. It worked on the desktop, but then not on the phone, only with this and that client, but not those. It was a confusing mess and I had to stop using it. If it works today, thats great.
Android’s bullshit made me quit XMPP. We needed instant messages to be instant but Android kept making that harder and harder until it was impossible.
With Signal we’re still fighting but it works a little bit better due to integration with the messenger service or whatever it’s called. Dunno, maybe XMPP can work with that as well by now.
Sigh, I want my Linux phone where I can control battery life vs availability myself.
Because the most useful communication apps are the ones that you can reach people on. XMPP’s lack of user friendly UX or long term support and commitment make it DOA for most normal people, which in turn makes it DOA for everyone who might want to talk to one of those normal people who are turned off by it.
Signal & Conversations (XMPP). Apparently the move from WA to Signal seems easier for most of my bubble. Can’t understand why.
You can’t understand why? Are you incapable of evaluating a user experience?
Care to explain, kind person? What’s so different between Signal and WA that a user could not find their way? Enlighten me.
XMPP also supports federation, or server-to-server communication, but it’s whitelist based from my cursory read
Such a benefit indeed. Like email, you can use any server and app. Except it has more instant messenging features.
First of all, thank you for your recommendation. I was on the fence between Siskin IM and Monal, so I went with Monal to replace AstraChat.
I’ve used Signal before and it was fine but I prefer not to give a phone number to open an account; there are other services that don’t require it.
Speaking of services, I use Simple X, Session, Matrix and Delta Chat (occasionally). Most of my eccentric mix of family, friends and colleagues are happy to try something new or switch as long as it doesn’t require a phone number to sign up. They’re slowly leaving Signal, WhatsApp, Telegram and limiting access to their iMessage.
In my experience, Session syncs very well between my devices which makes it my favorite. I chose FluffyChat over Element because of the App Privacy in iOS.
Signal is really simple and has a sizable userbase now. I’ve worked with people in non-tech companies and they’ll have signal installed because theres someone in management that cares for security to a degree and does official nonofficial team communication with signal
Element/Matrix I think has a chance. The newest Element X app looks a lot better on the phone and on desktop. It’s progressing to good user experience
