this post was submitted on 07 Feb 2025

306 points (98.7% liked)

Technology

61904 readers

3341 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each other!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed
Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago

MODERATORS

306

Time to get serious with E2E encrypted messaging (techcrunch.com)

submitted 1 day ago by [email protected] to c/technology

94 comments fedilink hide all child comments

I currently use Telegram for my friends and family, but have reluctantly come to the conclusion that the UK Government is either reaching agreement for backdoors with messaging services, or is trying its hardest to.

I'm also on Element/Matrix. Before I try to get my contacts to join me on there, should I be aware of any privacy issues or is that a good place to head?

top 50 comments

sorted by: hot top controversial new old

[–] [email protected] 24 points 6 hours ago* (last edited 6 hours ago) (1 children)

I currently use Telegram for my friends and family

Telegram is probably the worst thing you could use, it doesn't encrypt messages by default and they are stored on Telegram's servers, so they can read them at any time.

I'm also on Element/Matrix. Before I try to get my contacts to join me on there, should I be aware of any privacy issues

Yes, Matrix leaks a bunch of metadata and doesn't have post-quantum encryption.

The best option is to use Signal. It uses end-to-end encryption by default for everything: Normal chats, group chats, voice and video calls and even stories. Messages are only stored on their servers (in encrypted format, so they can't access them) until you receive them, after which they are promptly deleted and only stored on your device. And Signal has much better metadata protection than Matrix. The UX is also much better and less confusing, making onboarding new users much easier.

[–] cmhe 7 points 6 hours ago (2 children)

But you should also be aware that Signal does not federate, so the company can be bought. They have control over all accounts and the servers, without easy way to migrate away again. So it might just be another trap.

Try to use federated services (like matrix), they are more robust against hostile take overs.

[–] [email protected] 7 points 6 hours ago* (last edited 6 hours ago) (1 children)

At least (to my knowledge) the Signal messages are decrypted on the client end, so buying the company doesn't give them automatic access to messages.

Having said that, I'm sure a hostile new owner could update the app to decrypt and then send the messages as plaintext to the servers if they wanted..

[–] cmhe 3 points 6 hours ago (1 children)

Well, you can still insert client side decryption into the app.

But it isn't really about the messages, it is about the control of the servers and the accounts. You cannot easily move away from their servers, because you will lose your contacts. This gives the people controlling the servers power over you. A sort of vendor lockin.

[–] [email protected] 0 points 5 hours ago (1 children)

Well, you can still insert client side decryption into the app.

That's why all clients are fully open-source. You can also use a fork like Molly.

[–] cmhe 3 points 5 hours ago* (last edited 5 hours ago)

AFAIK, Signal does not want anyone to use alternative clients, has that changed?

As far as I know moxie, signals lead dev, considers only the use of the officially build and distributed client authorized to use their servers.

So if they ever manage to detect someone using their services with an alternative client, they might delete your account.

https://techcrunch.com/2016/11/07/signal-app-maker-rebuts-criticism-of-dev-direction-by-calling-for-more-community-help/

[–] [email protected] 6 points 6 hours ago (1 children)

so the company can be bought

The company (Signal Messenger LLC) is fully owned by Signal Foundation, a 501(c)3 non profit organization.

Try to use federated services

I generally like this idea, and I also use federated services for things like social media, that's why we're having a discussion here on Lemmy. But it introduces some issues with private messaging, like lack of reliability, which sucks if you want to use Matrix as your primary messenger, as well as metadata leaks. Federation is not always the answer, and in my opinion definitely not when it comes private and secure messaging.

they are more robust against hostile take overs

Probably around 80-90% of Matrix users are on the matrix.org homeserver, so it's absolutely not as decentralized and resilient as you think it is.

[–] cmhe 2 points 6 hours ago

The company (Signal Messenger LLC) is fully owned by Signal Foundation, a 501(c)3 non profit organization.

OpenAI is also non-profit. Not really an argument.

Probably around 80-90% of Matrix users are on the matrix.org homeserver, so it's absolutely not as decentralized and resilient as you think it is.

Well, the goal is that moving to your own server, will not mean that you will loose access to all your contacts. Which makes moving instances much simpler. If Matrix gets a hostile take-over, your don't really need to reach a critical mass for an alternative server.

[–] [email protected] 2 points 3 hours ago (1 children)

hello beautiful people of lemmy I'm excited to make my first comment in here

so I wanted to ask: considering that WhatsApp is a big threat to privacy and even worse because of google and iOS backups, how big of an improvement would it be not using it and using the secret chat option in telegram instead? That would solve the issue wouldn't it? As far as I know the concern is with normal non encrypted conversations and the groups channels and all those.

I would love to use signal with everyone but where I live it seems that there is 0 worries about the topic so I only use it with my more "international" people. The most I can get is probably to use telegram E2EE.

[–] [email protected] 6 points 2 hours ago* (last edited 2 hours ago)

Hello and welcome to the Fediverse.

Telegram's secret chat's encryption algorithm is made by Telegram themselves, which is already a red flag. You generally don't want to roll out your own encryption algorithm if you aren't cryptographers, which Telegram people aren't. Their MTProto is also not proven, so you'd rather not want to use it.

Here's a blog entry about their MTProto: https://web.archive.org/web/20180420061726/http://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-maths/

[–] [email protected] 5 points 5 hours ago (1 children)

The most privacy focused messaging app I know is SimpleX Chat, it has no user IDs, is FOSS, e2e encrypted with an option to use TOR, give it a try!

[–] [email protected] 2 points 3 hours ago

+1 for SimpleX

[–] [email protected] 19 points 9 hours ago

telegram is not encrypted e2e

[–] [email protected] 3 points 8 hours ago

My response to the body of this post is https://www.privacyguides.org/en/real-time-communication/

This might address the URL of this post (I've never interacted with "iCloud" so I don't necessarily know what would be a good replacement for it): https://www.privacyguides.org/en/document-collaboration/

[–] [email protected] 85 points 21 hours ago

Telegram is the worst kind of "secure" messaging in that it gives you a false sense of security while not really being secure.

[–] rottingleaf 99 points 1 day ago

Telegram is the least secure thing there is. Not only it's complete zero effort security, it's also much above zero effort to advertise itself as almost secure. Not a good combination as you know.

[–] [email protected] 64 points 1 day ago (12 children)

The biggest issue with Matrix is that the server collects ALL the metadata. If that's your server, that's fine. If thats the default matrix.org server that almost everyone uses, you might as well be using WhatsApp. Same thing goes if any of those people are conversing with people on your server, as they will store all redundant metadata on their server as well.

Signal is easier to use, more private, and faster.

[–] fangleone2526 25 points 1 day ago (11 children)

Signal requires a phone number on setup.

Also, matrix has bridges, which alone make it worthwhile for me. They, of course, don't help privacy, but they are so so nice for convenience.

Matrix is definitely slow though, and a grand majority of the clients are heavy terrible buggy electron apps. There are a few good ones ( nheko and the new beeper clients ), but even they have some rough edges.

I still use matrix all the time and love it.

If max privacy was the goal I think simplex looks wonderful. No required info for sign up, no way for them to possibly collect any metadata ( because there are no identifiers sent over internet for anyone at all ), E2EE, and decentralized.

[–] [email protected] 3 points 12 hours ago (1 children)

I’ve been trying SimpleX a little this week. It hasn’t been great, unfortunately. It could be an iOS issue, but notifications aren’t coming through. Maybe Android will be better.

[–] [email protected] 1 points 6 hours ago (1 children)

On iOS, I had best experience using element X, so far

[–] [email protected] 1 points 7 minutes ago

I absolutely love Element X. Synapse has been low maintenance to self-host, as well. Win-win.

[–] [email protected] 22 points 23 hours ago* (last edited 23 hours ago) (11 children)

Signal requires a phone number on setup.

It is dumb and annoying and inconvenient but doesn't affect its use or privacy.

I do agree that SimpleX seems like the best chat option.

[–] [email protected] 8 points 18 hours ago (2 children)

It creates a cost for spammers. They have to have an account with a Telco, which isn't free, which in a lot of countries comes with some sort of National ID to register. That's the reason.

[–] [email protected] 3 points 8 hours ago

Lol, let me introduce you to http://smspva.com/

[–] [email protected] 4 points 16 hours ago* (last edited 16 hours ago)

No they don't, you can sign up with a VoIP provider.

load more comments (10 replies)

load more comments (9 replies)

load more comments (11 replies)

[–] [email protected] 29 points 1 day ago (12 children)

I’ve honestly found signal better than matrix.

Matrix is just not there yet in terms of features UI etc and is less private than signal because it collects way more metadata and stuff. I know the idea of federation is cool, but Signal works better for the privacy aspect.

load more comments (12 replies)

[–] [email protected] 15 points 22 hours ago* (last edited 22 hours ago) (1 children)

I currently use Telegram for my friends and family, but have reluctantly come to the conclusion that the UK Government is either reaching agreement for backdoors with messaging services, or is trying its hardest to.

Unless you start an encrypted chat, Telegram chats are not E2E.

I’m also on Element/Matrix. Before I try to get my contacts to join me on there, should I be aware of any privacy issues or is that a good place to head?

Host your own Matrix node, and then you don't have to worry about prying eyes. Realistically, instead of worrying about the protocol, worry about the content of the text. Use PGP to encrypt your own text and send it over clearnet. Who cares at that point.

load more comments (1 replies)

load more comments