What messenger app to recommend to those not interested in privacy?

So I’m in a somewhat unfortunate situation. My circle of friends doesn’t want to switch to another messenger and we are currently stuck on the worst possible platform for security: Telegram.

The problem is that it is very hard to convince anyone to switch, if they are all perfectly fine and like Telegram. I mean I can get why they like it: The UX and UI of Telegram are amazing and there are well functioning clients available for any platform. It has more features and gimmicks than any other messenger I know BUT it lacks one mayor thing: E2EE. And that’s mostly what I care about. The second problem is that I was the person who recommended the switch to Telegram right after WhatsApp was bought by Facebook. I know, that was a bad recommendation, but back then I didn’t know shit about privacy or why E2EE mattered. I was just like “Hey, it’s not by Facebook, so it must be better”. And now everyone I know is there and won’t leave.

If - in the hypothetical situation of me setting an ultimatum and deleting my Telegram after that - I wanted to make them switch somewhere else: What messenger would that be? Currently I’m mostly thinking Signal. I know it’s not perfect either, it is centralized, and the servers are in the US, but it has a bigger user base already than most of its competitors like Threema or Matrix/Element and it is very easy to set up and use. I’m already a user of Signal, Threema, Matrix, WhatsApp and Telegram (every platform for some contacts, but most of them on Telegram sadly), so having yet another option is not a problem for me, as well as getting rid of one is also no problem. I’d love to delete both Telegram and WhatsApp in this move.

So, in conclusion, what I need is a messenger that has all or most of the following:

  • best possible security (E2EE is minimum)
  • easy to use (no complicated setup, simple UI)
  • already has some users (not too niche)
  • cross-platform and multi-device (should run on Android, iOS and Windows/Web)
  • some flashy dumb features like stickers and so on to keep them entertained

My choice would be Signal. But I am unsure if that is the best choice or if I should just wait a bit and see what all of the new EU laws about messengers and gatekeepers bring to the game and if anything chances with that.

TheAnonymouseJoker,
@TheAnonymouseJoker@lemmy.ml avatar

Either Signal or WhatsApp. There is no other easy to adopt, and good UX option. Although personally I find Signal very dubious because they refuse to implement usernames since many years now, but found all the time to implement that MobileCoin crypto.

sir_reginald,
@sir_reginald@lemmy.world avatar

If they have Android, Conversations is great, not more complicated to use than your normal instant messenger, except for the account creation which works just like email (user@server) so not that difficult either.

darkstar,

Signal?

skullgiver, (edited )
@skullgiver@popplesburger.hilciferous.nl avatar

deleted_by_author

    •
    amju_wolf,
    @amju_wolf@pawb.social avatar

    Telegram clients also technically have source available, even if late.

    MarcRnt,

    I know, but their server doesn’t. And since everyone uses it without the secret chats feature, they could read every message we exchange.

    1984,
    @1984@lemmy.today avatar

    Telegram has started it’s Enshittification phase now. They put stuff in the user interface to try and push you to pay for it.

    MarcRnt,

    And they have some weird crypto scams running in the background as well.

    MarcRnt,

    I don’t think WhatsApp is a good option. Their clients are not Open Source, so it’s unknown if they really implement all the privacy features of the Signal client. Also, Facebook and WhatsApp are known to collect every single bit of Metadata they can get, it’s really bad. I wouldn’t touch it again, under any circumstances. I’m glad that nobody I know uses it, at least inside my circle of friends. Some still use it for outside connections or family members.

    ReversalHatchery,

    Telegram is absolutely not the worst one. Those are whatsapp, facebook messenger, and viber. Telegram is not good, but I think it’s an acceptable compromise

    nIi7WJVZwktT4Ze,

    Do you have any info on Viber being a bad service privacy-wise? It’s a lesser-known messenger that prides itself on its privacy policy but I can’t find any info on it being the case or not.

    ReversalHatchery,

    Check this analysis from 3 days ago.
    7 different tracking components, from 4 different companies, including facebook.

    I don’t think it should pride itself on anything related to privacy.

    It also has quite a few hard to explain permissions.

    skullgiver, (edited )
    @skullgiver@popplesburger.hilciferous.nl avatar

    deleted_by_author

    •
    ReversalHatchery,

    fb messenger has a hidden e2ee feature that probably nobody uses, like with telegram, that’s at most feature parity, not a pro compared to telegram. But then since fb apps are closed source and heavily obfuscated, you can’t check for messenger nor whatsapp whether it actually does what it says.

    That was about trust in the available encryption and how the app handles your messages. So far I fail to see how fb messenger is better than telegram.

    But that’s not the only relevant aspect in privacy. It’s also important what else the app is doing, and whether there are alternative clients if you don’t trust the official one. This is the reason why I won’t ever accept facebook solutions being described as private options. I’d be surprised if any of facebook’s apps wouldn’t be doing everything in their power to collect every kind of information the OS provides to it, while the telegram client is not exactly fixated on harvesting everything.
    Telegram has much less tracking components in the app, but if even that amount bothers you, telegram foss from f-droid is absolutely clean. You’ll never get anywhere near with facebook services.

    And then also don’t forget that whatsapp somehow regularly has vulnerabilities that allow arbitrary code execution on your phone by an attacker. I don’t remember the last time there was such a problem with telegram, but probably is was many years ago, if it all.

    skullgiver, (edited )
    @skullgiver@popplesburger.hilciferous.nl avatar

    deleted_by_author

    •
    ReversalHatchery,

    but Signal occasionally stops publishing their source code for months at a time,

    I did not tell about Signal. Never made them a good example.
    I believe their tech is cryptographically sound, but they are doing things with their app and the service too that I don’t like, to put it that way. I want to switch from telegram, but signal is not an option to me as a primary messenger for several reasons.

    so what messengers are even left at that point.

    Simplex, Matrix, Telegram. Or there’s Molly too, but it inherits some of the problems of Signal.

    WhatsApp and Telegram are harvesting the exact same information (phone number, IP address, location, and shitty metrics like “how often did you click the new chat button this week”).

    Are you sure whatsapp does not collect anything more than that? And if so, why?

    Unlike Telegram, WhatsApp doesn’t put ads into their product.

    I haven’t seen any ads so far, and I don’t pay for telegram. Yes there are channels that I follow.

    I don’t know where this idea comes from that the WhatsApp client is somehow uploading a copy of your entire phone to Facebook,

    That is obviously not possible without root access, unless someone snoops in a rootkit for your system through a specially cradted whatsapp voice call.

    WhatsApp is better than Telegram and many other messengers because it’s using good encryption.

    Hopefully they are doing that for every message, and hopefully they refrain from analyzing screen content or typing stats for “a better advertisement experience”.
    And last but not least, hopefully they are not bundling such components that inspect the app memory contents, and neither do allow other processes to do that through them, unlike signal does. (Alternative source: drew devault’s take on the same problem (too, but it also covers more)). Oh wait, it does make use of google play services… what a pity

    Telegram releases plenty of vulnerable software but they don’t seem to get much media attention.

    I call bullshit. That article is about the telegram proxy server, which is not even official Telegram software, it is made by a dude in their free time.
    So far that is one zero software released by telegram, definitely nowhere near plenty.
    Are there that many known vulnerabilities in the clients too?
    Maybe you’re right and I just haven’t heard of them, but then please point to CVEs or something that demonstrates them. And don’t come with the issues of MtProto 1.0, that was ages ago and irrelevant today.

    Whatsapp is only more private compared to facebook’s other, less secure messenger.

    Did facebook employees just raid lemmy or what the fuck is happening in this post?

    skullgiver, (edited )
    @skullgiver@popplesburger.hilciferous.nl avatar

    deleted_by_author

    •
    ReversalHatchery,

    Why are you sure that they are?

    Because it’s being developed by facebook, the company that does not fail to use any chance to mine you for your data.

    In the same vein: how do you know Simplex, Matrix, and Telegram don’t do the same thing? Have you audited their entire source code?

    Those apps are open source. Yes, I have looked into them on occasions. Telegram’s mobile app has problems, which are fixed by telegram foss.
    The official Matrix app has opt-in tracking, but whatever.
    I’m also quite sure that if they would be doing something actually shady in the background, it would be known at least in the privacy community.

    I see your next argument being “open source is actually less secure”

    Every time I open the app I get told to buy Telegram Premium or whatever it’s called. Probably because I don’t get channels so I don’t see any ads.

    That has never happened to me.

    If they would do something like that, that’d become international news and basically kill their platform.

    I fail to see how. facebook does not care about fines, and whatsapp users don’t care about privacy.

    Firebase is how you get notifications to a phone without draining the battery in the process.

    UnifiedPush, if your service cares about privacy. By the way, the Matrix app supports it.

    About as many as for WhatsApp: 0

    Highly doubt that. Since whatsapp has got e2ee, every year (2017, 2018, 2019, 2020) whatsapp has serious vulnerabilities, not in the encryption, worse: allowing arbitrary code to be executed on your phone by technically any other whatsapp user.
    From the nature of these vulnerabilities it seems very suspicious, as it’s always the worst kind of security breach (RCE), and when one gets fixed, somehow there’s other of the same kind the next time researches look for it. Oh and these vulnerabilities are always in components that are hosted by binary code, which is harder to reverse engineer even without obfuscation.

    Yes, they link your account to your Facebook account

    You admit that, then why do you claim it to be a private messaging service?

    but if you care about privacy you don’t have a Facebook account

    That does not matter. The point is that facebook is looking in your data, including who you know, and how frequently do you talk to them, but also how often and when are you online. If they can’t your it into a facebook account, who cares? They just make you a shadow profile, like it has been their tradition for many years.
    But also, almost everyone had a facebook account at one point in time.

    Earlier you asked why would they track you? Here I ask why wouldn’t they use all the tracking code they have already developed for the other facebook apps?

    Telegram […] is better than Signal at the very least

    Sorry, where did I say that? Probably I was unclear. Encryption wise signal is absolutely better, but all things considered the transparency of the client software and it being clean of programming libraries doing shady things is more important to me. What good is good encryption if it can be nullified? It would be ok if they would be working on it, but instead of that, as drew devault said, they are going to war to justify including google services, and that attitude does not help to trust them more.
    And as I said, there are also other problems, including that you can’t log in on multiple devices is a deal breaker for me, and that I have had telegram for many years, but for the better part of it I’m determined to not register to any more services with a phone number.

    even Meta gives you the courtesy of encrypting your messages

    How the fucking hell? Through the just as obscure option in messenger as in telegram to have an e2ee chat?
    Oh, no, you mean whatsapp, which still can’t be verified if it does not do anything with the cleartext messages before encryption, or after decryption on the other side. I see that you don’t trust telegram, and I agree that they have problems, but trusting facebook’s maybe-privacy that they will handle your data correctly when you have no way to check it is not better either. Who cares about e2ee when each of the ends cannot be trusted either. It is just privacy theater.

    TheFool,
    @TheFool@infosec.pub avatar

    Easiest seems to me just enabling E2EE in telegram since it’s there. Asking to use secret chats seems easier than asking to switch plattforms

    ReversalHatchery,

    Except that the feature is only available on mobile

    ReversedCookie,

    Signal is your way to go, so was it for me.

    meiko60,
    @meiko60@lemmy.sdf.org avatar

    Signal does not support web app

    ReversedCookie,

    Which has it’s reasons, since Web apps are very insecure.

    Lemmchen, (edited )

    Why would that be?

    ReversedCookie,

    A quote from the Whonix Docs:

    "The following guide provides a higher security and privacy standard than relying upon online services such as ProtonMail or Tutanota, that promise “encrypted email” in transit or storage. Online systems can still be broken by an attacker capable of exploiting JavaScript flaws or undermining certificate authorities that provide encryption certificates for websites; see Webmail. Further, online providers can be hacked or coerced by adversaries to provide access for extended periods. " This is about Online Email Clients, but it also counts for Web Apps.

    skullgiver,
    @skullgiver@popplesburger.hilciferous.nl avatar

    deleted_by_author

    •
    ReversedCookie,

    No? Please inform yourself better, electron based applications aren’t the same like a web app in a chromium based browser with a bunch of extensions, but okay.

    danileonis, (edited )
    @danileonis@lemmy.ml avatar

    SimpleX Chat > Matrix > others

    Btw it’s very difficult to change something in the routine, many people have your same issue; where I live WhatsApp is a fucking authority…

    Melody,

    Hot take here; so PLEASE do not reply unless you’re the OP.

    Maybe you don’t have to switch. At least not immediately. Ultimately someone will make a stink out of switching. Again!

    MProto isn’t the best cryptography around; but it does provide some implementation of some low level privacy. I wouldn’t trust a credit card number to it; but it’s not worthless. It is however heavily disliked by people who understand cryptography and value privacy. But Your friends don’t care! That fact is irrelevant to them emotionally.

    And this is where the problem starts…Your friends have gotten accustomed and attached too much to Telegram and it’s many eye-candy features and smooth polish.

    This is where you need to “Sour The Milk” and wean them off Telegram.

    Perform your usual setup of a new group. Use Signal or Matrix (usually this will be though Element). Then Force anyone who decides to be stubborn on Telegram to use the “Secure Chat” feature on Telegram. At least then the stubborn holdouts won’t be causing you excessive privacy issues.

    Then lastly just transition to your new platform and pay exclusive attention to the new one and let people trickle in.

    MarcRnt,

    That’s a valuable Idea. If I force them to use the secret chats option, then they maybe notice that Telegram is worthless without all the flashy stuff and is not private at all. And it’s at least a step forward into the right direction.

    Shaul,

    I think the only choice is Signal for practical purposes. There is no creating accounts, no scanning ID’s, no invite link to chat. If they already know your number, there’s nothing they need for you to contct you on Signal.

    For people who I have their number, I will never ever acknowledge any other option than Signal because confused people don’t end up making any choice. Only if they talk about servers and networks, then I will teach them network security. I say SimpleX F-Droid is king of them all, but for random people, I only mention Signal/Molly.

    For the record, I will say that I am more willing to currently use Whatsapp than ever use Telegram. I can’t speak to the cool features with Telegram because I hate it too much to register my number with them.

    ReversalHatchery,

    I don’t understand how you trust facebook more than telegram. It’s the exact opposite for me

    Shaul,

    Watch this whole video yewtu.be/watch?v=rtRQKQkvUfE

    ReversalHatchery,

    Already know those points. facebook is not better.

    slacktoid,
    @slacktoid@lemmy.ml avatar

    I use matrix and setup matrix bridges to avoid this. If you are fine with a single user setup beeper should be easier. this way you use matrix yourself and your friends use whatever they want. (you can qemu an x86 android image, and pass a webcam, for whatsapp to work on the bridge)

    jabberati,
    @jabberati@social.anoxinon.de avatar

    deleted_by_author

    •
    slacktoid,
    @slacktoid@lemmy.ml avatar

    The E2EE between the bridge service would still be intact. you would need to setup end 2 end encryption between matrix and the bridges which is a non issue if you host them yourself.

    jabberati,
    @jabberati@social.anoxinon.de avatar

    deleted_by_author

    •
    slacktoid,
    @slacktoid@lemmy.ml avatar

    you can self host beeper now. and E2EB is there for most of the common bridges and growing, its just that it needs to be implemented and turned on, just like E2EE.

    dingus,
    @dingus@lemmy.ml avatar

    Actually, I don’t know why I had forgotten this already.

    Link: DEF CON 31 - The Internals of Veilid, a New Decentralized Application Framework - DilDog, Medus4

    Veilid. I watched this DEF CON presentation on it. I remember asking myself “How would this differ from Matrix and why do we need a competing standard?”

    But actually, after watching, I do realize that in certain ways it seems more elegant and decentralized than even Matrix. It’s really more focused for general application development, but that means chat can be developed on the framework.

    So maybe put this on your radar as well while it’s being developed. It certainly has jumped to my attention after watching this video.

    veilid.com

    zoontechnicon,

    Really interesting! Sadly in the past a lot of such frameworks went the way of the titanic :/

    DavidGarcia,

    as much as I want everyone to use something like Briar or Cwtch, Signal is the only viable alternative for normal people. Session maybe, but last time I tried it, it was buggy and it has a small userbase.

    possiblylinux127,

    Signal is good but you can look into simplex chat or session

    Lemmchen, (edited )

    Not ready for primetime. Like, absolutely not.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • privacy@lemmy.ml
  • tacticalgear
  • DreamBathrooms
  • cisconetworking
  • khanakhh
  • mdbf
  • magazineikmin
  • modclub
  • InstantRegret
  • rosin
  • Youngstown
  • slotface
  • Durango
  • kavyap
  • ngwrru68w68
  • JUstTest
  • everett
  • tester
  • cubers
  • normalnudes
  • thenastyranch
  • osvaldo12
  • GTA5RPClips
  • ethstaker
  • Leos
  • provamag3
  • anitta
  • megavids
  • lostlight
  • All magazines
    •