So I’m in a somewhat unfortunate situation. My circle of friends doesn’t want to switch to another messenger and we are currently stuck on the worst possible platform for security: Telegram.

The problem is that it is very hard to convince anyone to switch, if they are all perfectly fine and like Telegram. I mean I can get why they like it: The UX and UI of Telegram are amazing and there are well functioning clients available for any platform. It has more features and gimmicks than any other messenger I know BUT it lacks one mayor thing: E2EE. And that’s mostly what I care about. The second problem is that I was the person who recommended the switch to Telegram right after WhatsApp was bought by Facebook. I know, that was a bad recommendation, but back then I didn’t know shit about privacy or why E2EE mattered. I was just like “Hey, it’s not by Facebook, so it must be better”. And now everyone I know is there and won’t leave.

If - in the hypothetical situation of me setting an ultimatum and deleting my Telegram after that - I wanted to make them switch somewhere else: What messenger would that be? Currently I’m mostly thinking Signal. I know it’s not perfect either, it is centralized, and the servers are in the US, but it has a bigger user base already than most of its competitors like Threema or Matrix/Element and it is very easy to set up and use. I’m already a user of Signal, Threema, Matrix, WhatsApp and Telegram (every platform for some contacts, but most of them on Telegram sadly), so having yet another option is not a problem for me, as well as getting rid of one is also no problem. I’d love to delete both Telegram and WhatsApp in this move.

So, in conclusion, what I need is a messenger that has all or most of the following:

  • best possible security (E2EE is minimum)
  • easy to use (no complicated setup, simple UI)
  • already has some users (not too niche)
  • cross-platform and multi-device (should run on Android, iOS and Windows/Web)
  • some flashy dumb features like stickers and so on to keep them entertained

My choice would be Signal. But I am unsure if that is the best choice or if I should just wait a bit and see what all of the new EU laws about messengers and gatekeepers bring to the game and if anything chances with that.

  •  ReversalHatchery   ( @ReversalHatchery@beehaw.org ) 
    1•10 months ago

    Why are you sure that they are?

    Because it’s being developed by facebook, the company that does not fail to use any chance to mine you for your data.

    In the same vein: how do you know Simplex, Matrix, and Telegram don’t do the same thing? Have you audited their entire source code?

    Those apps are open source. Yes, I have looked into them on occasions. Telegram’s mobile app has problems, which are fixed by telegram foss.
    The official Matrix app has opt-in tracking, but whatever.
    I’m also quite sure that if they would be doing something actually shady in the background, it would be known at least in the privacy community.

    I see your next argument being “open source is actually less secure”

    Every time I open the app I get told to buy Telegram Premium or whatever it’s called. Probably because I don’t get channels so I don’t see any ads.

    That has never happened to me.

    If they would do something like that, that’d become international news and basically kill their platform.

    I fail to see how. facebook does not care about fines, and whatsapp users don’t care about privacy.

    Firebase is how you get notifications to a phone without draining the battery in the process.

    UnifiedPush, if your service cares about privacy. By the way, the Matrix app supports it.

    About as many as for WhatsApp: 0

    Highly doubt that. Since whatsapp has got e2ee, every year (2017, 2018, 2019, 2020) whatsapp has serious vulnerabilities, not in the encryption, worse: allowing arbitrary code to be executed on your phone by technically any other whatsapp user.
    From the nature of these vulnerabilities it seems very suspicious, as it’s always the worst kind of security breach (RCE), and when one gets fixed, somehow there’s other of the same kind the next time researches look for it. Oh and these vulnerabilities are always in components that are hosted by binary code, which is harder to reverse engineer even without obfuscation.

    Yes, they link your account to your Facebook account

    You admit that, then why do you claim it to be a private messaging service?

    but if you care about privacy you don’t have a Facebook account

    That does not matter. The point is that facebook is looking in your data, including who you know, and how frequently do you talk to them, but also how often and when are you online. If they can’t your it into a facebook account, who cares? They just make you a shadow profile, like it has been their tradition for many years.
    But also, almost everyone had a facebook account at one point in time.

    Earlier you asked why would they track you? Here I ask why wouldn’t they use all the tracking code they have already developed for the other facebook apps?

    Telegram […] is better than Signal at the very least

    Sorry, where did I say that? Probably I was unclear. Encryption wise signal is absolutely better, but all things considered the transparency of the client software and it being clean of programming libraries doing shady things is more important to me. What good is good encryption if it can be nullified? It would be ok if they would be working on it, but instead of that, as drew devault said, they are going to war to justify including google services, and that attitude does not help to trust them more.
    And as I said, there are also other problems, including that you can’t log in on multiple devices is a deal breaker for me, and that I have had telegram for many years, but for the better part of it I’m determined to not register to any more services with a phone number.

    even Meta gives you the courtesy of encrypting your messages

    How the fucking hell? Through the just as obscure option in messenger as in telegram to have an e2ee chat?
    Oh, no, you mean whatsapp, which still can’t be verified if it does not do anything with the cleartext messages before encryption, or after decryption on the other side. I see that you don’t trust telegram, and I agree that they have problems, but trusting facebook’s maybe-privacy that they will handle your data correctly when you have no way to check it is not better either. Who cares about e2ee when each of the ends cannot be trusted either. It is just privacy theater.