Will this make end-to-end encryption finally get the polish it needs?
I don't know much about Matrix or Riot.im (from what I remembered, it was a implemented IRC alternative), but if it delivers on all of the above (and the article sure sounds like it), then it's definitely polishing up some final features that were still missing!
The server is not, and the Android code is updated months after each update, all commits being squashed(see issue[1]). Also their new app (Telegram X) is not open source.
related commit: https://github.com/signalapp/Signal-Android/commit/166973132...
pretty difficult to find the raw apk though: https://signal.org/android/apk/
about matrix:
you will probably end up having to use the electron riot app for a while, but the community is working hard on native clients, but afaik no client has e2ee in any usable state implemented yet (but a lot of progress is being made).
I think the matrix.org team acts as a non-profit organisation, but most of the core team is also hired by New Vector where, I think the planned profit model is to run matrix instances as a service.
there's some stuff about the funding in the faq: https://matrix.org/docs/guides/faq.html#what-kind-of-company...
I tried it less than a year ago, because I had heard that too, but it still didn't work. I should try again on my new phone I guess.
Not true, it has a websockets alternative to gcm.
>and requires a phone number
The phone number can be anything you control.
>and turned-on phone iirc
Yes
>(and their profit model seems to be extorting companies like Wire and helping closed source software like Whatsapp advertise with Signal-level encryption).
It (now) has its own nonprofit backing it (and a generous benefactor). It's not trying to be profitable.
The "extortion" thing seems to have been about wire using signal code in breach of copyright (ie not complying with the open source license).
Signal has stated that the goal of working with WhatsApp (and others) is to make good crypto be used as widely as possible. Matrix crypto is also based on what's used in signal.
>Wire is the best of all, but the Android app drains battery and everything is web
Signal is very polished (at least on Android - I'm not familiar with the ios app).
TLDR: If you don't control the server, there is no security guarantee. So signal, whatsapp and telegram are out.
Edit: If DNSSEC is as secure as sms, then signal is as secure as sms.
Not message contents etc.
WhatsApp is the same but has things like key-change messages off by default.
I believe telegram doesn't even encrypt by default, and has flawed crypto anyway.
You're right that the whole thing is flawed to some degree unless both parties are clued up.
You can even send E2E-encrypted messages/files to people who haven't even joined yet!
And that's low hanging fruit.