Threema Goes Open Source | Hacker News Reader

Threema Goes Open Source

threema.ch

141 pointsturrini46 comments

This is really big news. I use Threema because it is the only messenger out there that is:

a) always end to end encrypted (unlike Telegram)

b) supports account creation without any phone number (unlike Signal)

c) supports phones without google messaging service (unlike Signal, it formally supports it as well but in reality it's just a big battery drain)

It not being open source was always a bit sad for me, because most of the other apps on my phone are open source.

I'm curious about the multi device sync. I hope that it will be implemented in a way that doesn't use passwords but pair syncing. This is bad from a usability perspective (firefox abandoned it because of usability), but the only way I'm aware of how syncing can be made secure.

Out of curiosity what does Threema do that Element[1] (née Riot.im) doesn't? It seems to tick those boxes, but admittedly is still in quite active development and may not be as polished.

[1]https://element.io/

It did these things years before Riot did for starters. It does less, but well-polished IMHO.

Right you are. I like to think that I'm fairly knowledgeable in this space, but Threema totally passed me by. Maybe it's more popular in german speaking communities (or I'm just more than I thought)?

Threema is a pay-to-play client on the App stores ($3 USD on Google Play, €4 on the Apple store), inhibiting it's adoption when the playing field is full of free clients. The inability to try-before-buy (regardless of technical merit) turns away casual users who might give it a shot "just because", myself included. (Theory: the world has been burnt a thousand times over by shitty ad-infested mobile apps and no longer trusts buying before trying. I sure don't.)

And of course, the world has been burned by shitty ad-infested apps because nobody wants to pay for apps... (not that I necessarily disagree with you - I only got Threema because of a trustworthy recommendation)

nod I have had others tell me Threema is good, but it's a "walled garden" until now; Signal has won over hearts and minds by being FOSS and having no cost-based barrier to entry even for casual users. As a FOSS advocate I went with Whisper from the start and recommend Signal to everyone (with a fairly high take rate, non tech worker friends and neighbors) with a simple text link to install and saying something like "it's free and encrypted so nobody can see us talk." (KISS explanation)

(this is a US-centric comment, as phone numbers are rather static here; unlike other countries, not having a number isn't really how it works for most people on the big 4 carriers and their secondary MVNOs)

The world has also been burned by paying for apps that turn out to be actually shitty and-or ad-infested.

48hour refunds on google play should have addressed this conundrum but it seems people just aren't aware of it :(

You can get a refund if you go to the play store and use the refund mechanism within a timeframe.

Technically true and only easy if done within the first 2 hours, after that it's cumbersome (requires a desktop browser to go into order history). I will posit that it takes longer than 48 hours to decide if you want to continue using a chat/messaging app - the dynamics require multiple live humans to interact on their timescales, it's not just playing a game or whatnot on your own.

Yeah, my German-speaking + privacy-minded friends usually have it. I would estimate I can reach about 30% of my German contacts on Threema (if they have any IM at all).

But there's not a single non-German contact on there.

I kinda forced a friend of mine into using element/riot. He mostly complained about the lack of "polish" (which I also feel, and I'm a rather "frugal" user). He proposed Threema as an alternative, so I guess that the polish is quite the missing box.

The box I'm missing in Threema (unless I'm wrong of course) is the "not centralized" one. If for some reason (and admittedly, there aren't many realistic ones), Threema's servers/organisation are corrupted, the whole networks falls, right?

Matrix is more of a chat protocol than a messaging app. I signed up once and had to agree to rules of behaviour and stuff like that. Threema is also more likely to be present on other people's phones.

It's more a question of "what does does Element do that Threema doesn't"?

Element is a Matrix client, so you connect to the global open Matrix decentralised network, rather than just closed-source servers run by a (newly-sold) company like Threema. Typical Matrix implementations are entirely Apache licensed open source, so you get full control and visibility both clientside and serverside. Matrix also already provides synchronised multi-device conversations, as well as more advanced cross-signing verification for E2EE key validation than Threema. Finally, Matrix is an open standard protocol maintained by the non-profit Matrix.org Foundation, that anyone can contribute to via the open governance process (https://matrix.org/foundation, https://matrix.org/docs/spec/proposals etc) - the Matrix standard gives developers full freedom to write their own clients/servers/bots/bridges/whatever.

Personally I'd say that Element & Threema have similar levels of UX polish these days (but I'm biased, working on Element). It's perhaps true that Threema's relatively limited featureset means that polish is easier to achieve.

Element is significantly worse. Threema feels polished and actually works, meanwhile Element's UX is so obviously designed by security engineers that it's incomprehensible and useless.

There are still major, glaring and game-breaking bugs and UX quirks in Element even after a full frontend rewrite (that, by the way, made security UX significantly worse).

Are they opening up their servers as well? If I can not self host it may be as well as closed.

It looks like they're open sourcing the apps only.

IDK for a messaging app it's not that important to me, because the main value it provides is that service itself to which my network is connected.

Also, the hardest part of such apps is the client component, not the server component. If need arises it shouldn't be hard to build one compatible to the clients.

If the client app is open source and the messaging is end-to-end encrypted, I would say it's a lot better than being completely closed. The encryption, which you should now be able to verify, means you don't have to trust the server with your message data.

Though, sure, it would be better for the server software to be open source and rehostable too.

> I use Threema because it is the only messenger out there that is:

> a) always end to end encrypted (unlike Telegram)

> b) supports account creation without any phone number (unlike Signal)

Wire (wire.com) has had these for a long time with multi-device sync and also being open source.

From what I saw, it doesn't meet c) though?

https://github.com/wireapp/wire-android/issues/1903

Looks like it does. On Android it has entry in menu "Maintaint connection to server" which creates persistent notification. Notifications worked on my un-googled phone.

I've had never problems with any battery drain with Signal on phone without gapps

much more annoying it's unreliable message delivery especially when your switch frequently between wifi and Mobile data, there are some other issues, but they killed it for me with PIN code nag

I don't know yet, in the announcement they didn't qualify what open source means for them. Will the complete client be open source? Will only parts of the client be open source? what about the server? which license will be used? We'll have to wait and see if this is useful or just marketing for the company.

> Within the next months, the Threema apps will become fully open source, supporting reproducible builds.

Probably one that only allows creating builds for reproducibility. Which is perfectly fine in my opinion, as they are supported by app sales instead of donations like Signal.

"...and an acceleration of the product development thanks to the entry of the German-Swiss investment company Afinum Management AG." Can anyone explain what Afinum is/does? They're just a place that buys parts of any type of thing?

"We invest in small- and medium-sized companies. Because we are one of them." That just left me wondering if anyone has heard of them?

https://afinum.de/en/portfolios/

Unfortunately, Northdata doesn't provide much information, either (Posting the German version since the English one provides even less info):

https://www.northdata.de/Afinum+Management+AG,+Z%C3%BCrich/C...

https://www.northdata.de/Afinum+Management+GmbH,+M%C3%BCnche...

I'm German, and mildly interested in investing. Never heard of them, but I have heard of three of the companies (Ledlenser, Görtz, SIGG) in their portfolio. I would call all those three companies solid high-quality manufacturers. So I'm slightly optimistic.

Now that's an interesting change. More investment is always a bit worrysome due to "and what's the plan to make money", but Threema IMHO is nice to use and being open would be good for trust and thus maybe also adoption.

Well, they already have a working money making scheme. Going opensource doesn't change that.

Threema has 3 sources of income AFAIK. A per install fee for regular users, a special client for enterprise users and the same for schools.

Not a money-printing machine but pretty sure a steady income.

I very much hope that it works, and will continue to work!

If I remember correctly they also sell API access, e.g. for bots or service accounts, but that probably is not a big thing given the comparatively small current user base.

To put it into numbers: they have approximately 8 million accounts [0]. A license costs 4€ now, but it used to be cheaper (2€), so using the older number and subtracting fees and taxes, gives us 11 million € of revenue in the past half decade. That's not a giant number, but enough to support development of an app like this.

[0]: https://de.statista.com/statistik/daten/studie/445619/umfrag...

Plus, the enterprise version is a subscription.

> A per install fee for regular users

It was hard enough to get my friends to use signal and that was free. While I really do like Threema, The fact that it cost money on iOS makes it hard for me to push on my friend group.

Same here it's sad but I don't know a single person who would pay (and oh boy donate) for such an app. They are completely unaware/blind that developers need to eat too.

It's not even about the price: 50ct would be too much. In fact 99% of all my friends/family circle never payed for any app.

It's so weird. If you go to a bar with your friends you pay more for a single beer, and people spend so much time on these apps.

The problem is not with the cost.

If if it was the lowest possible amount on the Play store, people wouldn't buy it. It's the idea of paying for apps that is not so widely adopted.

I haven't even setup a payment method in the play store.

I haven't either. I don't even have the play store. I've bought it through their website with paypal.

I have similar minded friends. They have no issue dropping a bunch of money on some cosmetics in a game or random garbage that gets thrown away immediately.

So i ended up just buying a bunch of licenses for threema and giving them away. I know that isn’t an option for everyone but it was how i was able to convert my friends over.

It isn’t a big issue for me to do that. Even with buying 10 licenses, it is a small enough amount that its easy to budget for. Plus, i like to support companies and developers who (at least to me) seem to care.

What bothers me is that on iOS you can‘t buy licenses for others unless you have a credit card on file. I prefer using iTunes prepaid cards.

They might want to play down the "Swiss == secure" angle, e.g. from the About Precision, reliability, and discretion are typical Swiss characteristics, and as a true Swiss company, Threema lives these values every day.

https://en.wikipedia.org/wiki/Crypto_AG

Personally I am happy with Riot.im/Element Matrix. Is there some feature which distinguishes Threema from it?

Could someone with experience of Threema comment on the quality of its voice and video calls, especially for group calls of up to a dozen or so participants?

Threema currently only supports one-to-one calls (both voice and video). Quality is great if your network connection is good and if both participants are in an unmetered network.

Slightly off-topic, but interesting. Threema contributed back to web-rtc with security improvements they made for video calls.

https://webrtc-review.googlesource.com/c/src/+/177980

No group calls, but one to one calls have constant bit rate encoding which is considered to be more secure. Quality is amazing on good networks and not worse than others like WA or Wire on bad ones.

Significantly better quality than WhatsApp for example (one-to-one calls, recordings).

Reply on news.ycombinator.com