What's a good alternative to Signal on Android for casual messaging? I don't think Element is a good fit since it's not easy to ask a friend or family member to sign up for Element whereas it's simple to install Signal.
Searching through your messages by type, really good video messaging, voice messaging, video chats, and the best stickers on any platform.
It doesn't do E2EE by default (you need to manually flip on Secret Chats) and group chats are not E2EE at all, both of which make it HN kryptonite because apparently E2EE everywhere, by default, is the only thing that matters even though there are technical trade-offs to an E2EE-everywhere model. I appreciate I can flip on Secret Chats when I need them but do wish it was an option in group chats.
I selfhost a Matrix homeserver: it's nowhere near ready for primetime and misses a lot of those thoughtful touches less technical people appreciate. If you do want to try to onboard people to Matrix with the Element client (and be very careful because you only get one, maybe two shots with your friends and family before they go back to whatever they were using before) use Mozilla's homeserver for its vastly better performance and option of SSO sign-on.
This is true. I've been on IRC since the mid 90's with ircII and BitchX and even I find Matrix/Element to be tedious to navigate.
There's exactly zero chance I will suggest it to anyone non-technical until they get their clients up to snuff with the competition.
Telegram and Discord are the two best IRC-replacements, both offer easy native bot support and tools to manage bigger group chats (100+ members).
For 1-on-1 it's all the same to me. Telegram is still the easiest, since I can have the same chat history on multiple devices easily.
No it doesn’t. It’s owned by the 2nd largest surveillance capitalist; it shares a back-end with Facebook (so at a whim they can use the metadata around your chats to update their advertising models of you and your contacts); IIRC it leaks your engagement to FB (via web link previews).
-End-to-end encrypted by default (WA yes, Telegram No)
-End-to-end encrypted group chats (WA yes, Telegram No)
-End-to-end encrypted group video calls (WA yes, Telegram No)
-End-to-end encrypted desktop chats (WA yes, Telegram No)
-Client-side encrypted cloud backups (WA yes, Telegram No)
-Cross-platform end-to-end encrypted chats (WA yes, Telegram No)
It's a bit hard to make a case for Telegram's good intentions when they lack the ability to actually deploy usable, ubiquitous end-to-end encryption. They could even pay people like Moxie to implement it for them, which begs the question, why haven't they. Durov absolutely has the money.
Yes WA and FB has access to your communications metadata, but so does Telegram. And every entity that hacks Telegram.
Pavel Durov isn't a magical entity of good will and intentions, he's a Russian guy with sure, decent eye towards good user experience, but the cost for that is too great, considering he's never hired a competent cryptographer to even see if the features the app provides could be implemented in a privacy preserving way. I'd love to be able to defend Telegram's design choices, but the more they spend their time adding "sleek animations" and other bs features, the clearer it becomes it's just another social media platform with same privacy features as Facebook Messenger:
-Not end-to-end encrypted by default (Telegram Yes, FBM yes)
-No end-to-end encrypted group chats (Telegram Yes, FBM yes)
-Opt-in 1:1 end-to-end encrypted chats on mobile (Telegram Yes, FBM yes)
In that comparison, WA comes at the top. But then again, it's a false dichotomy as Signal puts incremental privacy features with no real down-sides.
-Open source clients (Signal yes, WA no)
-Reproducible builds (Signal yes, WA no)
-User-managed groups (Signal yes, WA no)
(And no, Telegram being open source with reproducible builds isn't really worth anything until the verification confirms that it's really using proper E2EE. Currently Telegram's source only confirms that it's not E2EE by default etc.)
As for the surveillance capitalistic aspect, Telegram is only as good as their word. FB wasn't surveillance capitalistic when it started back in 2005. Telegram isn't slaughtering the piglet before it's time to cash in, but they can get hacked at any point, and the hundreds of billions of messages that sit on their server, effectively unencrypted (storing the database key in server's memory is the same as "not encrypted"), Telegram isn't private even if Durov never wanted to use that data. The fact is experts agree such data is a liability, a toxic asset, that nobody can protect forever. Durov isn't as security researcher patching zero-days faster than NSA, GCHQ, Fancy Bear, Unit8200, CCA et. al. find them. Most probably Durov wouldn't even realize a rootkit has been sneaking data out of his server for the past 8 years.
Compared to these risks, WA has been ahead of Telegram ever since they implemented Signal protocol in 2016.
I still think the WA privacy story is more suspect than Telegram’s at this point.
Paying lip service is not the same as practicing what you preach. I'm not saying Mark Zuckerberg is on your side. I'm saying WA team managed to implement Signal Protocol before Zuckerberg et. al. realized what was happening wrt. WA's data aggregation capabilities. Also, Durov isn't called the Mark Zuckerberg of Russia for nothing. Also, it's not like VKontakte users Durov made his fortune with, had too much privacy. Why is Telegram suddenly a magical fountain of privacy when on tech level it's worse than WhatsApp?
"the user has no control over the keys"
Extraordinary claims require extraordinary proof.
"everything goes via their servers"
Kind of the central point of centralized messengers?
Also, with Telegram there is a guarantee 100% of group chats, and 100% of Win/Linux desktop chats go through the server in the form that allows the server to spy on the content. All Telegram clients also leaks the metadata that you specifically enabled E2EE with some person, i.e. you disclose your desire to hide data from all third parties. That type of metadata is extremely valuable, and something WA -- due to ubiquitous E2EE -- is unable to collect.
"I still think the WA privacy story is more suspect than Telegram’s at this point."
Your opinion doesn't override that of Matthew Green, or Bruce Schneier who have explicitly advised to NOT use Telegram. I have never seen a security expert recommend Telegram, and don't expect you to provide evidence on the contrary, either.
I didn't say it was. I said the Telegram _story_ was _better_ than WA's at this point.
> when on tech level it's worse than WhatsApp?
I'm not arguing that Telegram has a better or worse technical model; I'm arguing that the WA business model and senior leadership and share structure, which controls its tech, creates a _story_ which is less trustworthy.
I take your points about WA appearing technically better.
What I don't want is a corporation behind my chat app whose business is in monetizing my data. If Durov can keep Telegram out of that business I will be pleased.
E2EE is the bare minimum for security these days, as so carefully explained by the message you're replying to.
"If someone were to come to me and offer me E2EE by default without those features I would say no thank you."
This is such a loaded and unthoughtful comment. It assumes you have to make a choice. You don't, at least per technical reasoning. The only situation where you can't have E2EE is massive groups, and it's obvious those have no expectation of privacy. Anything else, I can explain to you on a technical level why it can be done in a privacy preserving way, and the only reason its not, is because Telegram's team lacks the know-how. Signal has already shown they can pull off pretty much any feature in a privacy preserving way.
So the question is not "what features do I need", but "should all my features be actual features". A feature that doesn't protect your privacy by definition can be used to spy on you, and I'm sure we both agree that is not a feature.
So ask yourself
Group chat with end-to-end encryption (Signal) or Group chat without end-to-end encryption (Telegram).
Which one do you choose? The answer is obvious.
>What I don't want is a corporation behind my chat app
Also, you should know Telegram is not a non-profit like Signal. Telegram is a limited liability _company_. It's a for-profit entity, and the LLC only means, the owners are "legally responsible for its debts only to the extent of the amount of capital they invested".
When Signal provides these features, please feel free to ping me back here but until then, the proof is in the pudding and the Signal pudding doesn't taste like the Telegram pudding.
As Signal's client is open source and its server is whenever they feel like it, I'm sure they'd also value your contribution to prove out your point.
>"Actual multi-session clients across devices."
Not available with E2EE
>"No Electron."
Sure, because you need all 32GB of RAM but not your human right to privacy. Also, this is an argument against Signal's client, not excuse why you can't have E2EE on non-electron native client.
>"Truck loads of features and thoughtful touches everywhere."
So, eye candy. Not very strong argument.
>"Searching through your messages"
Only exact messages. Gets incredibly slow once you go past few weeks. Client-side searchers are as fast as your phone, i.e., fast.
>"video chats"
Not E2EE for groups
>"best stickers"
1:1 match between my Signal and Telegram sticker packs (50+ packs)
>"even though there are technical trade-offs to an E2EE-everywhere model"
The problem with this BS claim, is you can't point to a single trade-off. Everything you mentioned can be done with E2EE.
>"but do wish it was an option in group chats."
So the question is, why aren't you demanding it?
>"When Signal provides these features, please feel free to ping me back here but until then"
Again, which features? Please provide an actual, exact list so we know when to ping you.
>"the proof is in the pudding and the Signal pudding doesn't taste like the Telegram pudding."
The problem when you add a ton of sugar into a pot of porridge made from shit, is now you have a ton of sugar with an even coating of shit in it. No matter how much eye candy you glue on top of insecure design and spaghetti code that is Telegram, the fundamental truth is, it was never empowering you, only its owners who are collecting as much data about you as FB does, if not more.
EDIT: Fixed lack of E2EE on video calls to mean group video calls. Apologies if this looks like moving the goal post, not my intention.
>>"video chats"
> Not E2EE
...isn't true. Please see https://core.telegram.org/api/end-to-end/video-calls
It's not my intention to be aggressive towards you or anyone else. It's the argument (or lack of arguments) I'm attacking, not the person.
Facebook Messenger, Hangouts, Google Chat, and above all SMS / iMessage. Whatsapp by all accounts is the most popular (as much as I personally detest it).
I know I know, not HN-fare exactly, but they're easy, popular, and work. That's all that most of our's social network actually cares about. There's a lot of discussion in this thread about detailed encryption/security policy, but while I am a privacy nut, none of my non-IT friends/family could possibly care less... And they're not wrong. This convoluted encryption which severely limits multi device usability Andb frequently has louse ui is out of proportion with other comms methods such as email also used. While I may stand up for principles of privacy, my family isn't wrong asking why should their exchange of recipes or birthdays wishes be any harder than necessary.
Given you’re calling out WhatsApp specifically as a service you detest I’m going to assume you rank it last of all these options. Why is this? WhatsApp is E2EE, has a simple UI (at least IMO) and doesn’t store messages centrally. If I claimed to be a privacy nut I’d put WA above any of these.
for what little it's worth: Facebook Messenger, Hangouts, Google Chat, let alone messengers of yore like ICQ, MSN, AIM, etc all allow me to create a userID & password on computer and use them from any device of my choosing, as well as change/transfer/obsolete devices seamlessly.
Whatsapp is bound to my phone number and device, and its experience with multi-device is.... actively hostile. My preference is to not type messages on a 1.5" keyboard, but rather on any number of ergonomic keyboards and devices I use around the house and work. Whatsapp is simply prohibitive for my usage, and for positively no actual (as opposed to theoretical/principled) benefit whatsoever. I've pulled what little hair I have trying to use it, but the 27th time it locked my account for using too many devices (Oh noes! I have a phone, tablet AND a laptop? Crazy me:), I gave up.
(privacy wise, also, my phone number is one of the more private and static pieces of identifying information I own; I guard it carefully and I have no idea why I need to expose it to everybody I want to communicate with, as opposed to anonymous and disposable userID or even email).
I did not mean to turn this into anti-whatsapp rant though; Many other E2EE-focus services are similar. Whatsapp just happens to be wildly popular and, for my use-case, completely and actively impractical :-/
Shiny stickers and broader user market vs privacy.
Almost constant uptime due to being owned by a multi million/billion dollar company vs a group that mainly runs on donations.
Etc etc
I really hope it's the former, instead of the latter.
Whatsapp is a non starter for me because the company that owns and operates it is not trust worthy. Very profitable, and probably making some of the people here great returns on their investments...but it's not trust worthy, nor ethical.
Beyond that, there are free XMPP servers, and you can even run you own. Clients like Conversations, blabber.im are all wonderful. I've been using it with friends and my wife for years without issues, albeit I have my own server.
There is also a Jitsi app available for mobile devices, but it is optional.
But.
In a thread about a Signal outage with a request for an alternative "casual messaging" app - I really don't think open source video video meetings is a relevant answer...
Perhaps Telegram but I recall reading some commentary on their crypto that made me hesitant.
Conversations is a good XMPP messenger, and it supports crypto extensions, OMEMO, etc.
WhatsApp is arguably more secure than many of the alternatives. Just look at the repo for Signal. For privacy it probably isn't, when you're in the US, that is.
But WA has been working on interesting proof of concepts for wider deployment such as the client-side encrypted backups. Those are actually fantastic when properly implemented. There's of course shitty aspects with WA about those like the 64-bit passwords, but, if that's a feature Signal thanks to possible collaboration can properly deploy later, I'm all for it.
There's a difference between Signal being categorically better for pretty much everything when compared to WA, but, WA isn't the worst option, even when considering its owned by FB.
The one part I see people struggle with is transferring keys across devices which is slightly convoluted (your keys are not stored on the matrix home server--for obvious reasons) but there are wizards to help you install your keys to a new device and for most use cases with phones completely unnecessary since you will always be using the same device.
-No end-to-end encryption for groups (on any platform)
-No end-to-end encrypted desktop chats (Win/Linux)
-No cross-platform end-to-end encrypted chats (iOS)
-No end-to-end encrypted group (video) calls
Great, for Durov if he wants your data, and all entities hacking their server for your data. Not that great for you.
They also meddled with Russian elections this year, blocking opposition bots, but allowing govt bots.
Telegram is not E2E encrypted by default, so the other comment makes sense.
I'm not sure of a good alternative as simple as Signal
If my message is over two weeks old, I'd prefer it not to be on anyone's server. I can keep a local backup if I wish to do so.
It doesn't have to be this way, as WA's planned feature of client-side encrypted cloud backups[1] shows, disproving Durov's implied claim that Telegram must have access to messages to provide such feature.
[1] https://engineering.fb.com/2021/09/10/security/whatsapp-e2ee...
And Win/Linux desktop chats are groups are not E2EE even if you want, so it's not just about it not being default, it's about the complete lack of E2EE for those.
"but this makes the distributed app model sooo much more user friendly."
It does not. It forces you to either drop E2EE, or whip out your phone hundreds of times a day.
"All your history is instantly available on the web client for example."
Which is a privacy nightmare, web-based crypto is never safe, not even when it supports E2EE. https://tonyarcieri.com/whats-wrong-with-webcrypto
"Try that with Signal."
You obviously can't because a) it's a security risk as per above and b) you don't need to as you can have native Signal client on your phone and your laptop and your desktop. Try having just one E2EE chat with Telegram across all three devices. You can't, even if you want to.
"The web client works if your phone is out of battery. Try that with WhatsApp."
Yeah, WA's system is shit, but at least they're working on a native desktop client (that also works on tablets), and that too, will feature E2EE for everything. Can't say that for Telegram.