mrbiber

This is not about some general vague problem with "extremism" of which supposedly all sides are guilty. This is about the emergence of a right-wing terrorist movement which has already committed several attacks. When your first reaction to this is to to bring in some unspecified crimes of the left, then this calls into question whether you understand the seriousness of the situation. There is a real chance that real, actual fascists kill many more people and perhaps even gain more political power. We can talk about this without engaging in some false equivalence.

Riot.im uses the OLM encryption library (that is also used by XMPP OMEMO, see the OMEMO XEP). The OLM protocol is (I gather) very similar to the Signal protocol.

Riot is based on Matrix which is a decentralized protocol (you're not tied to one company), and it doesn't need your phone number.

Riot.im is almost there, together with e2e crypto, foss stack, server federation and bridges to slack, irc etc.

Matrix.org/riot.im has working federation, end-to-end cryptography, works without Google Play and is completely open source.

The encryption is audited, but not yet enabled by default, as there are still some rough edges. But the apps have tremendously improved over the last few weeks alone and I am very happy with it.

I'm surprised to see that matrix.org / riot.im is not mentioned as an alternative to Signal. They have a federated, open protocol, usable open-source apps for web/Android/iOS, registration without a phone number (even email is optional), do not require Google Play, and support double-ratchet encryption (in beta, it's not activated by default yet, but it will be activated by default in private rooms in the future).

If you are interested in federation, riot.im [1] / matrix.org seems to have comparable security properties to Signal, allows federation of servers and does not require your phone number or Google Play.

[1] https://riot.im

At the moment, Signal and Wire seem to be the best options. They have open-source clients, end-to-end encryption, are easy enough to use that even less-computer savy people can be realistically convinced to use them and they seem to offer decent protection for metadata (not technical, but policy-wise).

There are, however, some upcoming developments which will change the situation in the next couple of months:

1) The main matrix.org client, Riot (https://riot.im) has end-to-end encryption now in beta. This will offer Signal-strength encryption, but in a decentralized, e-mail-like system with federated servers. This will create an ecosystem where people are no longer dependent on the goodwill (and solvency) of a single entity to use a good, encrypted messaging app.

2) Briar (https://briarproject.org) is a new (Android-only) app, designed for people with an especially high need for privacy. It works without central servers (through Tor hidden services, but hides the complexity of that), even works when the internet is down (e.g. when mobile networks are shut down during a protest) via Bluetooth and direct Wi-Fi connections, and it offers extra features, like a panic button that deletes all your data. It's in beta at the moment, with a planned release early next year.

TL;DR: Use Signal or Wire for now, but be ready to switch to a better system when available.

I totally agree. My hope is that because Matrix has an open protocol, there will be more competition in the client space which will lead (eventually) to good UX.

riot.im [1] (which is based on matrix.org) seems a good, decentralized, open messaging app. They have relatively nice mobile apps and they promise to soon release end-to-end encryption based on the OLM [2] ratchet which is similar to the Signal encryption. In contrast to Tox, Matrix relies on federated servers. Tox is pure P2P which, in my experience, never works very well on mobile devices.

[1] https://riot.im/ [2] https://matrix.org/docs/spec/olm.html

As far as I know, the identity is just a public key. You can add contacts only by either scanning a qr-code disayed on your contact's phone in person or by being introduced to each other by a mutual contact, so there is no real need for discovery. As there are no servers at all (not even federated), this also means that no one can even enumerate users.

Torsten Grote, one of the projects main developers, explains the technology behind it in this very nice presentation: https://m.youtube.com/watch?v=Dr42vZIoGqM

I am very hopeful that Briar (https://briarproject.org/) will achieve this. They don't use any centralized infrastructure, the app works even when the net is down, and they have e completely distributed and thus uncensorable forums and blogs.

Metadata-free chat exists already on the desktop with Ricochet (https://ricochet.im) and it will soon exist on mobile with Briar (https://briarproject.org). Both work through Tor hidden services - Briar also allows to exchange messages over Bluetooth and direct wifi.

I took part in the Whiteout crowdfunding and I think that their client was very promising, especially as there is still no Free Software client for Android that supports PGP/MIME properly.

I also had the impression that it was just a lack of PR and good community management that is part of the reason for why Whiteout never achieved traction although it seemed technically superior compared to Lavaboom and other (at the time) more popular projects. They never seemed to have much of a presence in terms of discussions about PGP-enabled clients and could just have done more in terms of outreach. I am sad to see them go.

In principle, this should work - I haven't tried it, but in Conversations, the fingerprints of my other connected devices show up and I can say that they belong to me.

In any case, there are no desktop clients yet that support OMEMO. Conversations and Jitsi support Message Carbons though (together with a compatible XMPP service, such as yax.im) very well. On the console, there is profanity that also supports it.

I'd be very excited to see more Free Software instant messaging applications support OMEMO (http://conversations.im/omemo/). It's basically TextSecure's Axolotl protocol with a few slight modifications. As such, it support multi-party OTR-like PFS and multiple devices. In contrast to TextSecure, Conversations (the first client to implement it) allows you to use it without having to install Google Play Services and makes it usable on a decentralized infrastructure (XMPP). If it became standard for Open Source messaging clients (whatever transport they use) to have Omemo built in and use it opportunistically, we might actually have a chance to provide usable crypto to the masses.

I'm not affiliated with the project, but from what I gather from the description, the reason is that they want to have completely open hardware.