Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
much thanks to @gary_host_laptop for the logo design :)
Why do people like Matrix? It's really slow. Even most of the non-Electron clients consume a ton of resources (even more than Electron apps usually do).
Especially Gomuks, by far the worst offender. It consumes nearly a gigabyte of memory and it's a TUI.
I think it more comes down to it not being Discord than people liking it.
Well, it's not privacy-focused.. but I do like Revolt for this purpose. It's performant, looks very similar to Discord, and I think they're adding E2EE eventually.
XMPP, for example, does not enable end-to-end encryption by default
Why always these false myths? The most popular XMPP mobile clients do enable it by default.
Right? It is a generic protocol for all sorts of communications, some of which don’t require encryption. Yet every modern chat client for human-to-human communication has OMEMO, OTR, & PGP encryption options.
It was a conscious decision for them not to enforce E2EE by default. https://web.archive.org/web/20211215132539/https://infosec-handbook.eu/articles/xmpp-aitm/
XMPP clients have like 10 different implementations because of that and are not always consistent with each other or even function universally across platforms.
But I'm not an author. That would be @[email protected].
The article you linked is a highly misleading nothing burger. And enforcing e2ee at protocol level is a bad idea for many reasons.
Another basic thing -- If your messenger is throwing your messages in a notification; it's being logged. Google was found to be logging almost all notification content. Make sure your message app isn't putting the content of messages into notifications.
If the app implements their own notification system and doesn't rely on GCM then Google isn't able to log them as far as I know.
Sure -- but how many of them actually do?
You can also just use a degoogled os which won't be logging your notification content. But in any case you shouldn't have notifications as notifications are exclusive with at-rest encryption (or I guess you could have at-rest encryption but just have the db constantly decrypted whenever your phone is on? Seems to defeat the point then)
Which DeGoogled OS do you know of that uses their own notification backend?
Presumably any degoogled OS would remove that kind of telemetry—it seems like quite an obvious oversight if they continue to send notification contents to Google's servers? If the suggestion is that it's through a backdoor, then that's the responsibility of the open source community to spot the backdoor in the AOSP.
Now this is why I read comments. You're absolutely right and I knew this info and just hadn't put the two together. Thank you. Settings changed.
Pretty good read
What I like about Matrix so much is that it can be run fully on your own infrastructure, even the TURN server for VOIP, and you can build the clients from source yourself too.
But I agree that it's quite difficult to use. And until now only my dad and my spouse use it with me because they love me and trust me. But they both always have problems with their clients. It randomly logs out and then they have to login with the password and with the encryption key again. For a long time calling didn't work because I misconfigured the server. Then videos were for the longest time uploaded in full size and anything longer than a few seconds would be rejected. The whole spaces thing is implemented very weirdly so it confuses them. And then the threads are even worse so we can't use them because nobody gets how to do it.
Signal ux is much better fyi, though I accept it's hard to roll your own. Trade offs are generally worth
As far as I know you can't host your own signal server which connects to their servers.
I'm using Signal with the rest of the family and most friends.
TLDR: Avoid Telegram and WhatsApp. Recommended messengers are Session, Signal, SimpleX and Threema. Honorable mention: Briar.
Honorable mention to Matrix as well
Session should probably be avoided as well, primarily because they've disabled things like perfect forward secrecy and a few other security measures that probably should not have been disabled.
That's mentioned in the article I believe. I was just trying to save some people a minute or two. :)