I forgot Grindr DMs, but you already know that ones gonna be red all the way down lmao

Pls share with friends if you find it useful, I dont accept donations or anything, and it'll never have ads or bullshit.

I'm working on adding more services, but each one takes about 4 hours to research and review.

Signal really is that better replacement for WhatsApp since the functionality is identical, others would have to force people to get used to the different ui and the options.

I've been using Matrix for years, but now only as a replacement for IRC. The encryption key handling has always been cumbersome and flakey, and too easily broken by users. Not compromised "broken", but locked out "broken." It's been like this for years, and while the UI has improved, it's still too hard for casual users to confidently use; I've given up hope that it'll ever get to a point where I can recommend it to friends who don't give a fuck how it works, and who aren't interested in spending a half hour figuring out how to set things up - they just want it to work. So many encrypted messaging systems have done this correctly, I dispair that Matrix can't (it's a common issue with all clients, so I blame the design of the protocol).

Edit oh, I also wanted to say I'd also been disillusioned with Matrix when I realized I couldn't run my own server. That is, I technically could; I just couldn't afford to. Synapse is a hot mess of a server, but it also just pounds on the CPU and requires massive amounts of disk space (over time). Matrix is designed such that all content for channels joined by any user is replicated to the user's home server. It's a questionable design decison, at best, but a consequence is that regardless of the server software, the storage requirements make running a home server cost prohibative. Compared to, say, running an xmpp server, which could be done effectively on a Pi.

Working on it, hard to do well without JavaScript while maintaining the ease of webpage generation

Lets be honest, its not much different from China. They both make social media companies censor, and they both track citizens to predict their likliness of committing a crime in the future.

Where's the lie?

They hate him, because he told the truth.

I have worked for Status in the past, but that has not impacted the review of any apps. The spreadsheet has been reviewed thoroughly by others in the privacy space before I published it, and I encourage everyone to take a look and report any inaccuracies.

The criteria is objective on purpose. Everything on the spreadsheet can be verified for accuracy.

Well, Trail of Bits did more than a year ago

simplex.chat/blog/20221108-simplex-chat-v4.2-security-audit-new-website.html

SimpleX may be one of the best, privacy-wise, but until they implement multi-device support with shared history, it's simply a non-starter. Not being able to access a conversation on both my phone and my computer puts a messaging app near the bottom of any usability list.

SimpleX is close to implementing it; the last time I checked, there was a way to link two devices, but it was exceedingly cumbersome - too difficult to ask a non-tech person to work through - and the history syncing didn't work. If they get that worked out, it'll be a strong contender; I only wish it'd been part of the original design and not a tack-on, as I expect it'll consequently be a major source of bugs for the project.

Yep. Really need to compare the best-practice XMPP clients (e.g. Conversations, Siskin), not half-developed clients more suited to the XMPP landscape of 20 years ago. -- Just as Matrix's ranking in the table is high because only the state-of-the-art clients are considered -- there are plenty of Matrix clients which don't support e2ee, for example.

This list of mistakes isn't exhaustive, but extending from poVoq's mentions, here are some things XMPP(conversations) does actually have positive findings for:

• End to end encrypted by default [OMEMO]
• End to end encryption is available [OMEMO]
• Voice/video calls are end to end encrypted ["calls are always end-to-end encrypted with DTLS-SRTP"]
• Utilizes Perfect Forward Secrecy [OMEMO]
• Data is encrypted in transit [TLS and OMEMO]
• You can verify contacts out of band [https://gultsch.de/trust.html]
• There has been a third party code audit [2016]
• Provider can scan for illegal content [If you send content unencrypted, otherwise no different to Matrix/Signal]

I'm not sure there's much differentiation between any apps when it comes to "What can the apps hand to police?"; if the police have physical access to your device and app, they have access to everything you do on that device/app.

Dino, Gajim turn on OMEMO by default & even the TUI Profanity prominently displays [unencrypted] in red at the top by default nudging you to pick OMEMO, OTR, or PGP for end-to-end encryption. The protocol is generic on purpose & meant to be extended with encryption which in the case of private chat applications, is now defacto. Much in the same way, TLS isn’t required since there are application that don’t require it, but defacto, all guides for setting up a XMPP server for chatting applications will suggest TLS where some servers have options like s2s TLS required or it won’t talk to the other server.

Seems weird that there’s a big, red no even when all the defaults point in the direction yes for human-to-human chat. Much in the same way some values are wrong like apps & servers being open source when there very much are proprietary XMPP servers out there like WhatsApp & Zoom. There’s also a reason Tails OS comes with Dino (or Pidgin) & every dark web guide explains how to connect to XMPP thru Tor + OMEMO/OTR, because it can be secure & anonymous enough for criminals & whistleblowers while being lightweight & decentralized.

Telegram was suddenly unblocked in Russia after getting a bunch of money from the Kremlin.

https://www.wired.com/story/the-kremlin-has-entered-the-chat/

The Moscow Times reported that the investments included $75 million from a joint partnership between an Abu Dhabi state fund and a Kremlin sovereign wealth fund.