Mithat Konar (the wiki)

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Messaging Candidates ======

This is a summary of candidates for a cross-platform, user friendly text messaging platform for general use instead of Facebook Messenger, Google Hangouts/GTalk, etc. Mobile-friendly solutions have some precedence as mobile texting seems to be the dominant use case at the moment.

===== Requirements =====

The starting point in candidate selection is the now obsolete [[https://www.eff.org/secure-messaging-scorecard|EFF's Secure Messaging Scorecard]] (as of 14 July 2015). From that list, only entries that have at most one red mark are considered.

In addition, the ideal candidate will:
  * Be federated with an open source server.
  * Have open source clients.
  * Have clients for all major platforms:
    * iOS, Android, Windows, MacOS, Linux
  * Be easy to install and set up.
  * Provide something better than a miserable user experience once set up.
  * Offer privacy and security protections by default.
  * Feel like it's not going to abandoned.
  * Not require a phone number create an account.
  * Not require your phone number to be divulged to everyone with whom you communicate.

===== The candidates =====
The notes below shouldn't be considered complete; they just highlight known negatives.

==== ChatSecure + Orbot ====
  * //Have clients for all major platforms.// No clients for desktop platforms.
  * //Be easy to install and set up.// Setting up an XMPP account isn't tragic, but it's not as streamlined as a single-source (i.e., non-federated) system. The big fail here though is that public XMPP servers tend to be fickle. OTR is baked in, so that's good.

==== CryptoCat ====
  * //Have clients for all major platforms.// Android client is still betaware. No native Windows or Linux apps.
  * //Feel like it's not going to abandoned.// Development is advancing at a slow pace.
Also, the Facebook integration needs to be investigated to see whether there's a potential security compromise.

==== Jitsi + Ostel ====
  * //Have clients for all major platforms.// Jitsi isn't available for mobile platforms (although an Android app is in the works). Other Ostel-compatible apps exist for mobile, but Ostel supports calls only--no text.

==== Mailvelope ====
OpenPGP encryption for webmail. Not really what we are after.

==== XMPP clients with Off-The-Record Messaging (Pidgin, Adium, etc.) ====

  * //Be easy to install and set up.// Setting up an XMPP account isn't tragic, but it's not as streamlined as a single-source (non-federated) system. The big fails here though are that public XMPP servers tend to be fickle and configuring+engaging OTR messaging is an additional and cumbersome step.

==== RetroShare ====
  * //Have clients for all major platforms.// No mobile clients.
  * //Feel like it's not going to abandoned.// It's unclear how many developers are involved and what the commitment is.

==== Signal / RedPhone ====
Open Whisper Systems' partnership with WhatsApp/Facebook renders any security and privacy provisions suspect. Whatever lives within WhatsApp/Facebook is effectively governed by WhatsApp/Facebook privacy and security. In the absence of additional information, this renders this option ineligible for further consideration.

==== Silent Phone ====
  * //Have clients for all major platforms.// iOS and Android only.
Also, SilentCircle seem to have deprecated their standalone clients in deference to their turnkey payware systems.

==== Silent Text ====
  * //Have clients for all major platforms.// Android only.
Also, SilentCircle seem to have deprecated their standalone clients in deference to their turnkey payware systems.

==== Subrosa ====
In-browser tool. Not really what we are after.

==== Telegram Messenger ====
[[https://telegram.org/|link]]
  * //Be federated with an open source server.// The server is currently closed source. Federated open source services appear to be planned. From the [[https://telegram.org/faq#q-how-are-secret-chats-different|FAQ]]:

> Q: Why not open source everything?
> 
> All code will be released eventually. We started with the most useful parts -- a well-documented API that allows developers to build new Telegram apps, and open source clients that can be verified by security specialists.

  * //Offer privacy and security protections by default.// For the highest security (i.e., full marks from EFF), secret chats can be used. See the [[https://telegram.org/faq#q-how-secure-is-telegram|FAQ]]. also, the [[https://telegram.org/privacy|privacy policy]] is encouraging. Questions have also been raised regarding the solidity of its encryption((See[[http://gizmodo.com/why-you-should-stop-using-telegram-right-now-1782557415|Why You Should Stop Using Telegram Right Now]], [[http://fortune.com/2016/08/02/telegram-hackers-iran/|Iranian Hackers Just Cracked This Super Secure Instant Messaging Service]], and [[https://www.theverge.com/2017/1/11/14237136/trump-leak-telegram-security-cracked-russia-encryption|Trump leak raises new questions about Telegram security]].))
  * //Not require a phone number to create an account.// The only way to open a Telegram account is by using an SMS-enabled phone number.
  * //Not require your phone number to be divulged to everyone with whom you communicate.// The path of least resistance for using Telegram is to use your phone number as your identifier; however username identification is possible. See [[Telegram|Telegram use notes]] for more info. 

Additional vetting of the founders' financial and other interests is required before a firm recommendation can be made. However the founders seem not to be invested with [[http://vk.com/|VKontakte]] any longer, and the operation is based in Berlin.
==== TextSecure ====

Open Whisper Systems' partnership with WhatsApp/Facebook renders any security and privacy provisions suspect. Whatever lives within WhatsApp/Facebook is effectively governed by WhatsApp/Facebook privacy and security. In the absence of additional information, this renders this option ineligible for further consideration.

==== Tox ====
Relative newcomer [[https://tox.chat/index.html|Tox]] doesn't appear on the EFF's list. A more complete evaluation is pending, but initially this looks like a winner.

===== Recommendation =====

Tox needs a more complete evaluation, but on the surface it is encouraging. Telegram comes close to a recommendation, but the questions surrounding its encryption, its use of your phone number as the primary source for identification, and its clunky use of usernames makes an enthusiastic recommendation difficult.