Cleanup 2.0 instant messenger page #1836
|
|
@ -1,4 +1,7 @@
|
|||
<h1 id="im" class="anchor"><a href="#im"><i class="fas fa-link anchor-icon"></i></a> Encrypted Instant Messengers</h1>
|
||||
<h1 id="im" class="anchor">
|
||||
<a href="#im"><i class="fas fa-link anchor-icon"></i></a>
|
||||
Encrypted Instant Messengers
|
||||
</h1>
|
||||
|
||||
<div class="alert alert-warning" role="alert">
|
||||
<strong>If you are currently using an Instant Messenger like Telegram, LINE, Viber, <a href="https://www.eff.org/deeplinks/2016/10/where-whatsapp-went-wrong-effs-four-biggest-security-concerns">WhatsApp</a>, or plain SMS, you should pick an alternative here.</strong></div>
|
||||
|
|
@ -9,42 +12,28 @@
|
|||
|
||||
<p>We have described the three main types of messaging programs that exist: Centralized, Federated and Peer-to-Peer (P2P), with the advantages and disadvantages of each.</p>
|
||||
|
||||
<h2 id="centralized" class="anchor"><a href="#centralized"><i class="fas fa-link anchor-icon"></i></a> Centralized</h2>
|
||||
<h2 id="centralized" class="anchor">
|
||||
<a href="#centralized"><i class="fas fa-link anchor-icon"></i></a>
|
||||
Centralized
|
||||
</h2>
|
||||
|
||||
<p>Centralized messengers are those where every participant is on the same server or network of servers controlled by the same organization.</p>
|
||||
|
||||
<h3>Advantages</h3>
|
||||
<ul>
|
||||
<li>New features and changes can be implemented more quickly.</li>
|
||||
<li>Easier to get started with and to find contacts.</li>
|
||||
</ul>
|
||||
|
||||
<h3>Disadvantages</h3>
|
||||
<ul>
|
||||
<li>Centralized services could be more susceptible to <a href="#exploiting-centralized-networks">legislation requiring backdoor access</a>.</li>
|
||||
<li>Can include <a href="https://drewdevault.com/2018/08/08/Signal.html">restricted control or access</a>. This can include things like:</li>
|
||||
<ul>
|
||||
<li>Being <a href="https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165">forbidden from connecting third-party clients</a> to the centralized network that might provide for greater customization or better user experience. Often defined in Terms and Conditions of usage.</li>
|
||||
<li>Poor or no documentation for third-party developers.</li>
|
||||
</ul>
|
||||
<li>The <a href="https://blog.privacytools.io/delisting-wire">ownership</a>, privacy policy, and operations of the service can change easily when a single entity controls it, potentially compromising the service later on.</li>
|
||||
</ul>
|
||||
|
||||
{%
|
||||
include cardv2.html
|
||||
title="Signal"
|
||||
image="/assets/img/svg/3rd-party/signal.svg"
|
||||
description='Signal is a mobile app developed by Signal Messenger LLC. The app provides instant messaging, as well as voice and video calling. All communications are E2EE unless you choose to send as SMS. Its protocol has also been <a href="https://eprint.iacr.org/2016/1013.pdf">indepedently audited (PDF)</a>'
|
||||
labels="warning:<a>Requires phone number</a>:Signal requires your phone number as an personal identifier which means anyone you communicate with will see it.|success:VoIP"
|
||||
website="https://signal.org/"
|
||||
forum="https://forum.privacytools.io/t/discussion-signal/664"
|
||||
github="https://github.com/signalapp"
|
||||
windows="https://signal.org/download/"
|
||||
mac="https://signal.org/download/"
|
||||
linux="https://signal.org/download/"
|
||||
googleplay="https://play.google.com/store/apps/details?id=org.thoughtcrime.securesms"
|
||||
android="https://signal.org/android/apk/#apk-danger"
|
||||
ios="https://apps.apple.com/app/signal-private-messenger/id874139669"
|
||||
include cardv2.html
|
||||
title="Signal"
|
||||
image="/assets/img/svg/3rd-party/signal.svg"
|
||||
description='Signal is a mobile app developed by Signal Messenger LLC. The app provides instant messaging, as well as voice and video calling. All communications are E2EE unless you choose to send as SMS. Its protocol has also been <a href="https://eprint.iacr.org/2016/1013.pdf">indepedently audited (PDF)</a>'
|
||||
labels="warning:<a>Requires phone number</a>:Signal requires your phone number as an personal identifier which means anyone you communicate with will see it.|success:VoIP"
|
||||
website="https://signal.org/"
|
||||
forum="https://forum.privacytools.io/t/discussion-signal/664"
|
||||
github="https://github.com/signalapp"
|
||||
windows="https://signal.org/download/"
|
||||
mac="https://signal.org/download/"
|
||||
linux="https://signal.org/download/"
|
||||
googleplay="https://play.google.com/store/apps/details?id=org.thoughtcrime.securesms"
|
||||
android="https://signal.org/android/apk/#apk-danger"
|
||||
ios="https://apps.apple.com/app/signal-private-messenger/id874139669"
|
||||
%}
|
||||
|
||||
{%
|
||||
|
|
@ -67,37 +56,45 @@
|
|||
chrome="https://chrome.google.com/webstore/detail/keybase-for-reddit/ognfafcpbkogffpmmdglhbjboeojlefj"
|
||||
%}
|
||||
|
||||
<div>
|
||||
<h2 id="federated" class="anchor"><a href="#federated"><i class="fas fa-link anchor-icon"></i></a> Federated</h2>
|
||||
|
||||
<p>Federated messengers use multiple, independent servers that are able to talk to each other (email is one example of a federated service). Federation allows system administrators to control their own server and still be a part of the larger communications network.</p>
|
||||
|
||||
<div class="container">
|
||||
<div class="row">
|
||||
<div class="col-md-6">
|
||||
<h3>Advantages</h3>
|
||||
<ul>
|
||||
<li>Allows for greater control over your own data when running your own server.</li>
|
||||
<li>Allows you to choose who to trust your data with by choosing between multiple "public" servers.</li>
|
||||
<li>Often allows for third party clients which can provide a more native, customized, or accessible experience.</li>
|
||||
<li>Generally a less juicy target for governments wanting <a href="#exploiting-centralized-networks">backdoor access to everything</a> as the trust is decentralized. The server may be hosted independently from the organization developing the software.</li>
|
||||
<li>Server software can be verified that it matches public source code, assuming you have access to the server or you trust the person who does (e.g., a family member)</li>
|
||||
<li>Third-party developers can contribute code and add new features, instead of waiting for a private development team to do so.</li>
|
||||
<li>New features and changes can be implemented more quickly.</li>
|
||||
<li>Easier to get started with and to find contacts.</li>
|
||||
</ul>
|
||||
|
||||
</div>
|
||||
<div class="col-md-6">
|
||||
<h3>Disadvantages</h3>
|
||||
<ul>
|
||||
<li>Adding new features is more complex, because these features need to be standardized and tested to ensure they work with all servers on the network.</li>
|
||||
<li>Some metadata may be available (e.g., information like "who is talking to whom," but not actual message content if E2EE is used).</li>
|
||||
<li>Federated servers generally require trusting your server's administrator. They may be a hobbyist or otherwise not a "security professional," and may not serve standard documents like a privacy policy or terms of service detailing how your data is utilized.</li>
|
||||
<li>Server administrators sometimes choose to block other servers, which are a source of unmoderated abuse or break general rules of accepted behavior. This will hinder your ability to communicate with users on those servers.</li>
|
||||
<li>Centralized services could be more susceptible to <a href="#exploiting-centralized-networks">legislation requiring backdoor access</a>.</li>
|
||||
<li>Can include <a href="https://drewdevault.com/2018/08/08/Signal.html">restricted control or access</a>. This can include things like:</li>
|
||||
<ul>
|
||||
<li>Being <a href="https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165">forbidden from connecting third-party clients</a> to the centralized network that might provide for greater customization or better user experience. Often defined in Terms and Conditions of usage.</li>
|
||||
<li>Poor or no documentation for third-party developers.</li>
|
||||
</ul>
|
||||
<li>The <a href="https://blog.privacytools.io/delisting-wire">ownership</a>, privacy policy, and operations of the service can change easily when a single entity controls it, potentially compromising the service later on.</li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div>
|
||||
<h2 id="federated" class="anchor">
|
||||
<a href="#federated"><i class="fas fa-link anchor-icon"></i></a>
|
||||
Federated
|
||||
</h2>
|
||||
|
||||
<p>Federated messengers use multiple, independent servers that are able to talk to each other (email is one example of a federated service). Federation allows system administrators to control their own server and still be a part of the larger communications network.</p>
|
||||
|
||||
{%
|
||||
include cardv2.html
|
||||
title="Matrix"
|
||||
image="/assets/img/svg/3rd-party/matrix.svg"
|
||||
image-dark="/assets/img/svg/3rd-party/matrix-dark.svg"
|
||||
description='<a href="https://matrix.org/docs/guides/introduction">Matrix</a> is an open-source project that publishes the <a href="https://matrix.org/docs/spec">Matrix open standard</a> for secure, decentralized, real-time communication.<br />
|
||||
<a href="https://en.wikipedia.org/wiki/Riot.im">Riot.im</a> is the popular reference client produced by the Matrix.org team. It offers optional E2EE for 1:1 and group conversations that <strong>must</strong> be turned on by the user. (This can be done by clicking on the toggle switch which is accessed by clicking the room name or user name of the chat → Security & Privacy → Encrypted). In the future it will be <a href="https://github.com/vector-im/riot-web/issues/6779">on by default.</a>'
|
||||
title="Riot"
|
||||
image="/assets/img/svg/3rd-party/riotim.svg"
|
||||
description='<a href="//about.riot.im">Riot.im</a> is the reference client for the <a href="//matrix.org/docs/guides/introduction">Matrix</a> network. The <a href="//matrix.org/docs/spec">Matrix open standard</a> is an open-source standard for secure, decentralized, real-time communication.<br />'
|
||||
labels="warning:<a href=//github.com/vector-im/riot-web/issues/6779>Warning</a>:Riot offers optional E2EE for 1:1 and group conversations that must be turned on by the user.
|
||||
(This can be done by clicking on the toggle switch which is accessed by clicking the room name or user name of the chat → Security & Privacy → Encrypted).|success:VoIP"
|
||||
website="https://about.riot.im/"
|
||||
forum="https://forum.privacytools.io/t/discussion-riot-im/665/"
|
||||
github="https://github.com/vector-im/riot-web/"
|
||||
|
|
@ -110,43 +107,45 @@
|
|||
web="https://riot.im/app/"
|
||||
%}
|
||||
|
||||
<div>
|
||||
<h4>Worth Mentioning</h4>
|
||||
|
||||
<ul>
|
||||
<li>Other <a href="https://matrix.org/clients">Matrix</a> clients, that may however be less feature complete than Riot.im.</li>
|
||||
<li><a href="https://xmpp.org/about">XMPP</a> (Extensible Messaging and Presence Protocol) is an open-source communications protocol that began development in 1999. Since then, XMPP has been extended by the publishing of XEPs (XMPP Extension Protocols). <a href="https://conversations.im/omemo/">OMEMO</a> is the most popular XEP (XMPP extension) for E2EE. Clients are developed by the community and not by the XSF (XMPP Standards Foundation). <span class="badge badge-warning" data-toggle="tooltip" title="VoIP and file transfers/names may not be end-to-end encrypted.">Inconsistent E2EE</span></li>
|
||||
<ul>
|
||||
<li><a href="https://gajim.org/">Gajim</a></li>
|
||||
<li><a href="https://conversations.im">Conversations</a></li>
|
||||
<li><a href="https://siskin.im/">Siskin</a></li>
|
||||
<li>Other <a href="https://omemo.top">OMEMO</a> capable clients for XMPP.</li>
|
||||
</ul>
|
||||
<li><a href="https://www.kontalk.org">Kontalk</a> is a community-driven instant messaging network based on XMPP.</li>
|
||||
</ul>
|
||||
|
||||
<h2 id="peer-to-peer" class="anchor"><a href="#peer-to-peer"><i class="fas fa-link anchor-icon"></i></a> Peer to Peer (P2P)</h2>
|
||||
|
||||
<p>Peer-to-Peer instant messengers connect directly to each other without requiring third-party servers. Clients (peers) usually find each other through the use of a <a href="https://en.wikipedia.org/wiki/Distributed_computing">distributed computing</a> network. Examples of this include <a href="https://en.wikipedia.org/wiki/Distributed_hash_table">DHT (distributed hash table)</a> (used with technologies like <a href="https://en.wikipedia.org/wiki/BitTorrent_(protocol)">torrents</a> and <a href="https://en.wikipedia.org/wiki/InterPlanetary_File_System">IPFS</a>, for example), or <a href="https://en.wikipedia.org/wiki/Ethereum">Ethereum</a>'s <a href="https://github.com/ethereum/wiki/wiki/Whisper">Whisper</a> protocol (used with some newer DApps). Another approach is proximity based networks, where a connection is established over WiFi or Bluetooth (for example, Briar or the <a href="https://www.scuttlebutt.nz">Scuttlebutt</a> social networking protocol). Once a peer has found a route to its contact via any of these methods, a direct connection between them is made.</p>
|
||||
|
||||
|
||||
<h3>Advantages</h3>
|
||||
<ul>
|
||||
<li>Minimal information is exposed to third parties.</li>
|
||||
<li>Modern P2P platforms implement end-to-end encryption by default. There are no servers that could potentially intercept and decrypt your transmissions, unlike centralized and federated models.</li>
|
||||
</ul>
|
||||
|
||||
<h3>Disadvantages</h3>
|
||||
<ul>
|
||||
<li>Reduced feature set:</li>
|
||||
<ul>
|
||||
<li>Messages can only be sent when both peers are online, however, your client may store messages locally to wait for the contact to return online.</li>
|
||||
<li>Generally increases battery usage on mobile devices, because the client must stay connected to the distributed network to learn about who is online.</li>
|
||||
</ul>
|
||||
<li>Your <a href="https://en.wikipedia.org/wiki/IP_address">IP address</a> and that of the contacts you're communicating with may be visible if you do not use the software in conjunction with a <a href="/software/networks">self contained network</a>, such as <a href="https://www.torproject.org">Tor</a> or <a href="https://geti2p.net/">I2P</a>. Many countries have some form of mass surveillance and/or metadata retention.</li>
|
||||
</ul>
|
||||
<div class="container">
|
||||
<div class="row">
|
||||
<div class="col-md-6">
|
||||
<h3>Advantages</h3>
|
||||
<ul>
|
||||
<li>Allows for greater control over your own data when running your own server.</li>
|
||||
<li>Allows you to choose who to trust your data with by choosing between multiple "public" servers.</li>
|
||||
<li>Often allows for third party clients which can provide a more native, customized, or accessible experience.</li>
|
||||
<li>Generally a less juicy target for governments wanting <a href="#exploiting-centralized-networks">backdoor access to everything</a> as the trust is decentralized. The server may be hosted independently from the organization developing the software.</li>
|
||||
<li>Server software can be verified that it matches public source code, assuming you have access to the server or you trust the person who does (e.g., a family member)</li>
|
||||
|
|
||||
<li>Third-party developers can contribute code and add new features, instead of waiting for a private development team to do so.</li>
|
||||
</ul>
|
||||
</div>
|
||||
<div class="col-md-6">
|
||||
<h3>Disadvantages</h3>
|
||||
<ul>
|
||||
<li>Adding new features is more complex, because these features need to be standardized and tested to ensure they work with all servers on the network.</li>
|
||||
<li>Some metadata may be available (e.g., information like "who is talking to whom," but not actual message content if E2EE is used).</li>
|
||||
<li>Federated servers generally require trusting your server's administrator. They may be a hobbyist or otherwise not a "security professional," and may not serve standard documents like a privacy policy or terms of service detailing how your data is utilized.</li>
|
||||
<li>Server administrators sometimes choose to block other servers, which are a source of unmoderated abuse or break general rules of accepted behavior. This will hinder your ability to communicate with users on those servers.</li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div>
|
||||
<h4>Worth Mentioning</h4>
|
||||
|
||||
<ul>
|
||||
<li><a href="https://status.im">Status.im</a> - Encrypted instant messenger with an integrated <a href="https://en.wikipedia.org/wiki/Ethereum">Ethereum</a> wallet (cryptocurrency) that also includes support for <a href="https://our.status.im/tag/dapps">DApps (decentralized apps)</a> (web apps in a curated store). Uses the <a href="https://our.status.im/status-launches-private-peer-to-peer-messaging-protocol/">Waku protocol (a fork of Whisper)</a> for P2P communication. Only available for iOS and Android.</li>
|
||||
</ul>
|
||||
|
||||
<h2 id="peer-to-peer" class="anchor">
|
||||
<a href="#peer-to-peer"><i class="fas fa-link anchor-icon"></i></a>
|
||||
Peer to Peer (P2P)
|
||||
</h2>
|
||||
|
||||
<p>Peer-to-Peer instant messengers connect directly to each other without requiring third-party servers. Clients (peers) usually find each other through the use of a <a href="https://en.wikipedia.org/wiki/Distributed_computing">distributed computing</a> network. Examples of this include <a href="https://en.wikipedia.org/wiki/Distributed_hash_table">DHT (distributed hash table)</a> (used with technologies like <a href="https://en.wikipedia.org/wiki/BitTorrent_(protocol)">torrents</a> and <a href="https://en.wikipedia.org/wiki/InterPlanetary_File_System">IPFS</a>, for example). Another approach is proximity based networks, where a connection is established over WiFi or Bluetooth (for example, Briar or the <a href="https://www.scuttlebutt.nz">Scuttlebutt</a> social networking protocol). Once a peer has found a route to its contact via any of these methods, a direct connection between them is made.</p>
|
||||
|
||||
{%
|
||||
include cardv2.html
|
||||
title="Briar"
|
||||
|
|
@ -176,30 +175,25 @@
|
|||
ios="https://itunes.apple.com/app/ring-a-gnu-package/id1306951055?mt=8"
|
||||
%}
|
||||
|
||||
{%
|
||||
include cardv2.html
|
||||
title="Tox"
|
||||
image="/assets/img/svg/3rd-party/tox.svg"
|
||||
image-dark="/assets/img/svg/3rd-party/tox-dark.svg"
|
||||
description='Encrypted instant messaging and video calling software. Uses its <a href="https://toktok.ltd/spec.html"> own encryption protocol</a> that has not yet been officially audited by cryptographers.'
|
||||
labels="warning:<a href=//tox.chat/download.html#warning>Experimental</a>:Encryption has not been audited by professional cryptographers|success:VoIP"
|
||||
website="https://tox.chat"
|
||||
forum="https://forum.privacytools.io/t/discussion-tox/2115"
|
||||
windows="https://tox.chat/download.html#oses"
|
||||
mac="https://tox.chat/download.html#oses"
|
||||
linux="https://tox.chat/download.html#oses"
|
||||
freebsd="https://tox.chat/download.html#oses"
|
||||
openbsd="http://openports.se/search.php?so=tox"
|
||||
netbsd="http://pkgsrc.se/search.php?so=tox"
|
||||
fdroid="https://tox.chat/download.html#oses"
|
||||
googleplay="https://tox.chat/download.html#oses"
|
||||
ios="https://tox.chat/download.html#oses"
|
||||
%}
|
||||
|
||||
<h4>Worth Mentioning</h4>
|
||||
|
||||
<ul>
|
||||
<li><a href="https://status.im">Status.im</a> - Encrypted instant messenger with an integrated <a href="https://en.wikipedia.org/wiki/Ethereum">Ethereum</a> wallet (cryptocurrency) that also includes support for <a href="https://our.status.im/tag/dapps">DApps (decentralized apps)</a> (web apps in a curated store). Uses the <a href="https://blog.enuma.io/update/2018/08/08/decentralized-application-messaging-with-whisper.html">Whisper protocol</a> for P2P communication. <span class="badge badge-warning">Experimental</span></li>
|
||||
<li><a href="https://retroshare.cc">Retroshare</a> - Encrypted instant messaging and voice/video call client. RetroShare supports both <a href="https://www.torproject.org/">Tor</a> and <a href="https://geti2p.net">I2P</a>.</li>
|
||||
<li><a href="https://bitmessage.org">Bitmessage</a> is a decentralized, encrypted, peer-to-peer, trustless communications protocol that can be used by one person to send encrypted messages to another person, or to multiple subscribers.</li>
|
||||
</ul>
|
||||
<div class="container">
|
||||
<div class="row">
|
||||
The reason I left retroshare was because it appears to have continuous development. They haven't had a release in a while. To be honest it looks more like a collaboration platform. It could very well be removed from this particular page. Maybe this would be better moved to another section in another PR? The reason I left retroshare was because it [appears to have continuous development](https://github.com/RetroShare/RetroShare/commits/master). They haven't had a [release in a while](https://github.com/RetroShare/RetroShare/releases).
To be honest it looks more like a collaboration platform. It could very well be removed from this particular page. Maybe this would be better moved to another section in another PR?
Retroshare is still listed as a self-contained-networks.html#L65 as it is appropriately a self contained network of its own, instant-messaging seems like it always a secondary functionality. Retroshare is still listed as a [self-contained-networks.html#L65](https://github.com/privacytoolsIO/privacytools.io/blob/master/_includes/sections/self-contained-networks.html#L65) as it is appropriately a self contained network of its own, instant-messaging seems like it always a secondary functionality.
|
||||
<div class="col-md-6">
|
||||
<h3>Advantages</h3>
|
||||
<ul>
|
||||
<li>Minimal information is exposed to third parties.</li>
|
||||
<li>Modern P2P platforms implement end-to-end encryption by default. There are no servers that could potentially intercept and decrypt your transmissions, unlike centralized and federated models.</li>
|
||||
</ul>
|
||||
</div>
|
||||
<div class="col-md-6">
|
||||
<h3>Disadvantages</h3>
|
||||
<ul>
|
||||
<li>Reduced feature set:</li>
|
||||
<ul>
|
||||
<li>Messages can only be sent when both peers are online, however, your client may store messages locally to wait for the contact to return online.</li>
|
||||
<li>Generally increases battery usage on mobile devices, because the client must stay connected to the distributed network to learn about who is online.</li>
|
||||
</ul>
|
||||
<li>Your <a href="https://en.wikipedia.org/wiki/IP_address">IP address</a> and that of the contacts you're communicating with may be visible if you do not use the software in conjunction with a <a href="/software/networks">self contained network</a>, such as <a href="https://www.torproject.org">Tor</a> or <a href="https://geti2p.net/">I2P</a>. Many countries have some form of mass surveillance and/or metadata retention.</li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
|
|
|||
|
|
@ -1,16 +1,20 @@
|
|||
<h1 id="teamchat" class="anchor"><a href="#teamchat"><i class="fas fa-link anchor-icon"></i></a> Team Chat Platforms</h1>
|
||||
<h1 id="teamchat" class="anchor">
|
||||
<a href="#teamchat">
|
||||
<i class="fas fa-link anchor-icon"></i>
|
||||
</a> Team Chat Platforms
|
||||
</h1>
|
||||
|
||||
<div class="alert alert-warning" role="alert">
|
||||
<strong>If your project or organization currently uses a platform like <a href="https://tosdr.org/#discord">Discord</a> or <a href="https://drewdevault.com/2015/11/01/Please-stop-using-slack.html">Slack</a> you should pick an alternative here.</strong>
|
||||
<strong>If your project or organization currently uses a platform like <a href="https://tosdr.org/#discord">Discord</a> or <a href="https://drewdevault.com/2015/11/01/Please-stop-using-slack.html">Slack</a> you should pick an alternative here.</strong>
|
||||
</div>
|
||||
|
||||
{%
|
||||
include cardv2.html
|
||||
title="Matrix"
|
||||
image="/assets/img/svg/3rd-party/matrix.svg"
|
||||
image-dark="/assets/img/svg/3rd-party/matrix-dark.svg"
|
||||
description='<a href="https://matrix.org/docs/guides/introduction">Matrix</a> is an open-source project that publishes the <a href="https://matrix.org/docs/spec">Matrix open standard</a> for secure, decentralized, real-time communication.<br />
|
||||
<a href="https://en.wikipedia.org/wiki/Riot.im">Riot.im</a> is the popular reference client produced by the Matrix.org team. It offers optional E2EE for 1:1 and group conversations that <strong>must</strong> be turned on by the user. (This can be done by clicking on the toggle switch which is accessed by clicking the room name or user name of the chat → Security & Privacy → Encrypted). In the future it will be <a href="https://github.com/vector-im/riot-web/issues/6779">on by default.</a>'
|
||||
title="Riot"
|
||||
image="/assets/img/svg/3rd-party/riotim.svg"
|
||||
description='<a href="//about.riot.im">Riot.im</a> is the reference client for the <a href="//matrix.org/docs/guides/introduction">Matrix</a> network. The <a href="//matrix.org/docs/spec">Matrix open standard</a> is an open-source standard for secure, decentralized, real-time communication.<br />'
|
||||
labels="warning:<a href=//github.com/vector-im/riot-web/issues/6779>Warning</a>:Riot offers optional E2EE for 1:1 and group conversations that must be turned on by the user.
|
||||
(This can be done by clicking on the toggle switch which is accessed by clicking the room name or user name of the chat → Security & Privacy → Encrypted).|success:VoIP"
|
||||
website="https://about.riot.im/"
|
||||
forum="https://forum.privacytools.io/t/discussion-riot-im/665/"
|
||||
github="https://github.com/vector-im/riot-web/"
|
||||
|
|
@ -28,7 +32,7 @@
|
|||
title="Rocket.chat"
|
||||
image="/assets/img/svg/3rd-party/rocketchat.svg"
|
||||
description="Rocket.chat is an self-hostable open source platform for team communication. It has optional federation and experimental E2EE."
|
||||
labels="warning:<a href=//rocket.chat/docs/user-guides/end-to-end-encryption/>Experimental E2EE</a>:Regarding E2EE their documentation states 'This feature is currently in alpha. It's also not yet supported on mobile'. There is no forward secrecy so compromised decryption password would leak all messages. Federation was also added afterwards, potentially causing room for mistakes."
|
||||
labels="warning:<a href=//rocket.chat/docs/user-guides/end-to-end-encryption/>Experimental E2EE</a>:Regarding E2EE their documentation states 'This feature is currently in alpha. It's also not yet supported on mobile'. There is no forward secrecy so compromised decryption password would leak all messages. Federation was also added afterwards, potentially causing room for mistakes.|success:VoIP"
|
||||
website="https://rocket.chat/"
|
||||
forum="https://forum.privacytools.io/t/discussion-rocket-chat/1223"
|
||||
github="https://github.com/rocketchat/"
|
||||
|
|
|
|||
|
|
@ -1,2 +0,0 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<svg width="128" height="128" version="1.1" viewBox="0 0 33.866 33.866" xmlns="http://www.w3.org/2000/svg"><g transform="matrix(.043931 0 0 .043931 -.034709 -1.092)"><path d="m55.393 532.82 286.97-491.31c96.403-72.992 403.62 137.03 376.36 224.4l-264.75 505.47c59.224-106.03-313.56-331.49-398.58-238.56z" fill="#e6e6e6" fill-rule="evenodd" stroke="#241c1c" stroke-width="3"/><g stroke="#000"><path d="m395.55 28.063-283.02 480.54" fill="#808080" stroke-opacity=".1195" stroke-width="1.6468px"/><path d="m193.27 521.67 273.63-478.51" fill="none" stroke-opacity=".069182" stroke-width="1.6578px"/><path d="m283.67 559.55 266.09-481.82" fill="#b3b3b3" stroke-opacity=".075472" stroke-width="1.6507px"/><path d="m442.34 696.99 259.36-486.94" fill="none" stroke-opacity=".21384" stroke-width="1.6507px"/></g><g fill-rule="evenodd"><path d="m393.67 26.59c-19.648 0.192-36.822 4.5488-50.18 14.061l-287.65 491.55c12.787-13.406 31.767-19.932 54.652-20.971l285.37-484.63c-0.73275-0.0042-1.4673-0.013-2.1934-0.0059z" fill="#e6e6e6"/><path d="m395.86 26.596-285.37 484.63c23.701-1.076 51.577 3.7251 81.08 12.856l276.08-483.72c-25.631-8.6186-50.148-13.645-71.791-13.77z" fill="#ececec"/><path d="m467.65 40.363-276.08 483.72c29.573 9.1522 60.771 22.657 91.027 38.934l267.15-485.29c-27.233-15.378-55.27-28.34-82.098-37.361z" fill="#e6e6e6"/><path d="m549.75 77.723-267.16 485.3c47.653 25.635 92.959 58.148 125.85 91.445l262.54-485.38c-31.608-32.535-75.256-65.399-121.24-91.365z" fill="#e6e6e6"/><path d="m670.99 169.09-262.55 485.38c13.999 14.171 25.744 28.479 34.471 42.457l260.31-488.34c-8.2409-12.768-19.229-26.1-32.238-39.49z" fill="#ccc"/><path d="m703.23 208.58-260.31 488.34c14.528 23.271 20.674 45.62 14.856 64.869l260.85-496.58c4.4659-15.775-1.7012-35.425-15.393-56.637z" fill="#b3b3b3"/></g><ellipse transform="matrix(.85943 .51126 -.48882 .87238 0 0)" cx="541.96" cy="429.54" rx="232.96" ry="92.651" stroke-width="1.651"/></g></svg>
|
||||
|
Before Width: | Height: | Size: 1.9 KiB |
|
|
@ -1,2 +0,0 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<svg width="128" height="128" version="1.1" viewBox="0 0 33.866 33.866" xmlns="http://www.w3.org/2000/svg"><g transform="matrix(.31143 0 0 .31143 2.9966 4.9564e-5)" fill="#fff"><path d="m71.574 41.851c0-4.685 0.074-10.553-0.033-15.237-0.047-2.018-0.268-4.076-0.746-6.034-3.421-13.999-16.972-22.705-31.201-20.13-12.596 2.279-21.973 13.518-21.973 26.336v15.035c-0.475 0-0.794-1e-3 -1.116 0h-11.482c-2.773 0-5.023 2.249-5.023 5.023v56.875c0 2.773 2.25 5.023 5.023 5.023h79.451c2.775 0 5.024-2.25 5.024-5.023v-56.875c0-2.774-2.249-5.023-5.024-5.023zm-19.467 53.267h-14.775c-2.322 0-4.203-1.914-4.203-4.274 0-0.063 7e-3 -0.127 9e-3 -0.19-5e-3 0-6e-3 -1.021-8e-3 -2.041-1e-3 -1.129 0.511-4.289 2.061-6.574 1.641-2.418 3.855-3.99 6.257-4.697-3.166-1.291-5.396-4.398-5.396-8.025 0-4.789 3.88-8.668 8.667-8.668 4.789 0 8.667 3.879 8.667 8.668 0 3.719-2.344 6.891-5.637 8.12 2.332 0.753 4.537 2.313 6.273 4.707 1.621 2.235 2.285 5.343 2.285 6.47v2.043c-6e-3 0.062 0 0.125 0 0.189 1e-3 2.358-1.88 4.272-4.2 4.272m9.672-62.014c-1.562 4.611-4.52 8.305-7.61 11.912-2.386 2.783-5.19 5.125-8.176 7.247-0.144 0.103-0.298 0.188-0.685 0.427 1.781-3.076 3.217-5.998 3.633-9.404-4.234 1.002-8.227 0.564-12.093-1.14-6.862-3.023-10.963-9.618-10.263-17.063 0.573-6.127 3.94-10.543 9.321-13.395 8.667-4.593 19.734-1.655 24.689 6.516 2.887 4.758 2.932 9.741 1.184 14.9" fill="#fff"/></g></svg>
|
||||
|
Before Width: | Height: | Size: 1.4 KiB |
|
|
@ -1,2 +0,0 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<svg width="128" height="128" version="1.1" viewBox="0 0 33.866 33.866" xmlns="http://www.w3.org/2000/svg"><g transform="matrix(.31143 0 0 .31143 2.9966 4.9564e-5)" fill="#414141"><path d="m71.574 41.851c0-4.685 0.074-10.553-0.033-15.237-0.047-2.018-0.268-4.076-0.746-6.034-3.421-13.999-16.972-22.705-31.201-20.13-12.596 2.279-21.973 13.518-21.973 26.336v15.035c-0.475 0-0.794-1e-3 -1.116 0h-11.482c-2.773 0-5.023 2.249-5.023 5.023v56.875c0 2.773 2.25 5.023 5.023 5.023h79.451c2.775 0 5.024-2.25 5.024-5.023v-56.875c0-2.774-2.249-5.023-5.024-5.023zm-19.467 53.267h-14.775c-2.322 0-4.203-1.914-4.203-4.274 0-0.063 7e-3 -0.127 9e-3 -0.19-5e-3 0-6e-3 -1.021-8e-3 -2.041-1e-3 -1.129 0.511-4.289 2.061-6.574 1.641-2.418 3.855-3.99 6.257-4.697-3.166-1.291-5.396-4.398-5.396-8.025 0-4.789 3.88-8.668 8.667-8.668 4.789 0 8.667 3.879 8.667 8.668 0 3.719-2.344 6.891-5.637 8.12 2.332 0.753 4.537 2.313 6.273 4.707 1.621 2.235 2.285 5.343 2.285 6.47v2.043c-6e-3 0.062 0 0.125 0 0.189 1e-3 2.358-1.88 4.272-4.2 4.272m9.672-62.014c-1.562 4.611-4.52 8.305-7.61 11.912-2.386 2.783-5.19 5.125-8.176 7.247-0.144 0.103-0.298 0.188-0.685 0.427 1.781-3.076 3.217-5.998 3.633-9.404-4.234 1.002-8.227 0.564-12.093-1.14-6.862-3.023-10.963-9.618-10.263-17.063 0.573-6.127 3.94-10.543 9.321-13.395 8.667-4.593 19.734-1.655 24.689 6.516 2.887 4.758 2.932 9.741 1.184 14.9" fill="#414141"/></g></svg>
|
||||
|
Before Width: | Height: | Size: 1.4 KiB |
|
|
@ -8,73 +8,73 @@ description: "Discover secure and private ways to communicate with others online
|
|||
{% include sections/instant-messenger.html %}
|
||||
|
||||
<h3 id="exploiting-centralized-networks" class="anchor">
|
||||
<a href="#exploiting-centralized-networks">
|
||||
<i class="fas fa-link anchor-icon"></i>
|
||||
<a href="#exploiting-centralized-networks">
|
||||
<i class="fas fa-link anchor-icon"></i>
|
||||
</a>
|
||||
Recent news about breaking E2EE on centralized instant messengers
|
||||
Recent news about breaking E2EE on centralized instant messengers
|
||||
</h3>
|
||||
|
||||
<h5>March 2020</h5>
|
||||
<ul>
|
||||
<li><a href="https://www.eff.org/deeplinks/2020/03/graham-blumenthal-bill-new-path-doj-finally-break-encryption">The Graham-Blumenthal Bill: A New Path for DOJ to Finally Break Encryption (EFF)</a></li>
|
||||
<li><a href="https://www.eff.org/deeplinks/2020/03/graham-blumenthal-bill-new-path-doj-finally-break-encryption">The Graham-Blumenthal Bill: A New Path for DOJ to Finally Break Encryption (EFF)</a></li>
|
||||
</ul>
|
||||
|
||||
<h5>January 2020</h5>
|
||||
<ul>
|
||||
<li><a href="https://cyberlaw.stanford.edu/blog/2020/01/earn-it-act-how-ban-end-end-encryption-without-actually-banning-it">The EARN IT Act: How to Ban End-to-End Encryption Without Actually Banning It</a></li>
|
||||
<li><a href="https://cyberlaw.stanford.edu/blog/2020/01/earn-it-act-how-ban-end-end-encryption-without-actually-banning-it">The EARN IT Act: How to Ban End-to-End Encryption Without Actually Banning It (Stanford)</a></li>
|
||||
</ul>
|
||||
|
||||
<h5>November 2019</h5>
|
||||
<ul>
|
||||
<li><a href="https://www.reuters.com/article/us-interpol-encryption-exclusive-idUSKBN1XR0S7">Exclusive: Interpol plans to condemn encryption spread, citing predators, sources say (Reuters)</a></li>
|
||||
<li><a href="https://arstechnica.com/tech-policy/2019/11/think-of-the-children-fbi-sought-interpol-statement-against-end-to-end-crypto/">Think of the children: FBI sought Interpol statement against end-to-end crypto (ArsTechnica)</a></li>
|
||||
<li><a href="https://www.reuters.com/article/us-interpol-encryption-exclusive-idUSKBN1XR0S7">Exclusive: Interpol plans to condemn encryption spread, citing predators, sources say (Reuters)</a></li>
|
||||
<li><a href="https://arstechnica.com/tech-policy/2019/11/think-of-the-children-fbi-sought-interpol-statement-against-end-to-end-crypto/">Think of the children: FBI sought Interpol statement against end-to-end crypto (ArsTechnica)</a></li>
|
||||
</ul>
|
||||
|
||||
<h5>October 2019</h5>
|
||||
<ul>
|
||||
<li><a href="https://www.eff.org/deeplinks/2019/10/open-letter-governments-us-uk-and-australia-facebook-all-out-attack-encryption">The Open Letter from the Governments of US, UK, and Australia to Facebook is An All-Out Attack on Encryption (EFF)</a></li>
|
||||
<li><a href="https://arstechnica.com/tech-policy/2019/10/the-broken-record-why-barrs-call-against-end-to-end-encryption-is-nuts/">The broken record: Why Barr’s call against end-to-end encryption is nuts (ArsTechnica)</a></li>
|
||||
<li><a href="https://arstechnica.com/information-technology/2019/10/ag-barr-is-pushing-facebook-to-backdoor-whatsapp-and-halt-encryption-plans">US wants Facebook to backdoor WhatsApp and halt encryption plans (ArsTechnica)</a></li>
|
||||
<li><a href="https://www.eff.org/deeplinks/2019/10/open-letter-governments-us-uk-and-australia-facebook-all-out-attack-encryption">The Open Letter from the Governments of US, UK, and Australia to Facebook is An All-Out Attack on Encryption (EFF)</a></li>
|
||||
<li><a href="https://arstechnica.com/tech-policy/2019/10/the-broken-record-why-barrs-call-against-end-to-end-encryption-is-nuts/">The broken record: Why Barr’s call against end-to-end encryption is nuts (ArsTechnica)</a></li>
|
||||
<li><a href="https://arstechnica.com/information-technology/2019/10/ag-barr-is-pushing-facebook-to-backdoor-whatsapp-and-halt-encryption-plans">US wants Facebook to backdoor WhatsApp and halt encryption plans (ArsTechnica)</a></li>
|
||||
</ul>
|
||||
|
||||
<h5>August 2019</h5>
|
||||
<ul>
|
||||
<li><a href="https://arstechnica.com/tech-policy/2019/08/post-snowden-tech-became-more-secure-but-is-govt-really-at-risk-of-going-dark">Post Snowden tech became more secure, but is government really at risk of going dark? (ArsTechnica)</a></li>
|
||||
<li><a href="https://arstechnica.com/tech-policy/2019/08/post-snowden-tech-became-more-secure-but-is-govt-really-at-risk-of-going-dark">Post Snowden tech became more secure, but is government really at risk of going dark? (ArsTechnica)</a></li>
|
||||
</ul>
|
||||
|
||||
<h5>July 2019</h5>
|
||||
<ul>
|
||||
<li><a href="https://techcrunch.com/2019/07/23/william-barr-consumers-security-risks-backdoors/">US attorney general William Barr says Americans should accept security risks of encryption backdoors (TechCrunch)</a></li>
|
||||
<li><a href="https://www.theregister.co.uk/2019/07/23/us_encryption_backdoor/">Low Barr: Don't give me that crap about security, just put the backdoors in the encryption, roars US Attorney General (The Register)</a></li>
|
||||
<li><a href="https://techcrunch.com/2019/07/23/william-barr-consumers-security-risks-backdoors/">US attorney general William Barr says Americans should accept security risks of encryption backdoors (TechCrunch)</a></li>
|
||||
<li><a href="https://www.theregister.co.uk/2019/07/23/us_encryption_backdoor/">Low Barr: Don't give me that crap about security, just put the backdoors in the encryption, roars US Attorney General (The Register)</a></li>
|
||||
</ul>
|
||||
|
||||
<h5>May 2019</h5>
|
||||
<ul>
|
||||
<li><a href="https://www.theguardian.com/uk-news/2019/may/30/apple-and-whatsapp-condemn-gchq-plans-to-eavesdrop-on-encrypted-chats">Apple and WhatsApp condemn GCHQ plans to eavesdrop on encrypted chats (The Guardian)</a></li>
|
||||
<li><a href="https://www.theguardian.com/uk-news/2019/may/30/apple-and-whatsapp-condemn-gchq-plans-to-eavesdrop-on-encrypted-chats">Apple and WhatsApp condemn GCHQ plans to eavesdrop on encrypted chats (The Guardian)</a></li>
|
||||
</ul>
|
||||
|
||||
<h5>January 2019</h5>
|
||||
<ul>
|
||||
<li><a href="https://www.justsecurity.org/62114/give-ghost-backdoor/">Give Up the Ghost: A Backdoor by Another Name (Just Security)</a></li>
|
||||
<li><a href="https://www.justsecurity.org/62114/give-ghost-backdoor/">Give Up the Ghost: A Backdoor by Another Name (Just Security)</a></li>
|
||||
</ul>
|
||||
|
||||
<h5>December 2018</h5>
|
||||
<ul>
|
||||
<li><a href="https://www.zdnet.com/article/whats-actually-in-australias-encryption-laws-everything-you-need-to-know/">What's actually in Australia's encryption laws? Everything you need to know (ZDnet)</a></li>
|
||||
<li><a href="https://www.zdnet.com/article/whats-actually-in-australias-encryption-laws-everything-you-need-to-know/">What's actually in Australia's encryption laws? Everything you need to know (ZDnet)</a></li>
|
||||
</ul>
|
||||
|
||||
<h3>Complete Comparison</h3>
|
||||
<ul>
|
||||
<li><a href="https://securechatguide.org/effguide.html">securechatguide.org</a> - Guide to Choosing a Messenger.</li>
|
||||
<li><a href="https://www.securemessagingapps.com/">securemessagingapps.com</a> - Secure Messaging Apps Comparison.</li>
|
||||
<li><a href="https://securechatguide.org/effguide.html">securechatguide.org</a> - Guide to Choosing a Messenger.</li>
|
||||
<li><a href="https://www.securemessagingapps.com/">securemessagingapps.com</a> - Secure Messaging Apps Comparison.</li>
|
||||
</ul>
|
||||
|
||||
<h3 id="#rtc-independent-security-audits">Independent security audits</h3>
|
||||
<ul>
|
||||
<li><a href="https://eprint.iacr.org/2016/1013.pdf">A Formal Security Analysis of the Signal Messaging Protocol (2019)</a> by Katriel Cohn-Gordon, Cas Cremers, Benjamin Dowling, Luke Garratt and Douglas Stebila</li>
|
||||
<li><a href="https://keybase.io/docs-assets/blog/NCC_Group_Keybase_KB2018_Public_Report_2019-02-27_v1.3.pdf">Keybase's Protocol Security Review (2019)</a> by <a href="https://www.nccgroup.trust/">NCC Group</a></li>
|
||||
<li><a href="https://www.nccgroup.trust/us/our-research/matrix-olm-cryptographic-review/">Matrix Olm Cryptographic Review</a></li>
|
||||
<li><a href="https://briarproject.org/news/2017-beta-released-security-audit">Briar - Darknet Messenger Releases Beta, Passes Security Audit</a></li>
|
||||
<li><a href="https://eprint.iacr.org/2016/1013.pdf">A Formal Security Analysis of the Signal Messaging Protocol (2019)</a> by Katriel Cohn-Gordon, Cas Cremers, Benjamin Dowling, Luke Garratt and Douglas Stebila</li>
|
||||
<li><a href="https://keybase.io/docs-assets/blog/NCC_Group_Keybase_KB2018_Public_Report_2019-02-27_v1.3.pdf">Keybase's Protocol Security Review (2019)</a> by <a href="https://www.nccgroup.trust/">NCC Group</a></li>
|
||||
<li><a href="https://www.nccgroup.trust/us/our-research/matrix-olm-cryptographic-review/">Matrix Olm Cryptographic Review</a></li>
|
||||
<li><a href="https://briarproject.org/news/2017-beta-released-security-audit">Briar - Darknet Messenger Releases Beta, Passes Security Audit</a></li>
|
||||
</ul>
|
||||
|
||||
<hr/>
|
||||
|
|
|
|||
Reference in New Issue
Taking another look at Kontalk, it looks like it requires phone numbers, and additionally uses openpgp for group chat so that would indicate no PFS.
Also looks like the encryption is some custom thing not documented. They were looking at doing OpenPGP, but now that's looking like OMEMO.
Removing XMPP recommendations, as all future clients must support E2EE by default. This is something we've discussed in the past thoroughly.
While Matrix does not at this moment, https://github.com/vector-im/riot-web/issues/6779#issuecomment-614822531 is imminent, so we make an exception for that.
Wait, so you will delist xmpp (a protocol) because not all clients have it enabled by default, but leave matrix because atm pretty much only one client has e2ee and all the rest does not even have a support for it not to mention having it by default?
At the same time keeping and promoting matrix with all it's metadata stored indefinatelly in the database?
We are referring to Riot specifically because it will very shortly have E2EE on by default.
Individual XMPP servers also store metadata (or can). High security environments where that is an issue will operate non-federating Matrix and XMPP servers.
Though on matrix they just DO regardless of whether you want it or not. And while others do it in logs, matrix does it in database.
Conversations already does have it on by default so not sure whats the logic behind it.
The logic is if something can, then we assume it does. Particularly in a federated network. Better to assume that it does than pretend like it might not.
Unless you have a non-federating server there's really no way to know what remote servers do.
Yes it does, but the issue is a lack of other high quality clients like it for other platforms.
Future discussion about XMPP should be in our issue https://github.com/privacytoolsIO/privacytools.io/issues/1838