Session: Is the only fully decentralized messenger that is reliable (as far as I know)
Hello, it’s me — the dude who comes to PG just to post links to one furry blog.
Signal: Is good but requires phone numbers
Not anymore
3 Likes
The app leaks your IP address to the server by default. Roughly 50% of your contacts will use same server cloud provider (Akamai or Flux) as you, and that company can end-to-end correlate your conversations with that contact. Always use SimpleX with Tor if you actually want to get rid of user identifiers.
I’d argue the apps that hide your IP by default and that use no (de)centralized servers provide better privacy: Cwtch, Quiet, Ricochet Refresh, OnionShare chats, and Briar.
5 Likes
I guess some of the mentioned issues will get solved with the Session Protocol V2, espically its introduction of PFS (Perfect forward secrecy).
I know, you can now give you phone number to Google/Apple to then pay Signal to not give them your phone number.
This is obviously not an anonymous or fully pseudonymous account.
Almost anything “leaks” your IP address to its server by default.
Signal “leaks” your IP address to its server.
Technically Tor is also “leaking” your IP address to its entry node.
But nothing is stoping you from using Tor or a VPN in combination with SimpleX, the point of SimpleX is not to hide your IP from the SimpleX server, but to avoid reusing the same app internal user identifier.
And I am not aware of another app that takes this goal that serious and is also good for day to day use.
They are all good messenger, but I they all some drawbacks.
I also want to mention that Session is also hiding your IP through its onion routing
2 Likes
I wish more issues in this world could be solved with proposing protocol without having to implement those protocols. And it was not the only idea in the post.
I know, you can now give your phone number to Google/Apple to then pay Signal to not give them your phone number.
They already have mine. There’s a significant difference between “Signal requires” and “my beliefs require.”
I edited my post to make the wording clearer.
They also have mine, but the can NOT connect them with my SimpleX connection or Session IDs.
If you use Google/Apple to directly pay Signal for giving you a numberless account, there is direct papertrail from the account to you your IRL identity.
Feel free to buy a Signal account using my sacrificed privacy — fully anonymously, with crypto, in the most true p2p way: simplex
Signal states there’s no such connection. Are there arguments for them being wrong?
I appreciate this offer, how much do you charge and would you offer more then 1 account?
Though the problem is that this account would then be linked to this Forum account here 
Correction: WeChat is NOT directly run by the Chinese government, but a private company Tencent, one of the biggest gaming and technology companies in the world. Despite privacy and security concerns, it’s the most versatile super app in the world, and the most ubiquitous in China.
Sure, I won’t charge anything above $3 for one account — I genuinely respect others’ beliefs. For multiple, I don’t know, it’ll be boring to buy them, encrypt, and export — I’ll take a small % above cost.
Though the problem is that this account would then be linked to this Forum account here
In which way — with timecodes? I guess there are a lot of new Signal accounts to be created these days, and even more after the official release
did I say “directly” in the video? because if not then I’m not sure what you are correcting
1 Like
Some Free / Libre / Open Source tier list makers in case anyone’s interested:
Probably should be moved to be moved to a separate topic…
Most of the tools that say they provide metadata resistance does not. That includes your Session. SimpleX shines in the category of walk-does-not-match-the-talk.
Yes it does. Which is why we don’t consider Signal to provide anonymity to users by default. The difference is, Signal isn’t claiming to have no identifiers whatsoever.
Tor is the routing protocol. Obviously the entry node has your IP, but it has no other information. It doesn’t know what app’s data it’s moving, the service provider’s server, and in the context of instant messaging, the recipient. All it sees is you wanted to relay this encrypted blob to relay node. Your argument is about as useful point as “Recipient has the decryption key” is for analyzing E2EE security. Yes, that’s how it works. We don’t have better mechanisms for providing anonymity online, and the NSA agrees.
This may have something to do with what I said: “Always use SimpleX with Tor if you actually want to get rid of user identifiers.”
Still, defaults define the application’s default security. Just because you can bolt on Tor, doesn’t make the app automatically use Tor. If you forget to enable Tor, if you mistakenly think it uses Tor by default, or, if someone messes with your settings, SimpleX will silently run without telling you Tor isn’t enabled. the GUI makes no indication about anonymizing traffic. The apps I listed won’t work at all if Tor isn’t working, because they operate via user-run Onion Services. Thus they’re better from the PoV of misuse resistance.
Also, you need to either apply your rules to everything (Nothing prevents using Tor with Signal, nothing prevents using burner phones and non-KYC SIMs to register Signal), or nothing. Internal consistency would help your argument significantly.
But now you’re moving the goal posts, adding the “good for day-to-day use”. That “good for day-to-day use” is your subjective assessment, and people who depend on metadata-resistant communications with their lives would probably consider SimpleX client leaking the IP to server by default or after misconfiguration, less good for day-to-day use. The issue is you’re not providing any clear threat model under which you operate and where use of SimpleX shines.
All apps make fundamental trade-offs between what they can provide. E.g.,
- You can’t have offline-messages and p2p Tor routing.
- You can’t have forwarding of received messages and endpoint security.
- You can’t have automatic public fingerprint verification and trust-no-one approach.
The “they all have some drawbacks” is also inconsistent with your original goal post
Is on top because its the only messenger I know that tries its best to avoid user identifier, which makes it the king of private messaging.
where your focus was the lack of identifiers defined the whole show, not “daily use UX”. I listed a bunch of tools that handle the “no user identifier” much better by default, meeting that specific goal. Then you changed your position to keep your app where you want it to be. If I were you I’d do some internal exploration about how much of fanboy-mentality is at play here; Messaging apps tend to form cult-like following for whatever reason.
Yup. It’s an improvement over SimpleX if there’s volunteers running the anonymity network. But last I checked, it suffers from the same issue as SimpleX, lack of hosting diversity: Third of the nodes were run on VPS by single company: Hetzner. Too bad the lokidashboard website has gone so updating my info isn’t as easy as it used to be. Tor has 9794 nodes vs Session’s 1100, and there’s 1106 recognized networks where largest provider has 10.2% of nodes. Thus, it has more distinct hosting providers than Session has nodes. For comparison, the hosting diversity of SimpleX server infrastructure is 2, and for now, it’s completely unclear if there’s even a separate organization with developers/staff that set up the network, or if it’s just SimpleX company staff managing servers on Flux too.
7 Likes
Yes, I’m aware of all of these, but threat model and requirements differ. E.g. my main threat model is preventing mass surveillance by bigh tech. And that’s all. And requirements are:
- No need for phone number or app, account can be PC only, but also must have android and ios apps for others
- It’s low resource program, that can run on 15 year old linux laptop (less than 200mb), but it’s not TUI
- Has system tray integration, so it can stay always on without accidentaly closing it, and still shows notifications
- E2EE of course, with multi-device support
And so far, I have found nothing better than XMPP. But it’s PITA with their OMEMO implementation and multiple devices. Similar is with Matrix, some things are better, some are worse. Could say they are equal.
DeltaChat is probably closest to what I’m looking for, even though it takes 250-300MB in idle. But QR code contact adding, and setting your PC as a second device with a QR code - I don’t know what to say to that.
1 Like
And really you can’t operate the internet without an IP of any kind, anyone claiming it doesn’t use it is lying or trying to sell you snake oil, I digress
Granted companies/services can anyway choose not to log the IP, that’s possible to do but it is not like it isn’t used in any way to connect to services we rely on which baffles me alot of it just comes down to that
also even if you use VPN not just Tor, VPNs know your real IP, no question there.
2 Likes
Lots of good points but I find it strange you’re rightfully going after XMPP and email wrt metadata, but Matrix servers accumulate the same information: your IP, your account, your contacts account, their server, and on their servers end, their IP. Plus on top of that, the typical info like observed contact list, quantity, schedule and type of transmitted data information.
I think it’s important to look at the server side capabilities from the PoV of what malicious server SW could do, and what does the client prevent it from doing.
All decentralized platforms have thus roughly same treat model.
Granted Matrix default E2EE protects some metadata like someone calling you by your IRL name.
In the recommendation for SimpleX, I would at least include the following: Without Tor you use this app at your own risk.
I guess everything we use, we use at our own risk including Tor. And I don’t think Tor is far from the top of risky apps, it’s not always clear what you expose
2 Likes
I dont favor SimpleX over Signal because of IP, but because of app internal user identifiers.
How do you mean?
I dont consider networking directly part of the user identifier problem.
Networking is a different problem.
I never claimed that Session alone provides stronger IP obfuscation then Tor.
But it would be good to get more stats on network diversification.
You could put SimpleX in a Tor distro or in a Android profile with Orbot on always-on+killswitch.
Sure, if you only need to hide your identity from other users, your threat model is much more relaxed. Even Telegram allows you to hide behind a call sign.
Data diode isolated, split TCB architecture can’t automate data input from Destination to Source device without violating the no feedback loop principle that breaks the security property.
Which is fine again if you trust the vendor to do the right thing with your metadata. If you need the equivalent of end-to-end encryption for your metadata (vendor has no access), i.e. when you don’t trust the vendor, then anonymous overlay networks obviously play a role in your metadata protection 
I didn’t say you did! I merely provided context in a situation where you hand-wavily disregarded every Tor messenger due to their “drawbacks”, and then brought out Session (that like you said, has weaker IP obfuscation) as an alternative. It is an alternative for a more relaxed threat model.
Which doesn’t really change my point about app’s own defaults dictating how we should classify the apps. Using OS that forces traffic through Tor is much more misuse resistant, we can agree on that.
1 Like