They’ve had to develop a lot of standards, and most recently ones like MTA-STS, just to get some opportunistic encryption that can’t simply be intercepted and downgraded by an adversary. Many servers still do not implement MTA-STS or DANE.
We’ve had HTTPS for years, which provides explicit transport encryption. It’s always on by default, and there are very few ways to downgrade it into plaintext. Email, by contrast, took a lot longer to gain some semblance of security because it depends on a lot of other moving parts, including crummy, unmaintained SMTP servers that need to be retired and replaced.
When you start looking at other standards like DKIM, DKIM2, DMARC, and ARC, you start to realize email was not made in recent times, and trust was not a protocol feature built-in from the start.
And until not so long ago, they were only opportunistically upgraded to TLS, meaning downgrade attacks to plaintext were certainly possible.
The main issue is the adoption of standards. You might come up with a great new idea, but it has to go through a lengthy RFC process or nobody will adopt it.
This is notoriously a slow process (as most IETF working groups are), so trying to develop a modern chat platform on top of it is a terrible idea. If you run into a problem, you can’t just deploy a quick solution or issue a new room/spec version the way a protocol like Matrix does.
Instead, you have to find some existing piece and hope it works. I think the reason Delta Chat is able to achieve what it does is simply because it doesn’t try to do a lot of what protocols like Matrix can handle at scale or with better reliability.
I have used SimpleX in the past but don’t do so currently, largely due to the network effect. Personally, I find Matrix works pretty well these days for larger rooms and DMs (it’s widely used by many open-source projects), and the remaining communities that still use IRC bridge nicely via Heisenbridge. Matrix serves a different space, though and it’s more of a Teams replacement.
Its metadata social graph (who is speaking to whom) is more pronounced than Signal’s, but this combination still provides a pretty good coverage of features.
A tool has to be secure, work properly, and be good enough that other people will actually want to use it. However, security design and attack surface are going to become even more starkly pronounced as capable agents target them for exploitation.
It is simply no longer an option to develop something that is just “good enough.” Without a bulletproof architectural foundation that can be iterated if necessary, clinging to a tool out of a personal cargo cult becomes completely irrelevant.
