Context
Continuing the discussion from 2026 Instant Messenger Tier List.
The video made a lot of people react to it which could be good but most of the time adds confusion or false belief.
As a comparison summary, tier lists have become popular for their simplicity.
After watching the video and reading the posts, here are my impressions.
Problems
- Tier lists are highly subjective
- Simplicity and completeness aren’t best friends
- Comparisons need methodology, completeness and sources
- Every day or so, users ask to add another app/tool
- Team of PG (Privacy Guides) lack resources to fully address points 3 & 4
Solution
A mix of Wikipedia and a comparative table like this to enable traceable open contributions that are simple and fast to make; while centralizing and clarify information to let people choose what’s best for them based on facts.
Personal thoughts
First thing I notice was that there is no standard on which to test messaging apps compared to browsers (see “Solution” section example of comparative table) that all depend on the same standards (Javascript API, HTTP headers, DNS queries, …). It would be impossible to create a similar comparison in that sense. BUT, what can be done is a scenario comparison.
Second thing, while looking at the 9 listed threats on PG, each of them needs user data to succeed even if they don’t all aim for data retrieval (ransomware, infrastructure deterioration, …). This means that we should focus on data.
So I thought to compare, for each functionality in messaging app, which data is necessary and to whom it is shared. This is the “completeness”.
This implies that we should define what is a messaging app (what functionalities enable peoples to exchange) and bound this comparison to the main players that are parts of the process.
In that sense, features like usage of Tor that can increase privacy should be reserved for another comparison as it is not a “messaging app” functionality (even if some apps offer it) and because it can be configured outside the app while still providing what it intends to. Following this example, yes ISPs play a role and may gather data but as for any other usage needing internet access so it shouldn’t be part of this comparison. This is the “methodology”.
Prototype
Tried to prototype it, thought to be a 5 minutes hop… Fast-forward many days, tears and sweat: here it is! (not accessible via Tor)
What’s next
Some thoughts on what could be improved:
- Because everything is a question of trust (I was fine before realizing it, damn it! See this list of assumptions as an example), maybe a “trust indicator” should be shown for the entities able to access user data. No idea how to gather the data, how to weight it or what the indicator should look like.
- Metadata are data and should be part of the comparison.
- While trying to keep it simple, those comparisons can quickly become hard to read. To be frank, this prototype isn’t a good way to compare apps because it doesn’t present multiple apps side by side. It could still be useful for completeness and sources management in order to help synthesize information. What could be done to inform people nicely would be two tables. One for the mandatory data usage of each app with their default settings and another one but with hardened settings. Example:
Insert toggle between default settings and hardened settings table
Default settings comparison table
| Data | Signal | SimpleX | Briar | … |
|---|---|---|---|---|
| Phone number | . | . | . | … |
| … | . | . | . | … |
One caveat being having to define what are, for each app, default and hardened settings? (example: is Signal phone numberless registration a default or a hardened setting?) This could reintroduce debates and thus undermine the point of the proposed solution.
Disclaimers
Multiple things to keep in mind:
- I’m not a specialist in security nor a jurist nor a dev…
- …so, information gathered aren’t complete or 100% factual nor the app is coded, or the data arranged in the best possible way
- Everything is hand-made.
Conclusion
This is a draft that should serve as a base for a larger discussion. Indeed, messaging apps are just one type of tool but this could be applied to VPNs, OSes, …
But more importantly, it asks how comparisons made on PG could be improved.
Last point of “What’s next” is, at the time of publishing this topic, where I end up being.