Encrypted Messaging

Software & Web Applications
1

So I thought I would create a post to talk about some encrypted messaging services. I know Tom talks about Signal occasionally but Signal is not the only one out there. Here is a list of some messaging apps and protocols including Signal. My criteria:

  • Must be free (as in freedom) and Open source software (foss)
  • Must have had some sort of security audit
  • Must be on F-droid to some extent (Signal is the exception)
  • Must be be completed and out of beta

I am writing this from Android (AOSP) perspective.

Signal

Signal is probably the most popular and well known out side of Telegraph and WhatsApp. I do not think I need to talk to much about it but I will point out some potential downsides. The Signal app still requires a phone number to sign up although you now do not need to share your number. Another issue I have with it is its dependency on proprietary software and services. There is no official Libre version and they do not publish on F-droid.

Molly and Molly FOSS

Molly is a soft fork of Signal that aims to fix some of the issues with Signal. It is on F-droid and has a completely foss version with no Google proprietary libraries. It also has some cool features such as app locking and encryption, some support for unified push, support for routing via Tor and a few other things. I like Molly because it has a completely foss version which works well for me. Molly still uses Signals servers for messages.

Simplex Chat

Simplex chat is a new messager that protects privacy and prevents spam. It does not require a phone number and there is no central identifier. You can add contacts via one time links shared via QR codes. This protects against spam and unwanted messages. I also like that you can create “incognito chats” which are chats that do not share account display names or profile images. Simplex Chat does not use Google services and has its own notification system. It also has a first party F-droid app.

Matrix

Matrix is closer to a discord alternative than anything. It is a federated platform that allows for chats and online discussion. Dedicated communities can also use spaces which are effectively groups of chat rooms. One downside is that you need to turn on encryption and it only works for private messages. Another aspect of Matrix is that there are tons of clients. This might be a benifit or a drawback depending on who you are.

Briar

Briar is more of an app for groups of people who are being targeted by a governments or powerful organizations. It would be great for protests but is not idea for day to day usage. The cool part about Briar is that it is totally decentralized. Messages can sync over Bluetooth, local WiFi or Tor. Additionally messages can be relayed by a third person who is in the contact list of all parties. Briar has Forms, blogs and private groups. Forms are exactly what they sound like. Blogs are just public read only messages and private groups are groups that are private. The biggest draw back to Briar is that you need to be online always if you want to receive messages. This isn’t always practical so Briar has Briar mailbox which is a second device you can leave at home to receive messages while you are offline.

Conclusion

This is not a complete list but it is a start. I left out some messagers that I didn’t like such as Session.

1 Like
2

Hey @Darin755,

Thanks for sharing this comprehensive overview of encrypted messaging services. I appreciate the focus on FOSS and security audits. It’s great to learn about alternatives like Molly, Simplex Chat and Briar. Your insights on each app’s strengths and weaknesses are really helpful.

Marcos

3

I stick with tools that actually encrypt messages by default and don’t rely on trust in the server. If the code’s public and audited, that gives me more confidence.

4

All of the apps above are fully E2EE

5

I’ve looked into this too, and one thing I ran into was how some services that look secure don’t work well if your provider doesn’t support proper encryption or strips it out. I switched to another sip provider and saw a difference right away—calls and messages stayed encrypted without dropping or weird errors. Worth checking if your sip provider does end-to-end SRTP and TLS properly.

6

but but but ALL the big names in messaging ALL swear ALL their messages are E2EE.

LOL

It seems these days, we actually have to DEFINE E2EE b/c the big tech companies are pulling the ol’ “redefine the terms” on us, to confuse the public.