Welcome to Incremental Social! Learn more about this project here!
Check out lemmyverse to find more communities to join from here!

I made a spreadsheet that ranks messengers for privacy

I've been working really hard to research and rank messaging apps by their privacy. The more green boxes the better.

I plan to turn PrivacySpreadsheet.com into a place for privacy data on everything from cars to video games. It's all open source too on GitHub.

Not trying to advertise, I just put a lot of time into researching all this, and I want to share it since I think others could benefit.

n7gifmdn ,
@n7gifmdn@lemmy.ca avatar

who has analyzed the code to determine how sweet new comer SimpleX really is?

Cheradenine ,

Well, Trail of Bits did more than a year ago

simplex.chat/blog/20221108-simplex-chat-v4.2-security-audit-new-website.html

BlanK0 ,

Thx for the effort 🙏, the repo looks very interesting gonna have a look later

lazynooblet ,
@lazynooblet@lazysoci.al avatar

It's got that telegram is funded by Russia, is that true?

Wikipedia says the opposite.

https://en.m.wikipedia.org/wiki/Telegram_(software)

Telegram was launched in 2013 by the brothers Nikolai and Pavel Durov. Previously, the pair founded the Russian social network VK, which they left in 2014, saying it had been taken over by the government. Pavel sold his remaining stake in VK and left Russia after resisting government pressure.

AtmaJnana ,

Telegram was suddenly unblocked in Russia after getting a bunch of money from the Kremlin.

https://www.wired.com/story/the-kremlin-has-entered-the-chat/

The Moscow Times reported that the investments included $75 million from a joint partnership between an Abu Dhabi state fund and a Kremlin sovereign wealth fund.

BearOfaTime ,

Uggh, that's a bit concerning.

TheAnonymouseJoker ,

Telegram is not meant for private messaging. It is like a public forum but in the form of realtime chat. Telegram and Discord are unique types of public chat style forums.

BearOfaTime ,

Really? Because that's how I use it. There's nothing "public" about anything I use in it.

There's also fully end-to-end encrypted chats.

TheAnonymouseJoker ,

You can go whisper in another person's ear in a discussion group, thinking others cannot hear your whispers. Does not make it true. You can go use an axe to cut vegetables if you like. Just do not complain when the onion becomes red.

If you do not understand the nature of different tools, it is entirely your fault. Use different tools for different purposes.

poVoq ,
@poVoq@slrpnk.net avatar

You got some errors for XMPP e2ee: the popular mobile clients all enable it by default, it has perfect forward secrecy and a/v calls are usually also e2ee and of course data is encrypted in transit.

rcbrk ,

Yep. Really need to compare the best-practice XMPP clients (e.g. Conversations, Siskin), not half-developed clients more suited to the XMPP landscape of 20 years ago. -- Just as Matrix's ranking in the table is high because only the state-of-the-art clients are considered -- there are plenty of Matrix clients which don't support e2ee, for example.

This list of mistakes isn't exhaustive, but extending from poVoq's mentions, here are some things XMPP(conversations) does actually have positive findings for:

  • End to end encrypted by default [OMEMO]
  • End to end encryption is available [OMEMO]
  • Voice/video calls are end to end encrypted ["calls are always end-to-end encrypted with DTLS-SRTP"]
  • Utilizes Perfect Forward Secrecy [OMEMO]
  • Data is encrypted in transit [TLS and OMEMO]
  • You can verify contacts out of band [https://gultsch.de/trust.html]
  • There has been a third party code audit [2016]
  • Provider can scan for illegal content [If you send content unencrypted, otherwise no different to Matrix/Signal]

I'm not sure there's much differentiation between any apps when it comes to "What can the apps hand to police?"; if the police have physical access to your device and app, they have access to everything you do on that device/app.

mobergmann ,
@mobergmann@lemmy.world avatar

The is the messenger matrix from the German blog Kukitz-Blog (it is a blog with a strong focus on privacy and is in my opinion well informed). But no worries, the matrix is also available in English.

Maybe you can take some inspiration from the matrix.

fool ,
@fool@mastodon.world avatar

@UnHidden
A Mastodon post linking to a Lemmy post linking to a GitHub with no info worth only a .com website link left

Didn't know my patience can be used up before seeing anything worthwhile

(And frankly, I would still bet the ranking somehow confuses privacy with anonymity)

AtmaJnana ,

I can't wait for 0.19.

UnHidden OP ,

A mastodon post? what? did someone share it there?

PoliticalCustard ,
@PoliticalCustard@lemmygrad.ml avatar

Wow, that's amazing, It's huge! A staggering amount of work has gone into that, well done!

aldalire ,

Session?

UnHidden OP ,

Working on it

pineapplelover ,

The issue with me is ease of use to use with other people. I've tried Matrix and Session with other tech minded people and it's not nearly as seemless as Signal. I'm just waiting for an app that ticks all my boxes, really looking forward to Signal usernames though.

BlanK0 ,

Signal really is that better replacement for WhatsApp since the functionality is identical, others would have to force people to get used to the different ui and the options.

BearOfaTime ,

Except Signal UI is... Not good. It feels like using a texting app.

Between the UI and dropping SMS support, I can't get anyone to use it anymore, and people I had using it have moved on.

Dropping SMS is really frustrating - it was the big selling point I had.

pineapplelover ,

Huge bummer. Kind of understood why they did it but they lost a lot of people because of this.

ry_ ,

I’m one of those people who thinks SMS has no place in a private messaging app. Signal is the gold standard, and enabling sms merely legitimised this incredibly non private and antiquated messaging protocol.

BearOfaTime ,

And gave a constant reminder to people that something better was right there.

And put things in one place.

You're letting perfect be the enemy of good. At least with SMS support I could get people to switch to "this new texting app", and we'd then have a proper Signal encrypted chat. And when they texted someone else, Signal would append the "you could have encryption too" signature, generating a conversation about it.

The people who moved off of Signal went back to SMS entirely. How is that better?

MrRazamataz ,
@MrRazamataz@lemmy.razbot.xyz avatar

but it is a texting app...

JustEnoughDucks ,
@JustEnoughDucks@feddit.nl avatar

Everyone. Everyone. I mean everyone here misses the biggest plus for WhatsApp compared to pretty much every other messenger. Signal is pretty much the only one as "simple" as it.

We are all too big of privacy geeks to realize what non-tech-savvy people go through with these.

  • Sign up process is dead simple from your phone. It is literally as simple as putting in your phone and PIN. Once you hit the "choosing server" on people using matrix for the first time, you have already lost them. Completely. The exact same thing happened with mastodon and lemmy. People who had no idea about how federation and decentralization were instantly lost

  • Backups: backing up is a process that the users have to do on a lot of matrix clients, or not available. People want to be able to simply move to a new phone by installing the new app, logging in, and being right back with all of your old messages. Even on signal you still have to restore the automatic backup. If you don't have that file, you are screwed. I can't remember if Element will sync your messages automatically to a new device.

Those 2 things and population are literally the only thing that the average person actually cares about outside of other people being available on the platform.

sxan , (edited )
@sxan@midwest.social avatar

I've been using Matrix for years, but now only as a replacement for IRC. The encryption key handling has always been cumbersome and flakey, and too easily broken by users. Not compromised "broken", but locked out "broken." It's been like this for years, and while the UI has improved, it's still too hard for casual users to confidently use; I've given up hope that it'll ever get to a point where I can recommend it to friends who don't give a fuck how it works, and who aren't interested in spending a half hour figuring out how to set things up - they just want it to work. So many encrypted messaging systems have done this correctly, I dispair that Matrix can't (it's a common issue with all clients, so I blame the design of the protocol).

Edit oh, I also wanted to say I'd also been disillusioned with Matrix when I realized I couldn't run my own server. That is, I technically could; I just couldn't afford to. Synapse is a hot mess of a server, but it also just pounds on the CPU and requires massive amounts of disk space (over time). Matrix is designed such that all content for channels joined by any user is replicated to the user's home server. It's a questionable design decison, at best, but a consequence is that regardless of the server software, the storage requirements make running a home server cost prohibative. Compared to, say, running an xmpp server, which could be done effectively on a Pi.

toastal ,

Replicating all chat history + attachments provides a lot of resilience to the network from a node going down, but at the cost preventing to the home lab user from practically hosting a server which just means everything centralizes around Matrix.org, & when anyone on Matrix.org chats with you or your group, that metadata gets synced back to the central hub server once outwardly funded by Israeli intelligence.

toastal , (edited )

I made the mistake of getting my family to switch to Signal. It works great for messaging, but it has other issues—beyond the typical SIM-required complaint. I hate that you have to register with a ‘primary’ device on either iOS or Android fueling that duopoly (SoL if you are on a postmarketOS or KaiOS or Capyloon phone… or just don’t want a internet-capable phone). Notifications are sent thru Google’s FSM (news 1–2 months ago that of course Apple & Google send all the metadata to the feds) & refuse to support UnifiedPush (thank goodness the Molly fork does). They’re also not too happy to support alternative clients meaning you are stuck with the shitty, resource-sucking Electron client while not having a web client or native or TUI client. And the worst cherry on top is shipping those iOS emoji to Android & Linux …eww.

pineapplelover ,

  • Yeah not having it as a default SMS app sucks. Can't really argue with you there. Perhaps, one could make a fork with it?? Just thought of that now.

  • I seriously doubt any encrypted messenger is going to support OS like KaiOS or non internet capable devices.

  • For unified push, just use molly.

  • iOS emojis...I really don't care, Signal devs have other things to worry about.

toastal , (edited )

With an FPGA or special CPU instruction set, the encryption algorithms could run on a toaster—which would give access to whatever low-spec handheld you wanted without making it chug to have strong encryption. That also still isn’t covering the future hope of a Linux phone, or someone that just wants to register an account on their laptop.

Using forks puts stress on other teams to keep up with breaking changes, & 90%+ of folks won’t be looking for forks or be willing to trust their unofficial status. I saw the code for UnifiedPush as a Mattermost plugin & it was like 50 lines or something small which is much less than the rest while allowing users to keep control of their metadata which is a big deal if you care about privacy. A fork for SMS support would encounter similar issues, & now you either need to compete with Molly or copy its featureset otherwise users have to choose, SMS or UnifiedPush. That said, I agree with the SMS situation since it was easy to convince relatives to use this new “text app” where encryption magically came to a chunk of their contact list.

Saying emoji was the most important was tongue-in-cheek, but it makes the application feel non-native (& I think Apple’s emoji are particularly ugly). You would think at least the Google set was shipped to Android, or—now hear me out—not ship emoji, don’t override the user experience, let the user’s fontconfig display the one they set. Shipping a whole font (or images) for emoji is why the application size is so bloated for a chat app.

pineapplelover ,

The first two arguments I get. But the emoji argument about not shipping them at all? Yeah if this is going to be a mainstream and easy to use app then that won't fly. My friends, family, and I all use emojis, gifs, and stickers. I'm sure many people enjoy these things as well. All that bloat.

toastal ,

Are you using a device without an emoji font installed on the system at all? The web works just fine without browsers shipping an emoji font.

Encryption ,
@Encryption@feddit.ch avatar

This is a really cool idea, will share it around!

Maybe add the website on the GitHub-Repo as the projetc-site URL, makes it easier to navigate.

degen ,

This makes me feel things. Incredible.

return2ozma ,
@return2ozma@lemmy.world avatar

Is there a way to lock the left cells while scrolling through the other messengers?

UnHidden OP ,

Working on it, hard to do well without JavaScript while maintaining the ease of webpage generation

clever_banana ,
@clever_banana@lemmy.today avatar

Don't do this with JavaScript ffs

UnHidden OP ,

I will not include any JS in the site.
I'm not a web dev, I'm a mobile app dev, so web dev is new to me

Chozo ,

Not that I give a shit, but I can see you potentially catching some flack for listing the USA as an "authoritarian regime" lmfao

UnHidden OP ,

Lets be honest, its not much different from China. They both make social media companies censor, and they both track citizens to predict their likliness of committing a crime in the future.

return2ozma ,
@return2ozma@lemmy.world avatar

Where's the lie?

Encryption ,
@Encryption@feddit.ch avatar

They hate him, because he told the truth.

TheAnonymouseJoker ,

USA is atleast 100x worse than China, if you cared to look at Snowden and Assange leaks, and Wikipedia page for USA surveillance programs since the formation of NSA in 1960s. Assange is getting drugged and tortured as we speak, and that is not happening in China. Snowden can never go back to his home unless he wants to be "mysteriously dead".

BearOfaTime ,

I wouldn't say worse than China, but I'd say they're both equal, in their own way.

It's the nature of state politics and security. I'd bet even money every government on the planet is equally bad, up to the resources they have at their disposal.

Remember, all governments are collections of individuals, and individuals range in their morality.

Certain types are attracted to certain opportunities...like the power of government.

clever_banana ,
@clever_banana@lemmy.today avatar

Maybe Undemocratic ia better?

cralder ,
@cralder@lemmy.world avatar

Bro put Tinder DMs on the list. Points for being thorough I guess lol.

Jokes aside looks really useful. Good job!

UnHidden OP ,

I forgot Grindr DMs, but you already know that ones gonna be red all the way down lmao

Pls share with friends if you find it useful, I dont accept donations or anything, and it'll never have ads or bullshit.

I'm working on adding more services, but each one takes about 4 hours to research and review.

Jolteon ,

Google's bound to put ads on Google sheets eventually.

UnHidden OP ,

Its not Google Sheets. It was initially generated with the tool because I like the formatting, but its HTML running on Cloudflare Pages. The source code is here

If you see errors or hwve suggestions, please submit an issue on GitHub, they're easier to track than here

Matriks404 ,

That hardly looks like original source code, but more like a HTML dumped from the website.

Or maybe just use used some visual editor to insert tables? I don't believe it's written by hand.

https://lemmy.world/pictrs/image/70bce1b2-798e-4ef1-9399-1f308bf32450.png

MrRazamataz ,
@MrRazamataz@lemmy.razbot.xyz avatar

They said "it was initially generated with the tool [Google Sheets]".

stepanzak ,

And Xbox live

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • privacy@lemmy.ml
  • random
  • incremental_games
  • meta
  • All magazines
    •