Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Best encrypted messaging app atm?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 90 posts

Re: Ask HN: Best encrypted messaging app atm?

#11

Post by hannob »

sgt wrote: post #9

I am under the impression iMessage is pretty secure and I use it extensively as most of my friends and colleagues have iPhones. Refer to http://www.apple.com/business/docs/iOS_Security_Guide.pdf which specifies that RSA 1280-bit keypairs are used, and the private key is held on the device. So in terms of transit - the protocol should be secure. The only remaining option would be to question whether iOS is secure/inse…

> I am under the impression iMessage is pretty secure

Why's that? (I'm asking seriously, because I don't understand how people get this impression.)

iMessage has some very fundamental design flaws that led to this attack: https://blog.cryptographyengineering.com/2016/03/21/attack-o...

The attack is not super-spectacular, but the more worrying thing is that the design is not sound. They use an ad-hoc crypto construction that fails to follow usual best practices. And they haven't really fixed it, they just put some duct tape over it to avoid the attack.

Re: Ask HN: Best encrypted messaging app atm?

#12

Post by lorenzhs »

blyuher wrote: post #3

Signal ( https://whispersystems.org/ ) got a good score from EFF. You may find this guide helpful - https://medium.freecodecamp.com/tor-signal-and-beyond-a-law-... edit: clarification

That article recommends Tor for browsing without mentioning the dangers involved. Malicious exit nodes are not hypothetical. It's easy to make mistakes with Tor, so I'd be wary of a general recommendation to use it. People who know more about this than me seem to agree: https://twitter.com/thegrugq/status/797608924606173184

edit: I'm also unsure about the warning against fingerprint authentication. I use Touch ID with a long passcode and consider that the best trade-off. It prevents everyday attempts to get into the phone and offline cracking. The passcode is required after a longer time of inactivity. If you're paranoid you can touch your pinky against it five times in predictable situations (border controls etc). It's not perfect, but I think it makes the best tradeoff between convenience and security for most "normal" people.

Re: Ask HN: Best encrypted messaging app atm?

#14

Post by gcb0 »

lorenzhs wrote: post #12
blyuher wrote: post #3

Signal ( https://whispersystems.org/ ) got a good score from EFF. You may find this guide helpful - https://medium.freecodecamp.com/tor-signal-and-beyond-a-law-... edit: clarification

That article recommends Tor for browsing without mentioning the dangers involved. Malicious exit nodes are not hypothetical. It's easy to make mistakes with Tor, so I'd be wary of a general recommendation to use it. People who know more about this than me seem to agree: https://twitter.com/thegrugq/status/797608924606173184 edit: I'm also unsure about the warning against fingerprint authentication. I use Touch ID wit…

agreed. tor exit nodes are a last resort.

try to stay within tor network or just rely on ssl and assume adversaries know the site but not the content you access.

Re: Ask HN: Best encrypted messaging app atm?

#15

Post by pmlnr »

This is a vague question: it depends entirely on the protocol you're about to use. I'll try to give a few answers anyway.

First of all, if you want total encryption, you'll need to make sure your connection is encrypted and secured as well (meaning following you back is not trivial), so the whole messaging should go through Tor[1].

There are plugin solutions for bitlbee[2], for Pidgin[3], and many other clients supporting OTR and similar encryptions.

If you want all-in-one solutions, you probably should look at Tox[4], which is a protocol, not just an app, built to be encrypted by default. It's complicated and nasty to use and set up, but it's pretty secure.

Other ideas might be drawn from the prism-break Communications list[5], listing apps like Chatsecure[6] or Xabber[7], both encryption-capable jabber apps.

[1]: https://www.torproject.org/ [2]: https://wiki.bitlbee.org/bitlbee-otr [3]: https://developer.pidgin.im/wiki/ThirdPartyPlugins#Securitya... [4]: https://tox.chat/ [5]: https://prism-break.org/en/protocols/ [6]: https://chatsecure.org/ [7]: https://www.xabber.com/

Re: Ask HN: Best encrypted messaging app atm?

#17

Post by warcode »

urza wrote: post #8

As an alternative to Signal, I would also recommend Threema. Mobile only, paid, end-to-end encrypted with in-person verification. Team and infrastructure is based in Switzerland https://threema.ch/en/

I recommend Threema as well. Been using it for a couple of years.

Accounts not tied to phone number, available on IOS, Android and Windows Phone, perfectly working group chats.

Re: Ask HN: Best encrypted messaging app atm?

#19

Post by adrianN »

lorenzhs wrote: post #12
blyuher wrote: post #3

Signal ( https://whispersystems.org/ ) got a good score from EFF. You may find this guide helpful - https://medium.freecodecamp.com/tor-signal-and-beyond-a-law-... edit: clarification

That article recommends Tor for browsing without mentioning the dangers involved. Malicious exit nodes are not hypothetical. It's easy to make mistakes with Tor, so I'd be wary of a general recommendation to use it. People who know more about this than me seem to agree: https://twitter.com/thegrugq/status/797608924606173184 edit: I'm also unsure about the warning against fingerprint authentication. I use Touch ID wit…

The exact same dangers exist with normal browsing. Intermediate nodes on your route can do whatever they want unless you use proper encryption. In fact, things like sniffing your traffic are routinely done by $ThreeLetterAgency.

Re: Ask HN: Best encrypted messaging app atm?

#20

Post by tmikaeld »

libeclipse wrote: post #18
jedisct1 wrote: post #16

I like https://wire.com and https://threema.ch/en

Wire was in the middle of a shitstorm a while back iirc because it falsly advertised that it encrypted everything end-to-end, when in actual fact only text was so.

Doesn't wire use Webrtc? I thought it was encrypted end to end by default. Do you have a source to this?
Post reply on HN