Mal's avatar
Mal 3 months ago
Simplex, Session, Signal, or Bitchat? #asknostr #privacy

Replies (19)

Uncle_Mack's avatar
Uncle_Mack 3 months ago
Me I have signal but hardly use it, Bitchat is just fun and built in mesh network is awesome.
Most of them will say bitchat because they are dick suckers who don't read protocols & don't understand the difference. They only care about who made it. But yeah lets see what they say.
Theres multiple types of mesh networks & the good ones do not require bluetooth or location to be on. Bluetooth networking only encourages this. When their coordinating at the job. image Using Bluetooth Technology!
Mal's avatar
Mal 3 months ago
I second this notion 😂
For privacy session can't be beat. So, whats wrong? Simplex: Leaks your IP and needs the host to be online. Signal: Not decentral Bitchat: Thats more like IRC than DM and its location / relay based. Nostr DM's: Various standards and if done wrong your metadata is very public. That leaves session. Session is completely metadata secure but doesnt persistently store messages server side. Thats a plus and a con. It is decentralized although with a centralized bootstrap. Another one I personally use is Matrix. Element is a nice client for it but if you use Matrix avoid the main orgs server as its subject to UK law. You want a third party one, they all federate. On Matrix whatever homeservers are involved have the metadata but its end to end encrypted.
SimpleX is great if you only use one or two groups but want the ability to have unique identities for all of them. Some really great potential, too! Its main downsides are insane battery drain, long waits for chat to sync (especially if you're in a bunch of groups) and if you don't keep up with it daily, you'll be waiting 30+ minutes sometimes just for things to sync. Session is a really good option if you want anonymous and relatively ephemeral chat in a bunch of groups. Lacks the unique identities of SimpleX but doesn't take 20 years to sync. Main downsides are a lack of populated groups because of poor moderation controls which led to major DoS attacks and the spread of CSAM. They also removed perfect forward secrecy, which was a bad move with a bad excuse to justify it. Signal is generally the best option overall. Phenomenal feature set, everything just works, it's the ideal messenger if you're just trying to have private chats with people you trust to some degree. Plus, people underestimate its protection, as features like Sealed Sender make things even more private than many want to admit. Its primary downsides are simply the inability to be fully anonymous, as well as the fact that the network isn't decentralized like the other two... but that also means you don't deal with spam/DoS attacks nor do you have to wait for lengthy syncs. Can't speak on BitChat as I've never used it and really have no intentions to.
I take it from this answer you have not used simplex recently. Simplex does not take any time to retrieve messages you could be experiencing this issue if you were connected to some unofficial smp & xftp servers, if you use orbot, a vpn, or a private dns resolver. Theres many factors why you may be experiencing an issue retrieving your messages. You can always go to setting & restart after you've done all your changes to attempt again. As for the battery drainage issue this was recently fixed which has made a drastic improvement please update to the latest version 4.4.0. Session is not good because of the DoS attacks which keep happening because it's public knowledge that everything you do on session is tied to one private key & simplex in comparison generates a new key every message & contact rotating them. So even if someone did ddos simplex & somehow managed to perform a man in the middle attack & intercepted one private key the keys are constantly rotated & they would only get a partial hash meaning they couldn't intercept your messages or your contacts unlike session they can obtain everything of yours from that one private key. Signal is a CIA operation it's common sense if the US government is encouraging it the government would never really encourage a third party app or have these scandal stories of goverment files leaked over signal. Theres a plot going there & people who don't realize phone number required is a trap then I pity the foo. Bitchat is just a light irc but the tech behind it is only good for one purpose. When their coordinating at the job. image Using Bluetooth Technology! You can do your own research in discovering how bluetooth can be used as a sonar radar to track people in real time to the second of where they are exactly standing x & y coordinates. In comparison to all the open source chat apps simplex is the most private & secure chat app then all of them. Please do not take my word for it just because I said so please read the protocol on Simplex & compare it to the protocols of other open source apps if your a techie you will understand the technical terms & get why simplex is more secure. At the end of the day we all want to be able to chat without a big brother or the cops, feds, cia, nsa, tsa, & etc monitoring & logging everything. We can have that finally in simplex.
Session can be beat I can write so much here but I just wrote alot. Matrix is a bad open spurce chat the ui is nice but the encryption is shit theres tons of metadata leakage & it's funny chats encrypted but reactions arent. Anyone running a homeserver can use those web admin cp guis & see the ip address of anyone from any server. They can see every room you've joined & more. Matrix Element is a mess the only thing I like about it is threads & the media viewer in room settings when you hit upload.
Recently, yes, unless something major changed in the last week and a half. I take many precautions to ensure I only download official apps, but the issue still occurs, regardless of whether I use a raw connection, a VPN, Orbot... I've also tested it on PC, does the exact same there, so it's not just a phone issue. I definitely agre with and acknowledge the issues with Session and its DoS attacks. Even with that issue, I still manage to get messages quicker there than on SimpleX. I am going to very, very firmly disagree with your sentiment on Signal. It's baseless, has no grounding in fact. You might be skeptical of it, and that's fine, but it's outright FUD to say it's a CIA op. Also, if you research the government 'leaks', it's never due to the app itself. With cases such as Tucker Carlson, he didn't have great opsec. In the more recent government 'leaks', that was two-fold: usage of an unofficial, third-party app and someone invited someone else to a group chat they shouldn't have been in. As I said, in both cases, the 'leaks' were due to personal error, not the software itself. Moreover, the phone number requirement isn't actually as big of a deal as people make it out to be. I understand the arguments for why people don't like it, but Sealed Sender makes it a nonissue in terms of metadata. Unless both parties in a conversation are being very closely scrutinized by the feds, it's virtually impossible to track the metadata of a conversation or to know who is messaging whom. Even with close scrutiny, they'd have to essentially do what they do with Tor: look at both ends of the connection and correlate the traffic flow. That'd be possible for any messaging app, by the way. I'm not dissing BitChat, just not something I'm interested in and it also doesn't have the privacy protections that Signal, Session and SimpleX have. Decentralization is great (I'm very much in favor of it) but that doesn't automatically make it better for your privacy. Matrix is a prime example of this: decentralized, solid technology, but almost zero metadata protection for private messages and the way that homeservers communicate and archive data is concerning. Don't worry about me taking your word for it, I'm in cybersecurity as a career (though, admittedly, I'm entry-level at the moment) and have been researching this stuff even before I started moving into that career field. I respect your perspective and the time you put into this, but like I said: there are some areas that I fundamentally disagree with what you said.
In regards to signal you are right I never said it was the apps fault it was human error. But someone in that high of a position & knowing well aware the penalities of mishandling that kind of information on non-government controlled applications would have serious consequences. Nobody is going to have proof it's a cia op but we can observe & deduct from common sense the obvious. What I said isn't baseless All the articles of encouragement should be a clear clue theres a reason to be skeptic private e2ee has existed in many applications & i'm sure their aware of Simplex as well but they encourage this specific one why? You don't find it odd that FBI would encourage the public to trust signal & use it I would. Also a phone number tied to an account is dangerous you should look up the telecommunication act. They don't need to bypass encryption they just need to associate your number to the account in question just like a license id. As for the connection issues maybe it's your isp & where you are because I don't have these connection issues you are describing everything connects instantly & I get my messages instantly on simplex. I can only say make sure your on the latest. I hope you end up having a better experience & those issues do go away for you.
I mean, I don't trust the FBI as far as I can throw them but I'm also not the sort that thinks every little thing is part of a larger agenda. Regarding phone numbers, you can effectively throw a password ("Signal PIN") onto your Signal profile so that even if they have access to your phone number, the literal ONLY thing they're capable of getting from that information is simply when you were online last, and the time that you send a message. They really can't find out much other than that if you have a Signal PIN, massively thanks to Sealed Sender.
I take it you didn't read the act. Signal pin does not matter When they can screen mirror & key log. It's not about direct hacking or bypassing theres other ways to circumvent this stuff. I don't think everythings part of a larger agenda but recommending what chat to use does sound suspicious you know.
I know what it entails but I'm also aware that Signal's metadata protections mitigate any real problems that it presents.