Preparing for a Prototype

[levi]

Depends what you mean in terms of text messaging I guess. A dumb phone will do SMS, and Askarus already showed us using whatsapp on his prototype, although I don't know if that will work with a dumb phone connected to your Pyra to be fair. Discord and Telegram and Slack and IG should work out of the box with debian I'd have thought, but I don't really know the extent of what's out there these days.

 

[pmprog]

whatsapp on his prototype

How does that one work? I must have missed that

 

[docbroke]

How does that one work? I must have missed that

That was whatsapp web running in some app (like https://meetfranz.com/)

 

[Askarus]

I'm using Telegram on my Pyra since 2 years now.
I have no speakers and non working audio, so I don't know how calls will be but the few calls I make are Telegram calls.
So Pyra will do everything I need except those people who refuse using Telegram instead of Whatsapp as the later needs to be always connected to a phone.

So unless you need SMS and traditional phone functionality it will work out of the box for you.

BUT there is one big drawback: battery
Pyra does not have a proper power saving and standby mode yet.
And that is why I don't use my prototype much. I can't leave it on standby/leave it on the whole day while my phone is already running and connected to WLAN.

 

[Grench]

Are any of these encrypted messaging systems open source and or free?

 

[Askarus]

Are any of these encrypted messaging systems open source and or free?

tl;dr
Telegram has an open source frontend and clients exists for all major systems.
There is also Signal which is fully open source and the go-to solution if you are heavily privacy focused.
WhatsApp is closed and your phone must always be connected to the internet to access it via the Web. It has no real App, only an electron App which is the web version.

Signal is the best, as it's open source and uses end-to-end encryption.
The Signal guys are the one who invented the encryption Whatsapp is using now.
They don't store anything.
Their Encryption algorithm is fully transparent and open.

Then there is Telegram.
It's cloud based and stores your messages on its servers.
It's made by 2 Russian brothers who worked (or created) the biggest social media site there.
They left and made a messenger that is non-profit and funded by the millions (or so) they made.
You can also use secret chats and use end-to-end encryption.
Because of the cloud based storage you can upload files (up to 100GB think) and access it from any device connected.
The backend is closed, but the frontend has an open API and there are open source clients for Linux (even a command line tool exists).
They use their own encryption that is not open. So you need to trust them that it's secure.
But the Russian government banned Telegram for several months as they refused to give away user data.
People used VPN or other mechanisms to still access the messenger and the government released the ban later I think.
That speaks for itself in my opinion.
It's much more trustworthy in my opinion than WhatsApp, but less than Signal.
A lot more people use Telegram instead of Signal.

I don't recommend WhatsApp, as it collects your metadata and shares it with Facebook.
It has no open frontend/API and you have t use the Web-App to access it not from your Phone.
There is an App, but it's eelctron based, so it's the same as the web page.
Your Phone must be connected to the internet, as WhatsApp does not store your data on any servers.
That's the only good thing about them if you are privacy concerned, but it's extremely inconvenient to use.
And the metadata is enough for them to know so much about you.
I have WhatsApp but I'm rarely using it. Mostly for my university group.
After my studies I want to delete it as most people I have contact with have Telegram now

The others are even more niece than Signal and I don't consider them an alternative for me.
There is Threema which claims that they are privacy focused, but they are not open and you need to pay for their service. So no.

I hope that helps you and others who are interested in the subject.
If you have more questions feel free to ask.
I did some research about the topic in the past

 

[gpsqueeek]

XMPP and Matrix are both fully end to end encrypted, FLOSS (client and server), and decentralized, and therefore much more advisable in my opinion.
I use XMPP and easily configured it on my non-tech family's smartphones (Conversation or Pix-Art on android, there is a app for IOS too), and of course it works fine on PCs too (Gajim or Dino for example)

 

[Letalis Sonus]

XMPP

...is a protocol specification that does not define any kind of encryption, it has to be implemented around it. SSL encryption of the connection itself is common but not required (the server to server connection, which is outside of your control, may still be unencrypted!), any kind of E2E encryption has to be implemented as an extension on top of it. There are several E2E extensions that are incompatible with each other, like OMEMO and OTR.

XMPP extensions that implement audio and video chat usually do not encrypt their data streams.

 

[levi]

There's also various clients that run the Tox protocol, and when I've tested them they work, I've just never been able to convince anyone else to run one. Who knows among Pyra users however?

 

[Djoga'Ro]

I have my eye on tox, too. People are probably missing some things, they still have on their todo list. Plus, securely getting in contact with each other is by far not as convenient. And there was an embezzlement scandal.
Still, I'm just waiting for them to implement some kind of buffering - last time I checked sender and receiver needed to be online at the same time for messages to pass - and some way you can be online with multiple devices using the same account. Or do they have it by now?

 

[levi]

According to wikipedia some clients do have an outgoing buffer, to use an emailish term. Stuff goes into a buffer if your recipient isn't online, and goes out the next time you're both online. Without a central server, there's pretty much no other way of doing it.

 

[Djoga'Ro]

Thought, they had finding a way around it on their agenda. ? I haven't put too much thought into it, maybe distributed buffering. Though, now that I'm thinking about it, I'm not sure, if metadata could then still be protected.

 

[docbroke]

There is delta chat. Which is basically messenger that you can use with your email address. Messages are saved in you email. There is no central server. So if your email is secure your chat is secure.

 

[levi]

Thought, they had finding a way around it on their agenda. ? I haven't put too much thought into it, maybe distributed buffering. Though, now that I'm thinking about it, I'm not sure, if metadata could then still be protected.

Well, I suppose they could farm it out to all of your friends as well, in case any of those are online with the intended recipient, but either you leave the id of the intended recipient in the clear or you leave it out, in which case it needs to be circulated to everyone that everyone knows to see if anyone can decrypt it, thus proving they're the intended recipient. That could probably be easily abused by attackers trying to stuff everyone's home directory full of supposedly encrypted messages that don't actually decrypt anywhere, but are fully synced by every new tor user when they connect to a networked user. Even if you leave the recipent id in the clear you could probably do that as well, and you might have more that one social circle in your contacts, and you don't actually want the fact you talk to that ID announced to your other circles. In many ways, especially if you have an always on computer like a raspberry pi or anything more powerful, there are less abusable ways to fix that.

 

[gpsqueeek]

any kind of E2E encryption has to be implemented as an extension on top of it.

I don't see the problem with that, all the clients I mentionned have omemo...

 

[Askarus]

For me it's important that I can use it to chat with lots of people.
It's hard enough to convince them to use Telegram which I consider more or less a mainstream App now.
MATRIX and XMPP are maybe a solution for people who like technology, but not for normal people.
It's so hard to convince people to install Telegram. It would be even harder with other apps.
Telegram is the most user friendly Messenger I've seen so far.

 

[Silent-Hunter]

Unfortunately not having an Android device means Signal is not a good option, as you need an Android or iOS device to activate the desktop app.

 

[Letalis Sonus]

I don't see the problem with that, all the clients I mentionned have omemo...

But you can't ensure that everyone you contact uses it as well. Unless the developer explicitely makes the program XMPP-incompatible or does not implement server-to-server communication and enforces your server you can use it to chat with every other XMPP-based communication system. See the history of the Facebook chat and Google Talk for some examples.

If the client does not enforce E2E and throws an error on trying to contact anyone who does not use a client that supports the same extension, you might not be using any kind of encryption at all without noticing it.

 

[gpsqueeek]

But you can't ensure that everyone you contact uses it as well. Unless the developer explicitely makes the program XMPP-incompatible or does not implement server-to-server communication and enforces your server you can use it to chat with every other XMPP-based communication system. See the history of the Facebook chat and Google Talk for some examples.

If the client does not enforce E2E and throws an error on trying to contact anyone who does not use a client that supports the same extension, you might not be using any kind of encryption at all without noticing it.

Well, pix-art blinks red everywhere when encryption is not enabled, it is pretty hard to miss it. It uses omemo by default, which is implemented in most clients nowadays (appart from movim because of the social network functionalities but you can use pix-art with a movim.eu account ant use the movim client only for the social network)
I admit that it is not as intuitive with gajim though, and I have not tried Dino enough to advise on it yet. But for android there is nothing to stop newbies using it really, if the aim is to chat and share pictures, in my opinion (which you have the right not to share of course)

 

[Djoga'Ro]

@levi I thought to rather buffer not in the P2P layer, but the onion routing layer, that is there to find your peers. With time to live and per client configurable buffer capacity and it being a distributed buffer (certain level of redundancy, but limited). The buffer may still be rendered useless by lorem ipsum-ing it shut, but you'd have to clog the hole buffer and couldn't block certain senders or recepients or social circle selectivly.