Some of you may have heard of #simplex which likes to elevate itself as "the first messenger without user-ids" ... a goal, similar to ours, of not letting the transport layer know about who talks. Only we are doing it in the email system, fully interoperable with tens of thousands of existing email servers and other #openpgp endpoints. The email system is much more than SMTP/IMAP or even openpgp btw ... there is plenty of room for radical shifts and new takes. We are just starting :)

I got nothing for Signal. I used my brother's phone number but the 6 digit verification number just doesn't come.. He doesn't even know what Signal app is, so I doubt he used his phone number to sign up.

Guess this isn't the day to meddle with Signal. "No Signal" I guess :(

I'mma stick with SimpleX chat. This and the email. I dunno about Matrix+Element though

@scy They're all pretty bad. Threema has some major issues with their encryption protocol: https://infosec.exchange/@Fiona@blahaj.zone/114083506772906117

Delta Chat outright lacks forward secrecy, and also doesn't use post-quantum cryptography.

XMPP and IRC are a mess, and essentially unusable for less technical users.
When considering or recommending a messenger, always ask yourself: Would your grandma be able to use it? If she encountered some issue, would she be able to find someone, other than you, who could fix it? That unfortunately rules out a bunch of messengers.

I think best option is to use the @mollyim client for Signal. The second best choice would be @simplex

@Tutanota Currently we are using #session and exploring #simplex
Thank you tutanota!!

@feralthoughts @sarahjamielewis @dazo @ambiguous_yelp @light

> you say that #Tor relays should be required to sign agreements “prohibiting data collection and sharing”. Does this apply to #SimpleX relays?

Yes. It's in Privacy policy.

> 1-4.

Those that are preset operators (SimpleX Chat and Flux) - yes. We don't have a mechanism for the conditions for custom operators - it's coming.

@simplex

Will #SimpleX be providing a warrant canary? Or any other form of disclosure about legal demands for data on its users?

Will such disclosures also cover demands received by your relay providers? Do your relay providers have a legal obligation to provide SimpleX with this information?

@sarahjamielewis @dazo @ambiguous_yelp @light

@simplex

What defences does #SimpleX have against some law enforcement agency legally demanding and getting access to piecemeal metadata stored by all of its relay providers, and then putting it all together to the extent possible to get a picture of the network?

@sarahjamielewis @dazo @ambiguous_yelp @light

(continues)

@simplex

If a country’s jurisdiction empowers courts to order a relay operator to share metadata with law enforcement, what good is the relay operator’s legal agreement with #SimpleX, or with SimpleX users, stating that they won’t share metadata with anyone?

Most likely, the operator will have simply written an exception in the agreement itself enabling it to comply with court orders.

@sarahjamielewis @dazo @ambiguous_yelp @light

(continues)

@simplex

In

https://mastodon.social/@simplex/114002839284531491

you say that #Tor relays should be required to sign agreements “prohibiting data collection and sharing”.

Does this apply to #SimpleX relays? Specifically, are there legal agreements “prohibiting data collection and sharing” between
1. All relay operators deployed by SimpleX?
2. SimpleX and its relay operators?
3. SimpleX users and SimpleX relay operators?
4. SimpleX and its users?

@sarahjamielewis @dazo @ambiguous_yelp @light

(continues)

@simplex

A comment on your assertion about #SimpleX relay independence:

Is there a documented method for a user, or for an (independent) expert, to validate that the relays are independent, and can stay independent in the face of legal demands/threats?

If not, then users have no option but to trust SimpleX’s assertion about relay independence.

@sarahjamielewis @dazo @ambiguous_yelp @light

(continues)

@simplex

Your claim of deploying relays operated by independent providers does not invalidate my assertion that users need to trust #SimpleX and its relay providers, just like in case of other messengers with intermediary servers.

The "Trust in Servers" section in your own whitepaper says:

“Although end-to-end encryption is always present, users place a degree of trust in servers they connect to.”

So what you are arguing against?

@sarahjamielewis @dazo @ambiguous_yelp @light

(continues)