Given the recent Telegram scandal, we've updated our review of WhatsApp alternatives. 👉 https://tuta.com/de/blog/best-whatsapp-alternatives-privacy
What's your take? Should we drop Telegram completely? 🤔
Which is your favorite replacement for WhatsApp?
@Tutanota > Should we drop Telegram completely?
Yes.
It's extremely generous to say an app that requires providing your phone number is "anonymous", especially while giving an app that doesn't require any PII the exact same rating. 🧐
A group of Swiss researchers have published an impressive security analysis of Threema. We provide an extensive cryptographic analysis of Threema, a Swiss-based encrypted messaging application with more than 10 million users and 7000 corporate customers. We present seven different attacks against the protocol in three different threat models. As one example, we present a cross-protocol attack which breaks authentication in Threema and which exploits the lack of proper key separation between different sub-protocols. As another, we demonstrate a compression-based side-channel attack that recovers users’ long-term private keys through observation of the size of Threema encrypted back-ups. We discuss remediations for our attacks and draw three wider lessons for developers of secure protocols...
@Orca @Tutanota I was about to talk about this research work. The researchers have been interviewed by @nadim:
Cryptography FM: Episode 22: Three Lessons from Threema: Breaking a Secure Messenger!
Episode webpage: https://www.cryptography.fm/22
Threema is a Swiss encrypted messaging application. It has more than 10 million users and more than 7000 on-premise customers. Prominent users of Threema include the Swiss Government and the Swiss Army, as well as the current Chancellor of Germany, Olaf Scholz. Threema has been widely advertised as a secure alternative to other messengers. Kenny, Kien and Matteo from the ETH Zurich Applied Cryptography Group present seven attacks against the cryptographic protocols used by Threema, in three distinct threat models. All the attacks are accompanied by proof-of-concept implementations that demonstrate their feasibility in practice.
@Tutanota I see a big error to call messengers like Telegram or Signal to be "anonymous" when they require at least an active SIM card to set up an account
Getting an anonymous SIM is impossible in most countries now
@gkcan
My red line is earlier, that i dont want to verify with name; address; face photo to get a SIM card that links together all i ever do in my life
Very different threat model
If i would have an anonymous SIM card (or a more than one for seperate parts of work and personal life) i would have not so many issues to share their numbers with selected peer groups
@Tutanota I wouldn't call signal anonymous, as it requires text message activation. The move to usernames was a huge improvement and makes it *possible* to use it anonymously, but I would guess most people don't.
That said, nice infographic! Glad to have a friendly survey glance of cool, privacy-focused, technologies.
@Tutanota The most salient property is probably governance model and diversity of funding. Telegram can be leveraged easier because it is privately owned and top-down. It is harder to pressure an elected board esp. if members are in different countries. The technical component has to be solid, but that doesn't mean much if one person controls everything; c.f. the xz backdoor.
I'd suggest replacing the 'anonymous' column with 'requires PII'.
I prefer Matrix, but haven't heard of some of these.
@Tutanota
You're missing a very important column: Is it possible to join the network by running your own SERVER?
Any network that depends on a centrally controlled server has a single point of failure. (Yes, this is a recommendation of Element/Matrix.)
Also, ideally, identities should be possible to migrate like they (sort of) are on Mastodon and friends.
@Tutanota signal is not anonymous. The phone number can be associated with your name.
I think part of the evaluation process should be the location of their servers.
Teleguard from swisscows has absolutely no association with your phone number and their servers are in Switzerland.
qui 
Tuta
tekhne
bazil ⏚
ulixes
tootbrute
stavpup
Adam Wysokiński
Guy on the run
Kaya 
🇪🇪
tethre
Foxle
Jacket
nictakiego
Adam
Pyra
Orca 🌻 | 🎀 | 🪁 | 🏴🏳️⚧️
Skyper 💻🎧☕📖
Simon
SK
Laberpferd
Gurleen K
KAMØF
Luc
Angelo Schirinzi
shrugg1e
AdventureTense
notsoloud
Mbingu
s3nnet.de
Cwr1981
Vibuda Nimsara
Dominic Hunt
Olle Mille Andreassen