The following is a cross-post from my mastodon thread
In the wake of metas enshitiffication I have seen people recommend Signal and Matrix as private open source alternatives to meta products. In the following thread I will outline how if your goal is software freedom anti surveillance and anti censorship the best option for direct and group messaging is neither Signal nor Matrix but instead the up and coming https://simplex.chat/
Signal is centralised meaning its vulnerable to censorship it almost got backdoored by uks online safety bill and that bill still has a damocles sword clause hanging over signal. Signal is also not anonymous, your account is linked to you through your phone number, if your contacts are compromised then your conversations can easily be linked back to you and your contacts all be correlated. In contrast simplex is like having “a burner phone for every contact” meaning even if one contact is correlated you have no consistent identity that can be compromised by default. Also simplex has a custom onion routing protocol to hide your ip from relay servers by default and it makes it very easy to connect over tor if simplex is blocked in your country im pretty sure signal doesnt do that. Matrix has been floated as potentially being a decentralised and e2ee open source alternative to Signal, but Signal shares one massive pro with SimpleX which is that both have post quantum encryption meaning that quantum computers that many researchers say are a few short years away from being able to decrypt all historical data that is encrypted using classical techniques ie not post-quantum encryption - such as the private messages you are sending across matrix today Afaik Matrix currently has no plans to add post quantum (PQ) encryption today and previously they were relying on it being implemented in MLS a standard that Matrix has been trying to adapt to their decentralised framework for years with stagnant process. Whats more afaict the motion to add PQ to MLS quietly expired and wasn’t renewed so it’s likely not coming any time soon. SimpleX has PQ on top of their classical encryption implemented and working today and you can download the app and have PQ rn (the additional classical encryption is insurance in case it turns out PQ has some classical attack vector, hybrid encryption is recommended by sec researchers at this stage) In conclusion both Signal and SimpleX are PQ unlike matrix but SimpleX and Matrix are decentralised and less vulnerable to censorship than Signal, while only SimpleX supports Tor connections and protects ur IP with or without Tor, and has no persistent unique identifier creating a “burner phone for every contact” scenario where compromised contacts cant necessarily be used to correlate ur other contacts/groups simply by looking at ur phone number/username in those groups
Heres some evidence and argumentation to support building post quantum encryption now, state and capital are hoovering up encrypted data rn to decrypt for profit as soon as it becomes cheap enough to do so with quantum computers https://www.youtube.com/watch?v=-UrdExQW0cs
And here’s the best explainer of SimpleX on youtube, sorry about the racist thumbnail the guys a right winger but his knowledge on OPSEC is valuable. If you don’t know why the thumbnail is racist search “Terry Davis glow in dark” (the search results for which I have to give a racist slur cw for but theres no slurs in this video) https://www.youtube.com/watch?v=0cRu98XSap0
edit: see whitepaper for technical privacy details https://github.com/simplex-chat/simplexmq/blob/stable/protocol/overview-tjr.md
You can hide your number on Signal so people can’t start conversations with you unless they have your QR code/link.
But even if you leave it visible… it’s really not that big a deal. Tbh, thats a good feature if you want to use Signal as a way for people you don’t often interact with to securely communicate if they have your phone number but can’t utilize encrypted RCS. Once Apple gets on board with encryption then it’s less important for Signal to fill that gap for casual conversation.
Signal may not be perfect for all use cases. But it’s pretty easy to navigate for the normies and its got most of the features people would miss from whatsapp/facebook messenger. I got my family converted to Signal this week from facebook messenger and it went rather smoothly. Plus, Signal has been around for a long time. Even some among my less tech-literate family had already used it in the past, but everyone had heard of it so it was an easy sell.
The reality of communication nowadays is that there is no one size fits all solution. Signal, XMPP, Matrix, whatever else all have their pros/cons.
I know there’s been a lot more discussion around SimpleX lately, but tbh, the sudden noise about it + the VC backing just feels more like a coordinated advertising campaign and that makes me less interested in it.
I understand the skepticism, the owner evgeny is a right wing conspiracy person but it has actually already had a security review you might be interested in https://simplex.chat/blog/20241014-simplex-network-v6-1-security-review-better-calls-user-experience.html also because of the decentralised design it is easier to run a simplex relay than a matrix homeserver for example hackliberty.net runs private relays for simplex. All in all I think you’re right to be skeptical of a for profit enterprise but evgeny has said several times they have no intention to profit from user data, they recognise that privacy and anonymity is p much their only selling point so theyve said they want to make profit selling consultations and techniocal expertise to large corporations, kinda like how redhat “sells linux” i guess https://simplex.chat/blog/20240516-simplex-redefining-privacy-hard-choices.html as an anarchocommunist I dont agree with some of the views in this blogpost but I think reading it is a good way to dispell some of the skepticism