[jazzyjackson]

Still lame that they require phone number at all, it took them a long time to add usernames so you don't have to expose your phone number to a new contact. Still skeeves me out that the account is associated with a SIM at all.

[HNisCIS]

We need an established secure anonymous/subpoena-resistant chat app at this point. Signal is great for a minimal threat model but we're kinda past that now given everything going on.

Simplex was a decent option but they're going down the crypto rabbit hole and their project lead is...not someone who should be trusted by anyone in the crosshairs right now.

[integralid]

Can you explain more about simplex? I remember reading about it a while ago and being really impressed. Sad to hear the project is going downhill.

[heavyset_go]

Check out the developer/owner's social media, the chats they're in, and their responses to others and you'll see. They're much more interesting in crypto and politics than they are acting professional in public and towards others while representing their project and company.

It's not hard to do so, so if they're having difficulty doing that, what other simple things are they having difficulty with? Why would anyone hinge their safety and well being on the whims of such a person?

I say this as a person who bought into the initial concept, and who has used it myself.

[akimbostrawman]

>They're much more interesting in crypto and politics

I have yet to see any of that while just using the app. Do you think people owning a project should not be allowed to have and share there options about anything but the project?

[heavyset_go]

Do you think I'm allowed to criticize and not use an app based on my own judgment of the developer's behavior?

[maqp]

SimpleX front page lied by omission about it having no identifiers. The fine print threat model did not mention the server has access to your IP addresses, and the mitigation to create "decentralized" system of users talking via separate servers ran into the problem of there being two VPS companies hosting the entire public server infrastructure. These issues were major as SimpleX advertised itself as an improvement over Cwtch, which should've meant superset of metadata had been protected. But that obviously wasn't the case.

The CEO vanished from the discussion (again) so my proposals to improve ease of use of Tor never reached them. You can catch up on the discussion at https://discuss.privacyguides.net/t/simplex-vs-cwtch-who-is-...

[miroljub]

What do you use now? Catch? Briar? Tox?

I liked the SimpleX concept, but would prefer its relay server were replaced by Tor or i2p network.

And if they used Signal instead of NIH protocol.

Actually, the only unique SimpleX feature I really like is that it uses separate ids for every connection and group.

[maqp]

>What do you use now?

Signal mostly.

>separate ids for every connection and group

The thing is, there's Akamai and Runonflux, two companies hosting the entire public SimpleX infrastructure. If you're not using Tor and SimpleX Onion Services with your buddies, these two companies can perform end-to-end correlation attacks to spy on which IPs are conversing, and TelCos know which IPs belong to which customers at any given time. Mandatory data retention laws about the assigned IPs aren't rare.

[miroljub]

Yes, that's why I said I don't like their relays. It doesn't even have to be Akamai, you need to trust SimpleX first that not to track your IP. I'd rather use a messenger where something is not possible (or even hard) than trust.

As long as IP leaks are possible, I'd rather also use Signal, where at least the rest is battle tested and state of the art.

My concern with Signal is they'll either comply or move out of the EU with the incoming Chat Control, and I'd rather have a fully decentralized messenger with as few leaks as possible.

[akimbostrawman]

>so my proposals to improve ease of use of Tor never reached

Probably because it has always been trivial to proxy Tor with build in and supported socks5

[01HNNWZ0MV43FF]

Maybe DeltaChat?

[maqp]

No. https://delta.chat/en/help#pfs

[nanomonkey]

I agree, but you can mitigate that to some extent by using a phone number that is not linked to your identity.

Phreeli [https://www.phreeli.com/] allows you to get a cell number with just a zip code. They use ZKP (Zero Knowledge Proofs) for payment tracking.

[codedokode]

In my country, you cannot legally get a phone number not linked to the identity, and the prices are relatively high on the black market. Also, the phone discloses your location with pretty good precision, especially in US where everyone is living in their own house.

[sneak]

Signal accounts do not require a SIM. There is no requirement that the phone you use for running the app Signal has the phone number you use for Signal login.

My Signal number is a Google Voice number that has nothing to do with any mobile phone. The Google account has advanced protection turned on so you can’t port it or get the SMSes without a hardware login token.

[HNisCIS]

It's still associated with a credit card and your google account requires another phone number to create.

[the_gipsy]

In my country I cannot buy a SIM card / phone number without giving my full identification.

[extraduder_ire]

Can you buy a phone number from a different country? (genuinely curious, I live somewhere I can buy a sim card with cash, and saw some in the impulse-purchase section of a store earlier today)

[sneak]

So buy a number from a different country.

[codedokode]

But has something to do with a bank card you used to pay for it?

[jazzyjackson]

That's cool that there are phonenumbers without SIMs, my concern was more about SIM swap takeover. (Signal only guards this with a 4 digit PIN iirc)

[Zak]

The PIN can be longer than four digits. Signal also guards against this with safety numbers; if someone takes over an account, every contact will see that the safety number has changed and should consider that the account may be compromised until verifying out of band.

[codedokode]

Google Voice doesn't look like a safe option, your number can be taken away if you forget to pay or you can be banned for arbitrary reason without a way to appeal.