Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Specification of app features for comparison with other security focused messengers #2615

Closed
ghost opened this issue Apr 20, 2022 · 2 comments

Comments

@ghost
Copy link

ghost commented Apr 20, 2022

Here is the full list of questions used in this comparison, which currently does not include RetroShare. I was able to fill out some of them already. It would be great to hear from you guys and receive some answers.

About the app
Price: free
Repository: GitHub
Software license: Multiple
Availability: Github, F-Droid
Client is available since: 2006
Comes without proprietary libraries:

Platforms
Available on Android: Yes
Available on iOS: No
Available on Windows: Yes
Available on macOS: Yes
Available on Linux: Yes
Available via web client: No

Privacy / Security / Anonymity
Encryption protocol / library: PGP
Cryptographic primitives:
End-to-end encryption:
End-to-end encrypted 2-user chat:
End-to-end encrypted group chat:
E2EE is turned on by default:
Local message encryption:
Perfect forward secrecy is enforced: Yes
Certificate pinning is used:
Directory service can be modified to enable a MITM attack:
Contact verification possible: Yes
Contact can be added without needing to trust a directory server:
Notification if contact's fingerprint changes:
Contact's fingerprints can be verified manually: Yes
Avoids / Protects metadata during use:
Native Tor support: Yes
Last security audit:
Tracker integration (Exodus):
Use without phone number possible: Yes
Use without Google Play Services possible: Yes
Reasonably useful without sharing the contact list: Yes

Ecosystem and developers
Centralized / Federated / Decentralized: decentralized Peer-to-peer
Infrastructure hosting: (no servers)
Open Source server: (no servers)
Transparency report:
Legal jurisdiction:
Jurisdiction of the devs/company:
Funding:

Functionality
Visible if contacts are online: Yes
Audio-/Video-chats: Yes (experimental)
Group chats: Yes
Voice messages: No
File exchange: Yes
Read receipts: No
Editing sent messages: No
Self-destructing messages: No
Deleting sent messages locally: Yes
Deleting sent messages for both (2 user chat): No
Synchronization between multiple devices:

Backup
Storage location:
Automated:
Encrypted:

@csoler
Copy link
Contributor

csoler commented Apr 20, 2022

Thx for your interest in the software. Here's a list of elements (only the ones that need fixing):

About the app
Comes without proprietary libraries: yes
Available via web client: No (Partially. The web app is not complete yet).

Privacy / Security / Anonymity
Encryption protocol / library: TLS 1.3 (OpenSSL)
Cryptographic primitives: TLS_AES_256_GCM_SHA384, Chacha20+poly1305
End-to-end encryption: yes
End-to-end encrypted 2-user chat: yes
End-to-end encrypted group chat: no
E2EE is turned on by default: yes
Local message encryption: yes
Perfect forward secrecy is enforced: Yes
Certificate pinning is used: no
Directory service can be modified to enable a MITM attack: no
Contact verification possible: Yes
Contact can be added without needing to trust a directory server: ?
Notification if contact's fingerprint changes: yes (stops connecting to those friends)
Contact's fingerprints can be verified manually: Yes
Avoids / Protects metadata during use: yes
Native Tor support: Yes
Last security audit: 2017? (by Elttam)
Tracker integration (Exodus):
Use without phone number possible: Yes
Use without Google Play Services possible: Yes
Reasonably useful without sharing the contact list: Yes

Ecosystem and developers
Centralized / Federated / Decentralized: decentralized Peer-to-peer
Infrastructure hosting: (no servers)
Open Source server: (no servers)
Transparency report: blog, open source code, external (incomplete) doc, research report.
Legal jurisdiction: none
Jurisdiction of the devs/company: none
Funding: Mostly none, except Google summer of code

Functionality

Read receipts: Yes
Deleting sent messages locally: Yes
Synchronization between multiple devices: No

Backup
Storage location: local (encrypted) old versions of config and data files.
Automated: yes
Encrypted: yes

@ghost
Copy link
Author

ghost commented Apr 21, 2022

Thank you very much for your fast response and the time you took. I appreciate it!

@ghost ghost closed this as completed Apr 21, 2022
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant