Seca 0.1.0 beta 3: Seca Link connects by itself

Beta. Seca is still in active development. The apps are usable every day, but rough edges remain and some things will change before 1.0. Keep a backup, and report problems in Issues.

Third public beta of the Seca suite: three communication apps for Android sharing one Material 3 Expressive design, with no Google dependency and no trackers. They run on any phone with Android 12 or newer; GrapheneOS is recommended, not required.

What's new

• Seca Link connects on its own. Between two phones that both have it, a conversation turns encrypted with nobody sending an invitation: an invisible data SMS, which a phone without Seca never shows, does it when the conversation opens or a message is exchanged. The conversation then says the moment it became a Seca Link one.
• And says when it stops. A contact who turns Seca Link off, or takes Seca off their phone, stops publishing their keys. Seca notices, tells you, writes it in the conversation, and what you send goes back to ordinary SMS instead of pretending to be encrypted.
• A lock on the photo of every conversation Seca Link carries, in the list.
• A contact's new phone brings a new key: only your side, the one that did not change phone, is told, and the safety number is there to compare.
• Keys that stay reachable. They are published again every five hours by the app's own listening service and read back from each relay: one that takes the keys and keeps nothing is no longer named to contacts, and a contact's keys are looked for on every relay Seca knows. A connection that fails retries on its own, ten minutes later and then further apart.
• Notifications are conversations again. With the contact's photo or initials, their place at the top of the shade and a reply field. Android was refusing them, because their picture came as a bitmap, and drew the app's icon instead.

The apps

APK
seca-contacts-0.1.0-beta3.apk	Seca Contacts: colored profiles shared with the suite, favorites, duplicate merging, your own card shared by QR code, vCard, encrypted backup. No Internet permission.
seca-phone-0.1.0-beta3.apk	Seca Phone: call screen showing the caller's profile, T9 search, telemarketing blocking (France), profiles blocked for a chosen time, a remembered SIM for each contact, decline with a message, named Bluetooth outputs. No Internet permission.
seca-messages-0.1.0-beta3.apk	Seca Messages: texts in the colors of profiles, scheduled messages, verification codes erased after a delay, advertising texts filed away, and Seca Link.

Seca Link is end-to-end encrypted messaging between Seca phones, with no account and no Seca server: libsignal encryption (PQXDH), public Nostr relays, connection by SMS invitation or by scanning a QR code in person, read receipts, reactions, replies, encrypted photos and voice messages, disappearing messages, a Tor option with Orbot. Off by default.

From the settings of any of the three apps, the suite backup gathers contacts and profiles, call history and filtering, texts, conversations and settings into a single encrypted file.

Install

1. Download the three APKs below. Each works on its own, but they are made to go together.
2. Install them (Android 12 or newer). Android asks you to allow installs from your browser or file manager.
3. Choose Seca Phone as the Phone app and Seca Messages as the SMS app: each app offers it when it opens.

Coming from beta 1 or 2? Install over it: every beta is signed with the same key, nothing is lost.

Not on GrapheneOS? Let Seca Messages run in the background when it asks, so Seca Link messages arrive in time. Some brands add their own battery or autostart settings on top: dontkillmyapp.com explains them brand by brand.

Known limits

• MMS (carrier multimedia messages) are not supported yet.
• Seca Link only works between two phones with Seca Messages, and relies on public Nostr relays run by volunteers.
• Seca Link photos and voice messages: about 3 MB each, 5 minutes per voice message.
• Seca Link keys never leave the phone and are in no backup: on a new phone, contacts have to be connected again.
• Not on F-Droid or IzzyOnDroid yet.
• Tested mostly on a Pixel 9 with GrapheneOS: reports from other phones are very welcome.

Verify the files

The three APKs are signed with the same certificate. Its SHA-256 fingerprint:

2F:DE:A7:B4:6B:EF:FE:16:45:9B:B4:DC:DD:34:DB:5E:0C:B9:12:27:4A:5E:B6:28:E4:B0:D8:A5:96:21:17:90

To check it: apksigner verify --print-certs seca-messages-0.1.0-beta3.apk must print 2fdea7b46beffe16459bb4dcdd34db5e0cb912274a5eb628e4b0d8a596211790.

SHA-256 of the files:

4880b1679624b9aea935426052334b04e26ae1100a6e000c654ec812a69d43ac seca-contacts-0.1.0-beta3.apk
932be289ab90bff7d30541768995826341d83b3784710095005d7bc150f1ca47 seca-messages-0.1.0-beta3.apk
9178707b5c1dad377ab879636203c52f2dc3605bb819b9cc6643b6031d5d324e seca-phone-0.1.0-beta3.apk

Source code under the GPL-3.0-or-later license.