Add Threema

[PLAYERUNKNOWNHatsune01]

I hoping you guys can take a look in Threema. I wonder why Threema wasn't in Real-Time communication

https://threema.ch/en/

[efb4f5ff-1298-471a-8973-3d47447115dc]

this is probably the reason why it isnt listed
https://github.com/privacyguides/privacyguides.org/discussions/872#discussioncomment-2499145

[PLAYERUNKNOWNHatsune01]

Ohh then why Session is included? Session ditch Forward Secrecy too for their own crypto.

[ghost]

Yeah PFS isn't a requirement atm

[PLAYERUNKNOWNHatsune01]

Then why Threema isn't on the list? The only two problem of Threema is Centralize and no PFS that's it. Unlike Signal.

[dngray]

There was a rather lengthy discussion privacytools/privacytools.io#2162 and as far as I'm aware nothing has changed.

[PLAYERUNKNOWNHatsune01]

Ohh thanks! And to what I see you guys really favor Signal..... Oh well! I guess if I put my reason here I'm just gonna get ignored. Because clearly privacyguides really like Signal. Thanks 🙂

[flexagoon]

I guess if I put my reason here I'm just gonna get ignored

@PLAYERUNKNOWNHatsune01 you're always welcome to contribute to the discussion, you can say your reason, maybe it actually will change something

[samuel-lucas6]

Signal isn't perfect, but it's basically the best there is. I would argue its main problems are functionality related and whether their donation model is sustainable.

[825i]

Adding my comment here. There really is absolutely no reason why Threema is not at least on the list. It might not be perfect (no messenger is) but it's damn well better than Signal, jesus.

privacyguides/privacyguides.org#1445

Description

Affected Page:
Real-Time Communication

First of all, Privacyguides seems to recommend numerous services that cost money (eg. VPNs). So that can't be the reason that Threema (which is a buy-once service) is not recommended. You can buy a license with Bitcoin btw.

Secondly, the last time Signal was audited was in 2016. For Threema it was 2020. Threema has also been audited by 3 different companies.

Thirdly, Threema does not require a phone number, at all. In fact, it does not require ANY personally identifiable information to create an account whatsoever.

Fourthly, Threema can use it's own message delivery service. That is, it doesn't rely on Google Cloud Messages (GCM) protocol.

Fifthly, Signal is not GDPR compliant. Threema is.

There is a good comparison of messengers here: https://threema.ch/en/messenger-comparison

So why is Threema not even on the list? Furthermore, why is Signal the choice at the top of the list, when Session is arguably the best choice of them all from a privacy standpoint? As Session is basically Threema but entirely free. Though Session has not been audited at all.

Also: https://github.com/threema-ch
and: https://alethonews.com/2021/01/27/signal-the-encrypted-messenger-of-the-future-has-shady-links-to-us-national-security-interests/

[samuel-lucas6]

Threema is objectively worse than Signal from a protocol standpoint. Breaking down your points:

1. There's a big difference between VPNs and messengers. Most people don't use a VPN, whereas almost everyone under a certain age is messaging. Most VPNs rely on a subscription model, whereas almost all messengers are free. Therefore, people expect messengers to be free. Threema isn't expensive, but it's still something, and few people are going to go through the effort of paying via Bitcoin, which isn't 'anonymous' like the website suggests. Similarly, how do you convince your friends and family to sign up? Will they be paying with Bitcoin too? You have to convince your entire network to pay a fee to talk to you when there are other services you could use that cost nothing. You don't have that kind of problem with other paid services generally.

2. Signal was audited a while back that's true. However, Threema audits have missed or ignored or not covered things. Soatok is well respected when it comes to cryptography blog posts. Even if some of the things he mentions are more theoretical (NB I read that blog post and Threema's reply ages ago), it demonstrates bad decision making. By contrast, on the protocol side, Signal has had nothing but praise from what I've seen. Also, if there have been three audits, Threema's FAQ only lists two.

3. I agree that the phone number requirement is flawed. However, it's not a major problem outside the context of talking to strangers. Regarding Threema, you have to pay somehow, and almost everybody will be using an app store and paying by card or PayPal.

4. It seems to default to Google's push service, and they note some limitations with Threema push. I don't know anything about either though.

5. I think Signal is GDPR compliant, not that I know anything about GDPR either, so I may be wrong. However, they store virtually nothing, which has been proven in court cases.

6. Their messenger comparison page is misleading. They use the CLOUD Act to suggest Signal reveals a bunch of information when forced to, which is not the case.

7. For many reasons, some of which have been outlined above. Signal has a better reputation, Signal is free, and the Signal protocol is considered the gold standard and is used by other messengers. Session lacks various features Threema and Signal offer, but it has been audited.

8. Threema wasn't always open source, and that seems to be a Russia Today opinion piece, but I'm not going to read it now.

[ph00lt0]

One could argue that Signal is non-compliant with GDPR for the fact that it connects you to third party services of Google without consent, that is a bit far-stretched but technically this could be classified as a violation. Then the question becomes what are you defending and from whom? What is the risk of being connected to google for ReCaptcha do they get any data on you that endangers what you try to defend from? I personally think this risk is very limited, although I am also not happy with it. Using the Google Maps integration may be a larger problem.

May be good to add the latest news about Threema here: https://threema.ch/en/blog/posts/threema-libre
I still believe Threema to be offering weaker security and therefore also privacy than Signal does at this point.

[sith-on-mars]

Threema recently adopted a new encryption protocol 'lbex' which also supports PFS. Currently, it's only available on Android and the iOS version will be released soon. Also, PFS is Android only right now and it's not enabled by default, but this will be changed in the future.

Perhaps we should give Threema another chance once the new lbex protocol and PFS are adopted on both Android and iOS?

[dngray]

Perhaps we should give Threema another chance

We're not about recommending experimental software that hasn't been audited.

[sith-on-mars]

The new protocol definitely needs another audit before Privacy Guide reconsider it. However, I wouldn't say Threema is an experimental software. It has been around for quite a while and it's way more mature and feature-rich than Session and SimpleX.

[dngray]

I wouldn't say Threema is an experimental software

It most certainly is if the huge chunk responsible for keeping your messages private has been replaced by an entirely new protocol.

It has been around for quite a while and it's way more mature and feature-rich than Session and SimpleX.

Those features are irrelevant.

[PLAYERUNKNOWNHatsune01]

The new protocol definitely needs another audit before Privacy Guide reconsider it. However, I wouldn't say Threema is an experimental software. It has been around for quite a while and it's way more mature and feature-rich than Session and SimpleX.

Don't bother clearly this guy and everyone on this privacyguide clearly hate Threema and have bias to other messenger.