Kevin Karhan :verified:<p><span class="h-card" translate="no"><a href="https://mastodon.social/@sylv_a" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>sylv_a</span></a></span> personally, I'd recommend <a href="https://infosec.space/tags/XMPP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>XMPP</span></a>+<a href="https://infosec.space/tags/OMEMO" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>OMEMO</span></a> (and <a href="https://infosec.space/tags/PGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PGP</span></a>/MIME - encrypted <a href="https://infosec.space/tags/eMail" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>eMail</span></a>) for <em>real <a href="https://infosec.space/tags/E2EE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>E2EE</span></a></em> with <em><a href="https://infosec.space/tags/SelfCustody" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SelfCustody</span></a> of Keys</em> as well as actual <a href="https://infosec.space/tags/decentralization" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>decentralization</span></a>.</p><ul><li>All <a href="https://infosec.space/tags/SingleVendor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SingleVendor</span></a> and/or <a href="https://infosec.space/tags/SingleProvider" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SingleProvider</span></a> solutions are inherently insecure, if not due to <a href="https://infosec.space/tags/TechStack" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>TechStack</span></a> (i.e. using a <a href="https://infosec.space/tags/CDN" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CDN</span></a> like <a href="https://infosec.space/tags/ClownFlare" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ClownFlare</span></a> for app assets with <em>no valid reason</em>), <a href="https://infosec.space/tags/PII" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PII</span></a> (demaning a <a href="https://infosec.space/tags/PhoneNumber" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PhoneNumber</span></a> which oftentimes cannot be obtained <em>anonymously</em> for <em>no valod reason</em>!) or lack of <a href="https://infosec.space/tags/DataProtection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DataProtection</span></a> <a href="https://infosec.space/tags/Laws" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Laws</span></a> (i.e. <a href="https://infosec.space/tags/CloudAct" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CloudAct</span></a> is inherently incompatible with <a href="https://infosec.space/tags/GDPR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>GDPR</span></a> & <a href="https://infosec.space/tags/BDSG" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>BDSG</span></a>), it's due to the inherent risks of <a href="https://infosec.space/tags/centralization" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>centralization</span></a>.</li></ul><p>Cuz I <a href="https://web.archive.org/web/20220112020000/https://twitter.com/thegrugq/status/1085614812581715968" rel="nofollow noopener noreferrer" target="_blank">noone's gonna risk jailtime for (non-paying!) users</a> - it at all…</p><ul><li>Not even <span class="h-card" translate="no"><a href="https://mastodon.world/@Mer__edith" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>Mer__edith</span></a></span> !</li></ul><p>In fact I'd call U.S. MIL/INTEL as <em>"criminally incompetent"</em> if they didn't manage to plant <em>multiple people</em> inside <span class="h-card" translate="no"><a href="https://mastodon.world/@signalapp" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>signalapp</span></a></span> / <a href="https://infosec.space/tags/Signal" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Signal</span></a> or any other single-vendor / single-provider messenger. </p><ul><li>Cuz <a href="https://en.m.wikipedia.org/wiki/NOBUS" rel="nofollow noopener noreferrer" target="_blank"><em>if Signal wasn't</em></a> <a href="https://infosec.space/tags/NOBUS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>NOBUS</span></a>, they would've been shutdown/taken down/criminalized/hacked like <a href="https://infosec.space/tags/EncroChat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>EncroChat</span></a> and <a href="https://infosec.space/tags/SkyECC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SkyECC</span></a>.</li></ul><p>Personally, solutions like Signal & <a href="https://infosec.space/tags/Threema" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Threema</span></a> have a stench like <a href="https://infosec.space/tags/CryptoAG" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CryptoAG</span></a> / <a href="https://infosec.space/tags/MINERVA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>MINERVA</span></a> / <a href="https://infosec.space/tags/Rubikon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Rubikon</span></a> and <a href="https://infosec.space/tags/AN%C3%98M" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ANØM</span></a> / <a href="https://infosec.space/tags/OperationIronside" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>OperationIronside</span></a> / <a href="https://infosec.space/tags/OperationTr%C3%B8janShield" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>OperationTrøjanShield</span></a>.</p><ul><li></li></ul><p>By contrast: <a href="https://infosec.space/tags/OpenStandards" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>OpenStandards</span></a> like XMPP+OMEMO & PGP/MIME are <em>independently verifyable</em> and not dependent on on a single individual/organization for maintenance/survival/implementation/development.</p><ul><li>Also not depending on <a href="https://infosec.space/tags/GAFAMs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>GAFAMs</span></a> and/or <a href="https://infosec.space/tags/VCmoneyBurningParties" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>VCmoneyBurningParties</span></a> is way more sustainable long-term...</li></ul><p>Personally I'd still recommend <span class="h-card" translate="no"><a href="https://monocles.social/@monocles" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>monocles</span></a></span> / <a href="https://infosec.space/tags/monocles" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>monocles</span></a> with <a href="https://infosec.space/tags/monoclesChat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>monoclesChat</span></a> & <a href="https://infosec.space/tags/gajim" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>gajim</span></a>...</p>