The following is a cross-post from my mastodon thread
In the wake of metas enshitiffication I have seen people recommend Signal and Matrix as private open source alternatives to meta products. In the following thread I will outline how if your goal is software freedom anti surveillance and anti censorship the best option for direct and group messaging is neither Signal nor Matrix but instead the up and coming https://simplex.chat/
Signal is centralised meaning its vulnerable to censorship it almost got backdoored by uks online safety bill and that bill still has a damocles sword clause hanging over signal. Signal is also not anonymous, your account is linked to you through your phone number, if your contacts are compromised then your conversations can easily be linked back to you and your contacts all be correlated. In contrast simplex is like having “a burner phone for every contact” meaning even if one contact is correlated you have no consistent identity that can be compromised by default. Also simplex has a custom onion routing protocol to hide your ip from relay servers by default and it makes it very easy to connect over tor if simplex is blocked in your country im pretty sure signal doesnt do that. Matrix has been floated as potentially being a decentralised and e2ee open source alternative to Signal, but Signal shares one massive pro with SimpleX which is that both have post quantum encryption meaning that quantum computers that many researchers say are a few short years away from being able to decrypt all historical data that is encrypted using classical techniques ie not post-quantum encryption - such as the private messages you are sending across matrix today Afaik Matrix currently has no plans to add post quantum (PQ) encryption today and previously they were relying on it being implemented in MLS a standard that Matrix has been trying to adapt to their decentralised framework for years with stagnant process. Whats more afaict the motion to add PQ to MLS quietly expired and wasn’t renewed so it’s likely not coming any time soon. SimpleX has PQ on top of their classical encryption implemented and working today and you can download the app and have PQ rn (the additional classical encryption is insurance in case it turns out PQ has some classical attack vector, hybrid encryption is recommended by sec researchers at this stage) In conclusion both Signal and SimpleX are PQ unlike matrix but SimpleX and Matrix are decentralised and less vulnerable to censorship than Signal, while only SimpleX supports Tor connections and protects ur IP with or without Tor, and has no persistent unique identifier creating a “burner phone for every contact” scenario where compromised contacts cant necessarily be used to correlate ur other contacts/groups simply by looking at ur phone number/username in those groups
Heres some evidence and argumentation to support building post quantum encryption now, state and capital are hoovering up encrypted data rn to decrypt for profit as soon as it becomes cheap enough to do so with quantum computers https://www.youtube.com/watch?v=-UrdExQW0cs
And here’s the best explainer of SimpleX on youtube, sorry about the racist thumbnail the guys a right winger but his knowledge on OPSEC is valuable. If you don’t know why the thumbnail is racist search “Terry Davis glow in dark” (the search results for which I have to give a racist slur cw for but theres no slurs in this video) https://www.youtube.com/watch?v=0cRu98XSap0
You can hide your number on Signal so people can’t start conversations with you unless they have your QR code/link.
But even if you leave it visible… it’s really not that big a deal. Tbh, thats a good feature if you want to use Signal as a way for people you don’t often interact with to securely communicate if they have your phone number but can’t utilize encrypted RCS. Once Apple gets on board with encryption then it’s less important for Signal to fill that gap for casual conversation.
Signal may not be perfect for all use cases. But it’s pretty easy to navigate for the normies and its got most of the features people would miss from whatsapp/facebook messenger. I got my family converted to Signal this week from facebook messenger and it went rather smoothly. Plus, Signal has been around for a long time. Even some among my less tech-literate family had already used it in the past, but everyone had heard of it so it was an easy sell.
The reality of communication nowadays is that there is no one size fits all solution. Signal, XMPP, Matrix, whatever else all have their pros/cons.
I know there’s been a lot more discussion around SimpleX lately, but tbh, the sudden noise about it + the VC backing just feels more like a coordinated advertising campaign and that makes me less interested in it.