Skip to content

Comment on Ask HN: What encrypted chat application to choose?

Comments

First, know your adversary. Is it your ex-wife, your ISP, some disgruntled hosting provider employees, or law enforcement? That will help you narrow down your choices.

Second, for an email-like replacement, you may want to look into Bitmessage. It's decentralized, trustless, and end-to-end encrypted. Unfortunately, it may be vulnerable to some attacks: https://bitmessage.org/forum/index.php?topic=1666.15

For a live chat-like replacement, you may want to look into Tox. It is also decentralized, trustless, and end-to-end encrypted. It is designed to be a Skype replacement. However, this thread regarding a security audit and the software it uses is slightly concerning: https://github.com/irungentoo/toxcore/issues/121

Both Bitmessage and Tox are wet behind the ears, so-to-speak. PyBitmessage, the main client, is written in Python. As such, the proof of work needed to calculate for each message is not optimized. Attackers have written clients in C to take advantage of Python's weakness to flood the network. Until the main client is also written in C, and the PoW algorithm is designed to take advantage of it, I'm sure there will be other network flooding problems on the Bitmessage network.

uTox and Venom seem to be the most used Tox clients, but I have had trouble getting uTox and Venom to actually work with video. Further, when both parties are using uTox, in some situations, while my video and audio testing work fine, the other party cannot see me or cannot hear me. I use uTox for signing PGP keys, so I've used it a number of times, and it's probably 50% at this point when it Just Works.

Both Bitmessage and Tox, however, have not had a security audit of the code.

Also, OTR and PGP have proven to be reliable, stable, secure, and enjoy large communities. With PGP, you can end-to-end encrypt your email, and with OTR, you can end-to-end encrypt your live chat, although video and audio are not supported. It doesn't matter about your email or chat provider either, and software exists for Windows, Mac OS X, GNU/Linux, and BSD for both.

Freenode also offers TLS-supported IRC servers, including hidden servers on Tor. Although Tor has been getting some press lately of the FBI successfully taking down pedophiles and drug markets, these are all due to mistakes by the end users, and not insecurities with Tor itself. So, Freenode on Tor might be a good one-off solution, where you just need to chat quickly, without registering for accounts, and staying hidden. See https://freenode.net/irc_servers.shtml#tor

Finally, if you're not familiar with the EFF Secure Messaging Scorecard, you might want to take a look at it: https://www.eff.org/secure-messaging-scorecard. There are a lot of clients there, including the various security margins of each, so that might be of interest.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.