SimpleX Chat – fully open-source, private messenger without any user IDs (not even random numbers) that allows self-hosted servers – v5.4 is released – link mobile and desktop apps via secure quantum resistant protocol, and much better groups! reddit / selfhosted ---------------------------------------------------------------------- epoberezkin · 2023-11-25 20:12 Hello all! Also in v5.4: * Many group improvements: * faster to join and more reliable. Once you upgrade to v5.4, join [the new users' group](https://simplex.chat/contact#/?v=1- 4&smp=smp%3A%2F%2FPQUV2eL0t7OStZOoAsPEV2QYWt4- xilbakvGUGOItUo%3D%40smp6.simplex.im%2Fos8FftfoV8zjb2T89fUEjJtF7y64p5a v%23%2F%3Fv%3D1-2%26dh%3DMCowBQYDK2VuAyEAQqMgh0fw2lPhjn3PDIEfAKA_E0- gf8Hr8zzhYnDivRs%253D%26srv%3Dbylepyau3ty4czmn77q4fglvperknl4bi2eb2fdy 2bh4jxtf32kf73yd.onion&data=%7B%22type%22%3A%22group%22%2C%22groupLink Id%22%3A%22lBPiveK2mjfUH43SN77R0w%3D%3D%22%7D) and find other groups in [SimpleX directory](https://simplex.chat/contact#/?v=1- 4&smp=smp%3A%2F%2Fu2dS9sG8nMNURyZwqASV4yROM28Er0luVTx5X1CsMrU%3D%40smp 4.simplex.im%2FeXSPwqTkKyDO3px4fLf1wx3MvPdjdLW3%23%2F%3Fv%3D1- 2%26dh%3DMCowBQYDK2VuAyEAaiv6MkMH44L2TcYrt_CsX3ZvM11WgbMEUn0hkIKTOho%2 53D%26srv%3Do5vmywmrnaxalvz6wi3zicyftgio6psuvyniis6gco6bp6ekl4cqj4id.o nion). * create groups with incognito profile. * block group members to reduce noise. * prohibit files and media in a group. * Better calls: faster to connect, with screen sharing on desktop. * Many other fixes and improvements. Read more in the post: [https://simplex.chat/blog/20231125-simplex- chat-v5-4-link-mobile-desktop-quantum-resistant-better- groups.html](https://simplex.chat/blog/20231125-simplex- chat-v5-4-link-mobile-desktop-quantum-resistant-better-groups.html) Install the apps via [downloads page](https://simplex.chat/downloads/). Please ask any questions about SimpleX Chat in the comments! Some common questions: [Was SimpleX Chat audited](https://simplex.chat/blog/20221108-simplex- chat-v4.2-security-audit-new-website.html)? [Why user IDs are bad for privacy](https://simplex.chat/#why-ids-bad- for-privacy)? [How SimpleX delivers messages without user profile IDs](https://simplex.chat/#how-simplex-works)? [How SimpleX is different from Session, Matrix, Signal, etc.](https://github.com/simplex-chat/simplex- chat/blob/stable/README.md#frequently-asked-questions)? ---------------------------------------------------------------------- No_Requirement_64OO · 2023-11-25 20:55 Is it selfhostable? ---------------------------------------------------------------------- epoberezkin · 2023-11-25 21:28 yes, you can self-host the servers! https://simplex.chat/docs/server.html ---------------------------------------------------------------------- RedditSlayer2020 · 2023-11-25 23:10 About the auditing. I don't trust any expertise from a US based security company with ties to the government. ---------------------------------------------------------------------- gyzerok · 2023-11-26 05:07 Not sure, but “no ids” sounds like pure marketing. It’s not possible to not have one. If you can’t differentiate users, you can render chat history properly. ---------------------------------------------------------------------- rnimmer · 2023-11-26 05:17 No EFF audit? There is a history of (apps like this)[https://www.justice.gov/usao-sdca/pr/fbi-s-encrypted-phone- platform-infiltrated-hundreds-criminal-syndicates-result-massive] being created by big bro. Just use Signal. ---------------------------------------------------------------------- adamshand · 2023-11-26 07:59 They've been posting here for a couple years and the software has been getting steadily better that whole time. I haven't read the whitepaper in detail, but they seem legit. https://simplex.chat/#how-simplex-works ---------------------------------------------------------------------- adamshand · 2023-11-26 08:01 At least Simplex is open source and you can run your own infrastructure if you want. ---------------------------------------------------------------------- [deleted] · 2023-11-26 09:27 [removed] ---------------------------------------------------------------------- epoberezkin · 2023-11-26 10:20 It's been audited by Trail of Bits, and there will be another audit next year. Why do you need EFF audit? ---------------------------------------------------------------------- epoberezkin · 2023-11-26 10:22 That's absolutely possible if you assign IDs to connections between users and not to the users themselves - NIST calls it "pairwise anonymous identifiers" and recommends it as privacy by design approach, but it's not been adopted widely. This way, users can communicate without the network being able to observe or count users. Check "how it works" section on the website. ---------------------------------------------------------------------- 7ionwor · 2023-11-26 12:11 " [...] uses temporary anonymous pairwise identifiers of message queues, separate for each of your connections — there are no long term identifiers. " Meaning what? Fancy talk. ---------------------------------------------------------------------- epoberezkin · 2023-11-26 14:38 Meaning that instead of assigning identifiers to the users, as all other communication networks do, they are assigned to connections between the users. Check out "how it works" section on the site. Also see my talk at Monero conference: https://www.reddit.com/r/Simple XChat/comments/14lk5vo/my_talk_at_monerokon_about_simplex_chat_current / "Anonymous pairwise identifiers" (that is, identifiers assigned to a pair of users, without identifying users - hence, anonymous) is the term used by NIST and they are one of "privacy by design" principles, but it's not adopted by any other communication platform. ---------------------------------------------------------------------- therealSoasa · 2023-11-26 16:25 What's the secure quantum resistant protocol ? ---------------------------------------------------------------------- rnimmer · 2023-11-26 17:36 EFF has a strong and vocal [anti](https://www.eff.org/issues/street- level-surveillance)-[state](https://www.eff.org/issues/surveillance- human-rights)-[surveillance](https://ssd.eff.org/) stance. That makes them an appropriate and trustworthy group for this type of audit. ---------------------------------------------------------------------- CivilCompass · 2023-11-26 20:37 Just use signal and donate instead of this ---------------------------------------------------------------------- No_Requirement_64OO · 2023-11-27 05:54 This looks like the beginning of of a beautiful friendship. :) ---------------------------------------------------------------------- HammyHavoc · 2023-11-27 14:51 But this mitigates shortcomings of Signal—so, no. ---------------------------------------------------------------------- CivilCompass · 2023-11-27 14:54 "shortcomings" lmao In exchange for using software made by people who think they know better? Hard pass. ActivityHub and it's implementations are the right way to do this. ---------------------------------------------------------------------- HammyHavoc · 2023-11-27 14:57 Yes, like the potential for MITM attacks on Signal, centralization, reliance on DNS and global identities. By "ActivityHub", do you actually mean ActivityPub? If so, you can't be serious. ---------------------------------------------------------------------- epoberezkin · 2023-11-27 23:11 The spec is here: https://github.com/simplex- chat/simplexmq/blob/master/rfcs/2023-10-25-remote-control.md Specifically, it uses Streamlined NTRU Prime 761 (sntrup761) in key exchange, same that was adopted by SSH - right now it appears to be the best choice for post-quantum key agreement, from all points of view. We will be adding it to double ratchet soon (https://github.com/simplex-chat/simplex- chat/blob/stable/docs/rfcs/2023-09-30-pq-double-ratchet.md), we will then comment on this choice more, but the second link has some of the points in support of this choice. ---------------------------------------------------------------------- epoberezkin · 2023-11-27 23:13 Not sure if you've seen how Signal spends money in their last post. With all my respect to Signal contributions to tech, it made me very annoyed. We learnt from Signal a lot, and will continue learning, but this post they made just shows that under no circumstances non-profit should try to provide services - they should be focussed on managing intellectual property and protocols... ---------------------------------------------------------------------- epoberezkin · 2023-11-27 23:15 Are you talking about audit or endorsement then? I don't see them doing technical audits on their site. ---------------------------------------------------------------------- epoberezkin · 2023-11-27 23:15 👍 ---------------------------------------------------------------------- CivilCompass · 2023-11-28 00:15 I read that post in length. I disagree with frankly your entire assessment of the situation and what I view as your misguided attempts to rebuild the wheel. The literal exact sentiment you aim at signal can and should be aimed back at you. Focus on managing ip and protocols and not building self hosted nonsense that will be breeched by nation state actors 100% of the time. I'll personally fund them as much as I can and convince many others to as well because the service they provide is top notch and peerless in capabilities and overall fit and finish. I will not be responding to this post so please don't bother with a response. ---------------------------------------------------------------------- STP_VEGAS · 2023-12-04 17:13 Signal is reliant on Google Play Services for some features. If SimpleX was big bro, what information are they collecting? Why trust Signal more than any other? At least with SimpleX, the contact info is easily managed and not permanent thereby making spam easy to manage.