Do you prefer Threema, Signal or Matrix? Why?
So, I have a Threema license, but from what I've seen its encryption isn't post-quantum. Signal's encryption seems the strongest. I host my own matrix server.
Also, I kind of don't care where the servers are or which provider it is. Everything is encrypted anyway.
It's an issue.
You can't create an account on desktop. You can't create multiple accounts. You can't create an account at all if you don't have a phone number. You can't create an account if your phone number's previous owner created an account. Signal can be subpoenaed for your phone number.
Signal is the most secure
[citation needed]
EVERYTHING in Signal follows an encryption or tokenization chain. Not like crypto coins but real actual chain-of-custody type encryption workflows. It uses elliptical curve cryptography where the key for each message moves forward along an elliptic curve, which are excessively difficult to guess the factors for once it is selected if you are not the key holder. This means that even if someone cracks the key for a single message you sent, they are going to have to crack the key for every other message still as each one is different. Even the metadata is encrypted by the user's keys.
Signal doesnt have usernames in the traditional sense. It's phone number+6 digit pin hashed into an encrypted signature.
The signal company can't see anything you do besides account create date and last login date, even if they wanted to due to how their platform is set up.
Meanwhile, Matrix literally clones the metadata between servers when a user connects to and starts talking to users on another server, in plaintext (maybe encrypted at rest but not E2EE).
All the fucking people that actually know cryptography and are experts in their areas.
It's good to be inquisitive but at some point if a person is not qualified to understand either you gotta belief some authorative figure or pay someone you trust to go review the code if you still don't trust it.
Multiple experts have said for years that it's solid. There's audits out there. It's used in the most extreme places where people need to survive and commucate securely and governments keep screaming they need backdoors because they can't fo anything about it.
At some point the whole questioning it has to stop.
Continuing to eat garbage opinions from the internet and growing conspiracy theories eventually has a limit.
I prefer signal because it's been the easiest one to convince my friends and family to use. I have like 8 friends on Signal, the 1 I got onto Matrix quit after a week. Matrix I treat more like foss Discord so I only use it for communities. ElementX is really nice though so I have hope that eventually it could be as smooth to use as Signal.
Signal is much more polished and less fragile than Matrix, but is pretty barebones especially in terms of features for large communities. Matrix additionally has a browser client and many non-Electron desktop clients. It's really close and depends on the use case imo. For personal messages I think I prefer Signal, for communities Matrix.
I haven't used Threema.
Signal
Self-hosted Matrix.
It still needs polish, but it's on a good path. Meanwhile others are centralized by a single authority with an easy target painted on them for government coercion along with multiple other attack surfaces, and even information easily traced to PII. Also, not everything is encrypted. A lot of metadata is left out of E2EE. And those servers/providers have that data.
By contrast, a drop in the ocean is far more likely to not be targetted from the outset, making pretty much any matrix server (potentially with the exception of the matrix.org one, but it's ok to treat it as a demo anyway) a really good choice in that sense.
Post-quantum isn't really a big problem because it will be a very long time before there are viable quantum computers (maybe never). You should focus on the very real risks of security breaks from normal negligence and design errors.
Threema seems pretty unpopular, so the risk is highest. Signal and Matrix are both popular and have a lot of scrutiny on their cryptography.
All 3 have open source clients, but Signal contains some binary blobs. Only Matrix has an open source server, though end-to-end encryption enforced by the client alleviates most of the concern of proprietary servers. All 3 support end-to-end encryption.
Threema has been audited multiple times.
Matrix because I can host it myself. I like self hosting. But I agree that it is the least polished of all.
I liked the Matrix because of all the kung fu karate fights, though I got to say the second one was the best, even though the third one had a Dragon Ball Z fight at the end
Self hosted matrix with bridges to WhatsApp and telegram. What else....