Secure Messaging for Jolla: TextSecure, Threema, Bleep, etc

asked 2014-12-09 10:37:43 +0200

sunnystar
2382 ●19 ●24 ●26

updated 2015-07-26 13:49:56 +0200

Since Jolla and Sailfish OS focus on privacy and security, I was wondering if that approach goes beyond the device and also covers messaging? Ideally we would have a secure and decentralized solution. However, I do not know of such a solution elsewhere yet - and some kind of homebrew would be Jolla-2-Jolla messaging only. The first step would be to identify THE platform independent, open and secure messaging technology. While TextSecure has great cryptography, it relies on Google Cloud Push and is Android-only at the moment (I believe). Other technologies are decentralized (Bleep), but not open and auditable. Does DarkMail help here?

What is Jolla's plan to address this? Is secure messaging on the agenda?

It will take a while though... In the meanwhile it would be great to support at least one of the popular applications natively on Sailfish. This would in most cases require to contact the vendor and partner up with them. And if they refer to the dev costs and the small user base on Jolla, then I'm sure that a crowdfunding campaign would be happy backed by lots of sailors (incl me). For examples:

1. Jolla addresses the topic of secure messaging as it is important to Sailors.
2. Jolla evaluates the technologies. Also with regards of easy of implementation.
3. Jolla gets in touch with the vendors (e.g. Threema, BitTorrent, ...) and checks out if they would be open.
4. Jolla puts the promising candidates up for vote on Together.
5. Jolla starts a crowdfunding campaign with the winners of the poll.
6. Sailors back the project (hopefully!) and we have an implementation in 1 year.

Deal?

Some ideas around available messaging platforms I know of: To be able to communicate with people on Android, etc. it would be great to use a protocol which is available today and present on other platforms. I was thinking of TextSecure as it is considered cryptographically robust and it is open source - it uses on Google Cloud Push, but can also work in Pull mode (getting messages every 15 minutes is sufficient for me). Threema is a great solution from Switzerland with lots of users among the privacy aware crowd. Bleep is from the BitTorrent guys, but probably not yet open sourced. WhatsApp has - against all expectations - started to adopt the TextSecure protocol to allow end to end encryption between users (audits need to prove secure implementation). As of today, I feel that there is lots of things in the clouds for my Jolla, but no app in the making. Are there any projects targeting this niche on Jolla?

UPDATE [26-07-2015]: Telegram to the rescue?

I believe that a Threema-port to Sailfish is pretty utopic since they're not even supporting WindowsPhone. Also the developments around TextSecure don't seem to aim at moving away from using the Google Cloud Messaging (GCM) system in the near future, which funnels lots of data through Google's Play Service bound to the Google-ID; and is not a privacy advocate's favorite. So despite all the praise for the great encryption ideas that went into TextSecure, this approach lets down people who are caring for privacy and want to avoid Google's cloud.

With Sailorgram (also see here) I've discovered a pretty good native secure IM client for Jolla. As mentioned further down in the comments, Telegram has for its Secret Chats the highest rating on EFF's messaging score card. There are Telegram clients for your desktop computer as well, even for Linux-based systems. But check also out Cutegram for your Desktop-OS. If you would like to run Telegram as Android-App (on Jolla or on your Android), check out the F-Droid version of Telegram which has been sanitized from Google Play Service and other problematic elements. I like the flexibility of Telegram allowing me to choose between Cloud-Chats and Secret-Chats. SailorGram is supporting Secret Chats!

Brief remark on encryption "quality". I don't want to start a burning discussion on the quality of Telegrams MTProto encryption technology. However, for those who are interested or maybe even confused, I recommend reading this article.