-

2025-01-26 07:45:26

adb

adbenitez@mastodon.social

migrating from #WhatsApp to another centralized platform is not a real solution, that's why we are here in the #Fediverse and not in #BlueSky

Migrate from #WhatsApp to #DeltaChat and other decentralized alternatives, break free out of the silos once and for all and stop feeding billionaires/CEO incubators

#ArcaneChat #XMPP #Matrix #SimpleX #Session #decentralization #encryption

show all 46 comments

2025-01-26 07:59:24

Rob

rob@skol.social

@adbenitez

Can you tell me how Delta Chat security compares to #Signal? Why would I switch from Signal to use Delta Chat? What's the advantage?

2025-01-26 08:03:37

link2xt@fosstodon.org

@rob
It has better availability, which is part of security. You never hear "email network went down" and you can use multiple email addresses to avoid the case when your only email provider is unavailable or blocked.

Signal requires a phone number and the connection between your account ID and phone number is in their database (proprietary Amazon DynamoDB service actually, Signal does not run its own database). It can be requested even if you only get in contact with usernames.

@adbenitez

2025-01-26 08:05:47

adb

adbenitez@mastodon.social

@rob Some advantages:

- Decentralized, you can use different servers or host your own without having to follow the rules of a single company in the US

- No phone number or any private data required to register, totally anonymous

- You can have as many accounts as you want, even across different servers each, ex. one for family another for work, etc

- You can create or use bots to improve the experience

- in-chat mini-apps ex. collaborative editor

- good multi-device support

- and MORE!

2025-01-26 08:08:35

Rob

rob@skol.social

@link2xt @adbenitez

I use Signal heavily. To my knowledge and since I started using it years ago, including to make many international phone calls from the US to Australia and New Zealand, I have never observed any downtime that impeded my use.

I will research the phone number issue.

Here's my point: asking to move from a proven secure network, to an unproven, claiming to be secure network is not something I do lightly.

2025-01-26 08:09:53

Δж➂

ax3@wizard.casa

@adbenitez @rob

> without having to follow the rules of a single company in the US

what does this mean? you have to follow rules of any service provider (email) you use regardless of jurisdiction, no? eu and the us are in bed with each other as far as sharing intel/data. cryptography helps with this.

that one id i connected with you on as a test was in the us. i own the physical server so it's my rules.

2025-01-26 08:12:55

adb

adbenitez@mastodon.social

@ax3 that if Signal decides to ban you because rules in the US, ex. recently they added Cuba to the "terrorist countries" list, imagine how easy would be for US to tell Signal to not allow any Cuban phone number, that is not possible with decentralized platforms where users can use the provider of their choice and also countries can use their own server and be more resilient/independent while still federating with the rest of the world

@rob

2025-01-26 08:13:24

link2xt@fosstodon.org

@rob
More common case for availability is that if the country blocks Signal, you can lose access to such contacts if they don't have knowledge to bypass the block. Signal "censorship circumvention" is implemented differently on Android and iOS and is not available for desktop. It has failed to work in some countries on iOS in the past while working on Android.

@adbenitez

2025-01-26 08:14:34

Rob

rob@skol.social

@ax3

I would need a lot more information and assurance before switching to Delta Chat @adbenitez.

I'm glad it exists, and will do some research. But I am not interested in hosting my own service (that's not going to be more secure than Signal). Where I work, Signal is forbidden for business. I don't need more than one account.

The one compelling thing you've said here is "more features". But even those are unclear in their utility.

2025-01-26 08:15:39

Rob

rob@skol.social

@link2xt @adbenitez

I'm getting the idea that this is not for me. This is a chat app for doing things I do not do - which is ok.

Thanks for answering all my questions.

2025-01-26 08:17:13

Lancson

lancson@mastodon.zaclys.com

@adbenitez @ax3 @rob deltachat is just a way to chat in using emails

2025-01-26 08:19:10

adb

adbenitez@mastodon.social

@rob it is ok if you don't need Delta Chat, but I would be more careful about your mentality of considering #Signal the most secure and private app ever, because it isn't, but since I guess you are not a person at risk or activist getting on the bad side of US gov. probably it is safe enough for you? otoh, to send some memes to your family, any other decentralized app would do and you don't need to use a central service like Signal then?

@link2xt

2025-01-26 08:22:55

Δж➂

ax3@wizard.casa

@adbenitez @rob

> that if Signal decides to ban you because rules in the US, ex. recently they added Cuba to the "terrorist countries" list

i'm running through a us-based proxy at this time and i can reach cuba's website. just because there's a designation as a terrorist state doesn't mean traffic is blocked. the only networks i cannot reach are in the dprk which i have no interest in anyhow.

> imagine how easy would be for US to tell Signal to not allow any Cuban phone number,

sure, i mean it's possible that the us says "signal, don't allow cubanos" but so far there's been no example of this. i think this is speculation at the time, but yes something to keep in mind with riding other's infrastructure.

> that is not possible with decentralized platforms where users can use the provider of their choice and also countries can use their own server and be more resilient/independent while still federating with the rest of the world

what about countries that deny traffic to other countries? russia, china, and others have firewalls and dpi to inspect and block/re-route traffic.

it's absolutely possible to have issues with decentralized infrastructure. since we're talking about email, one of the chatmail servers is blocked due to ip reputation from a mail provider i've used. whether it's deltachat, fediverse, etc if a country or region notes that a certain ip space is not welcome they can block it and there's nothing we can do to change this besides hopping proxies and more hoops.

this all being said i use deltachat for personal communications, signal i keep for people who pay my bills and prefer a bit more security than sms over ss7

2025-01-26 08:25:08

Felix

newhinton@fosstodon.org

@rob @ax3 @adbenitez

If you need a coherent argument for why signal is still without any meaningful match, i can really recommend this blogpost:

https://soatok.blog/2024/07/31/what-does-it-mean-to-be-a-signal-competitor/

(Not mine. but i really should write an article why most defederated services aren't that great of an option for many people)

2025-01-26 08:28:15

adb

adbenitez@mastodon.social

@ax3 that was a theoretical example, I am not saying they are doing it, but they COULD do it EASILY if they want to, they block access to a lot free software documentation pages like https://developer.android.com and golang.org

@rob

2025-01-26 08:35:33

Δж➂

ax3@wizard.casa

@adbenitez @rob what ip space are you riding on that is getting blocked by google? google owns all the underlying ipv4 space for those two domains.

and yes, any nation could theoretically block ip space, services, etc. but the question i think about is, do i preemptively try to solve a theoretical problem or do i go with what i know and operate accordingly.

a lot of eu citizens have this distorted view that the us is some sort of gulag controlling everything. i'm an eu citizen and i can say both nations are equally fucked.

2025-01-26 08:36:43

adb

adbenitez@mastodon.social

@newhinton Signal is "open source", sure they have some code published, but that doesn't warranty that the code running in the server matches and they took already a long time to update in the repository the code they had deployed, same for the client, I was looking into it and a file in the source code was not the one actually used in production, it was being fetched from the server

#ArcaneChat fits:

- FOSS
- e2ee (forced)
- safe against MITM

@rob @ax3

2025-01-26 08:38:51

adb

adbenitez@mastodon.social

@ax3 this is going in the wrong direction, my only point is that if you can self-host or use a provider you trust more or with different policy/rules than a single ruling server it is much more powerful, I am not interested in discussing US-EU politics

@rob

2025-01-26 08:40:09

Felix

newhinton@fosstodon.org

@adbenitez @rob @ax3

Since signal protects against itself via it's encryption and envelope protocol, it simply doesn't matter what runs on the server.

Not great that they are regularly behind, but it is simply irrelevant for the security.

2025-01-26 08:44:17

adb

adbenitez@mastodon.social

@newhinton

by @link2xt: "Signal requires a phone number and the connection between your account ID and phone number is in their database (proprietary Amazon DynamoDB service actually, Signal does not run its own database). It can be requested even if you only get in contact with usernames."

also read: https://fosstodon.org/@link2xt/113895548001005917

@rob @ax3

2025-01-26 08:45:40

Rob

rob@skol.social

@adbenitez @link2xt

Who can answer that question today? The US government is shifting under my feet as we speak.

The last time #DirtyT was president, my city burned to the ground.

The direct answer to your question is “yes” today. But I am concerned about the future and want to take reasonable security precautions. That’s why I asked in the first place.

You’ve more than answered my questions and I am grateful for all your answers. Thank you.

2025-01-26 08:49:10

adb

adbenitez@mastodon.social

@rob that is exactly the point I wanted to transmit, even if #Signal is good today, nothing prevents it from going bad, and since it is a centralized service you and your family will be trapped there in the same situation that people are today with #WhatsApp, ofc. you can always wait and repeat the same story over and over again migrating to the next LessSuckingCentralizedApp of the moment

2025-01-26 08:49:38

Felix

newhinton@fosstodon.org

@adbenitez @link2xt @rob @ax3

I have read that. The exposure of usernames is the same as phone numbers. Which means you already need to know that it exists. So not much gained there. Also, what does this have to do with the database or the security?

Signal is demonstrably *the* most secure app. Every "problem" signal has, is a problem for other messengers too. (Usually the problems are worse for them, including and specifically deltachat)

2025-01-26 08:53:51

link2xt@fosstodon.org

@newhinton
> Signal is demonstrably *the* most secure app. Every "problem" signal has, is a problem for other messengers too.

Not every other messenger has a problem of keeping the relation between non-secret account IDs to phone numbers in a central database. For example, Matrix, XMPP, Session and Delta Chat don't have this problem because you can use them without having any phone number at all.

@adbenitez @rob @ax3

2025-01-26 09:00:20

Felix

newhinton@fosstodon.org

@link2xt @adbenitez @rob @ax3

True! Instead they leak message metadata, user relationships or even message content (if not careful) all over the place.

None of the "competitors" are actually as stringent and secure if it comes to the amount of data leaked to the outside. On that front, there currently simply is no true competitor that does secure and private messaging as well as signal does.

https://soatok.blog/2024/07/31/what-does-it-mean-to-be-a-signal-competitor/

2025-01-26 09:06:38

adb

adbenitez@mastodon.social

@newhinton you are completely ignoring my message where I said that arcanechat.me fits the bar, it enforces ALWAYS encryption, and ZERO METADETA is required, since UNLIKE SIGNAL, it doesn't require ANY private data for registration, its FULLY anonymous and END TO END ENCRYPTED and safe against MITM

@link2xt @rob @ax3

2025-01-26 09:09:21

adb

adbenitez@mastodon.social

@newhinton and also notice that for most people the security given by #DeltaChat, #Matrix, #XMPP, #SimpleX, #Session, etc. is more than good enough, without needing to give phone number or using a centralized service that might go the enshitification route sooner or later

@link2xt @rob @ax3

2025-01-26 09:10:42

Felix

newhinton@fosstodon.org

@adbenitez @link2xt @rob @ax3

Since that is a delta-chat client, it uses email as it's transport layer, right?

So it leaks at least when and with whom you are writing to everyone with access to one of the transfer-email-servers. I wouldn't call that "zero" metadata. Quite the opposite.

2025-01-26 09:15:20

adb

adbenitez@mastodon.social

@newhinton I think you are a bit outdated, yes, Delta Chat can be used as an email client but that is not the main way to use it, the normal way to use it is just to set a name and that is it, all the server do is transmit messages between random token addresses

@link2xt @rob @ax3

2025-01-26 09:16:22

Felix

newhinton@fosstodon.org

There you are right. For many people that kind of security is likely enough.

But then there is usability. With signal, i am already done once i signed up, and the people i can chat with, are already there. That is not true for the alternatives, especially the ones that allow plaintext messaging, which require a deeper understanding of the infrastructure you are using.

How secure/insecure something is then depends on your usage and your target audience.

2025-01-26 09:20:22

Felix

newhinton@fosstodon.org

@adbenitez @link2xt @rob @ax3

Okay, i might be outdated. But to be honest, this opens up a whole other can of worms that make it so much more complicated than most users want to deal with. (Though this is not a technical argument anymore, only a usability one)

Generally the question i ask is whether or not my grandma can use it securely. Most messengers fail in that category, especially federated ones. They have their place, but most will choose something "simpler".

2025-01-26 09:27:20

adb

adbenitez@mastodon.social

@newhinton I can assure you, your grandma will be able to register in #ArcaneChat / #DeltaChat MUCH MORE easily than in Signal, do you even remember how is it to login in Signal?

In ArcaneChat you don't really need to register, just set a name&avatar and start using it

In signal besides the same name&avatar screen your grandma needs to enter her phone number, give telephony permissions, then solving CAPTCHA to prove she is not a robot, then receive an SMS with PIN etc.

@link2xt @rob @ax3

2025-01-26 09:29:10

zetabeta

zetabeta@mastodon.social

@rob @adbenitez
don't ask https://soatok.blog/ about that, furry would be upset.

2025-01-26 09:32:33

adb

adbenitez@mastodon.social

@zetabeta

@rob

2025-01-26 16:28:39

🌻

c_th1@digitalcourage.social

@adbenitez

@delta

So Delta Chat is now Arcane Chat ??

2025-01-26 16:40:30

adb

adbenitez@mastodon.social

@c_th1 woot??? #ArcaneChat is a customized #DeltaChat client + arcanechat.me server optimized for NEVER allowing any unencrypted message in/out of the server, hence tackling one of the criticisms of the #Signal fanboys but without giving up on fully anonymity and federation

@delta

2025-01-26 18:23:10

Jog

jog@mastodon.zaclys.com

@adbenitez merci, je ne connaissais pas. Thank you, I don't know this. But @delta need a completly french web site to be used by my friend.

2025-01-27 01:03:12

Debacle

debacle@framapiaf.org

@adbenitez

I agree, that we should not promote yet another siloed platform, such as Signal. Jeff Bezos or US gov could just kill it in a blink of an eye.

At the moment, however, Delta Chat is missing a first class client on Linux.

Number of clients in my OS (#Debian main):

Matrix: 8

#Jabber/#XMPP: 12

Delta Chat: 0

Jabber exists since 1999, so it is stable and proven. Until there is a useful client for Delta Chat (or better: an XMPP bridge) in my OS, I can/will not try it 🤷

2025-01-27 01:16:24

Christopher

christopher@my.talesofmy.life

@Debacle Maybe I don't understand what you mean by 'first class client on Linux', but you can go to https://delta.chat/en/download and download Deltachat Flatpak file to install on Linux. There's also a Ubuntu Touch option as well.

2025-01-27 01:25:09

Debacle

debacle@framapiaf.org

@christopher

If I use something as my "daily driver", I want it in my OS. I don't use flatpak or similar intricacies. It must be integrated into my #packageManagement (here: #apt) and for the peace of my mind in #Debian main, not a third party repository.

2025-01-27 01:36:00

𝙶𝚑𝟶𝚜𝚝𝚣𝟶𝚡

gh0stz0x@poliverso.org

@Debacle @Christopher

On Debian it is in the repositories if I'm not mistaken.
You could still download the deb and install it: https://download.delta.chat/desktop/v1.52.0/

2025-01-27 02:06:22

Benjamin Kwiecień :eo:

ben@kwiecien.us

@debacle @christopher I'm currently having a lot of problems with the flatpak on Fedora Silverblue. Flatpak itself is an excellent tool and should not be avoided. Delta Chat desktop version does have a native deb package. What's bad about the desktop client is that it uses electron, but it's still a great application. They are currently working on porting it away from electron, and that's very exciting!

2025-01-27 04:13:53

adb

adbenitez@mastodon.social

@debacle I recommended Delta Chat because it is the more user-friendly and easy to switch to, but in fact that is why I said "and other decentralized alternatives" and tagged XMPP

as much as it would be cool to have the client in the Debian repo, most users migrating from WhatsApp don't even know what Debian is, and it can be installed using flatpak anyways

2025-01-27 06:25:37

Debacle

debacle@framapiaf.org

@gh0stz0x @christopher

No, Delta Chat is not in Debian main.

$ apt search deltachat ⇒ nothing

There is a bug report about it:

https://bugs.debian.org/1073037

Let's fix that and then we'll see 🙂

2025-01-27 06:28:22

Debacle

debacle@framapiaf.org

@ben @christopher

The problem with flatpak is not, that it were a bad tool. But I'm used to have all my packages in the #packageManagement (here: #apt) and don't want to move away from that luxury. That's why I do avoid flatpak, appimage, snap, pip, etc.

2025-01-27 07:21:05

Benjamin Kwiecień :eo:

ben@kwiecien.us

@debacle @christopher flatpak is wayyy more luxurious than the system package manager 😏

2025-01-27 14:07:38

Werawelt

werawelt@social.tchncs.de

@adbenitez
👍 👍 👍
#DeltaChat is the best!