All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
[HELP] Secure & Reliable Communication method
Greetings,
I was wondering what the best way is to communicate securely online, whether it is job related, friends related or whatever other reasons.
I think everyone should at least have the freedom to communicate privately without someone else being able to read the messages sent from a person to another.
I don't consider using telegram, signal, mail or any third-party provider secure because the messages and metadata can be stored in server side.
And also using such third-party library can expose the users to a bigger surface attack while web-based application does not.
I heard about XMPP lately and was told that this can be secure if used with OTR/OMEMO/PGP or any other plugin that encrypt message from end-to-end.
However, I also heard that some well-known XMPP servers have been compromised
Article: https://notes.valdikss.org.ru/jabber.ru-mitm/
If there are any experts or people who would like to discuss about this very interesting topic, I think it would help a lot of us.
Thanks to everyone who is willing to share knowledge about it
Cheers.
Comments
>
here is something private
1- spin up a linux instance on any cloud provider
2- add a new user other than yourself to server: adduser blabla
3- give the the server ip ssh port and password for blabla to mr. blabla
4- after user logins to server using ssh , run command: who
5- blabla user is logged on pts/1 so
talk blabla pts/1
after finishing your ultra important communication with blabla
delete user and wipe server and delete server, delete cloud provider, delete internet ...
matrix ?
@emre Thanks for the idea, however I think a lot of people including me still want to be able to have a contact list and thus making this scheme useless for such case
@ShadowLurker Matrix is a good alternative, however it works the same way XMPP does, meaning that you have to rely on someone else server, which means MiTM attack can happen
I understand the concern, but out of all that signals the best
not if you selfhost on your server
This is actually a very good idea, is it difficult to setup a secure XMPP server?
Also, which locations would be the best for such purpose?
And what would be the cost of it?
Best is crypted private phone !
Just open your private sip server & messages server @home, forgot the rest.
@ValdikSS important news don't miss
PGP email. Share your public key with your friends and then talk about ▓▓▓▓▓ and ▓▓▓▓▓▓▓▓▓▓ or even ▓▓▓▓▓▓ or whatever.
Not particularly useful for proper "group chatting" or anything, but for secure messages between you and a work colleague or something it's acceptable.
self-hosted matrix
@MannDude very useful comment, thanks !
@Rubben hosted which country VPS ?
Are you asking me where I host it or where you should be hosting it?
Where I should > @Rubben said:
Both but more especially where I should host it
Also not useful for group chat, contacts etc but simple enough to use:
https://github.com/magic-wormhole/magic-wormhole
Any provider you like, has good dealz, and doesn't have constant isses. If you're only planning to use it with friends / wont be joining rooms with 1000s of members, a 1c 1g 20g vps will be just enough.
Or, if he really cares and wants a provider who is supportive of privacy and anonymity -> @MannDude / Incognet.
@luciesup
Unless you can design and produce your own processor, all hardware, possibly telecom infrastructure, your own OS, and your own software - which of course others (with whom you want to communicate) would have to trust and get and use ... your "(basically) I trust nothing and nobody" approach won't get you far ...
Also, hint: coordination and communication are different things. For the former a common (used by both sides) server & software is useful if not even needed, for the communication between two parties itself no such common server is needed, and those that are needed (like routers) can be kept in the dark (encryption)/not understand your communication.
In that case, probably better off with Kyun.Host @naphtha who custom built their services from the ground up with a true privacy first approach. Anyway, the more choices for OP the better!
Signal - free too
Check it out. Healthcare uses it too for doctor patient communications in most places.
There's been so many cases of major criminals getting busted in Europe because the encrypted phone service they were using got hacked by the authorities. EncroChat is probably the most famous, but there's been a few:
https://www.europol.europa.eu/media-press/newsroom/news/dismantling-encrypted-criminal-encrochat-communications-leads-to-over-6-500-arrests-and-close-to-eur-900-million-seized
Matrix/Element has end to end encryption
OMEMO only best choice, OTR was old-one, PGP was defeat point of E2E.
Some modern XMPP client was aware any cert change as long you logged before MITM happen.
Its always recommended you doing self-hosted rather using public XMPP which some of them usint super old XMPP server. I just host prosody for my self and family it only took 200MB RAM and some storage for XMPP Upload HTTP.