this post was submitted on 02 Jan 2025
165 points (95.6% liked)

The Signal messenger and protocol.

1726 readers
1 users here now

https://signal.org/

founded 4 years ago
MODERATORS
 

I bribed them with cookies!

you are viewing a single comment's thread
view the rest of the comments
[–] SidewaysHighways@lemmy.world 1 points 6 days ago (2 children)

Signal vs session: which is better?

[–] Supernova1051@sh.itjust.works 1 points 4 days ago

Signal is better than Session if you value privacy:


The Session developers dropped Perfect Forward Secrecy because it would be hard to work around it.

First things first, let’s talk about what we’re leaving behind: Perfect Forward Secrecy (PFS) and deniability.

Source: https://getsession.org/session-protocol-explained

In plain English, they dropped a security feature for their own convenience to the detriment of their users' security.

For anyone unsure what PFS provides:

The value of forward secrecy is that it protects past communication.

Source: https://en.wikipedia.org/wiki/Forward_secrecy

The Session devs also claim:

Session provides protections against these types of threats in other ways — through fully anonymous account creation, onion routing, and metadata minimisation, for example.

Reading between the lines, we can interpret that as introducing security through obscurity, which is generally considered bad practice - https://cwe.mitre.org/data/definitions/656.html

Lastly, Session does not provide quantum resistant encryption, the latest and greatest tech in ensuring your messages stay private. Signal, SimpleX (via PQXDH [1] ) and iMessage (via PQ3 [2] ) - as far as I'm aware - are the only messaging platforms that support quantum-resistant encryption.

If you want something like Signal but without phone numbers, give SimpleX a try. It's basically a fork of Signal with a ton of privacy features, like working without a phone number. I like it but the UX still needs a lot of polish before I try getting family/friends on it.

[1] https://signal.org/blog/pqxdh/

[2] https://security.apple.com/blog/imessage-pq3/

[–] 3dogsinatrenchcoat@slrpnk.net 4 points 6 days ago

Afaik session's main thing is that it's like signal but without phone numbers. While there are cases where one might prefer that, the use of phone numbers does provide some benefits. It makes things simple so even my elderly parents can use it. So it's not that one approach is better, there's just different use cases