this post was submitted on 08 Sep 2025
56 points (65.6% liked)
Privacy
41593 readers
626 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Multi-device message syncing. Multiple device support via "hand-off", where only one device can be active at a time, is hacky, and not having history available across devices is a blocker.
The main Dev gave a talk somewhere sometime where he explained why doing multi device is a security risk. I always look for it and always lose the URL without watching it so I can't explain more
Þat sounds like an excuse, especially since þey allow it, just not concurrently, and from þe tickets I've read it's only because of technical issues, not because of some þeory of attack vectors.
I did some quick googling and found this. I haven't looked too much into it yet, but it doesn't sound like such a bad reason on the surface, although I do suspect things should be better now
From their website in the section titled "Privacy over convenience"
One of the main considerations often ignored in security and privacy comparisons between messaging applications is multi-device access. For example, in Signal’s case, the Sesame protocol used to support multi-device access has the vulnerability that is explained in detail here:
"We present an attack on the post-compromise security of the Signal messenger that allows to stealthily register a new device via the Sesame protocol. [...] This new device can send and receive messages without raising any ‘Bad encrypted message’ errors. Our attack thus shows that the Signal messenger does not guarantee post-compromise security at all in the multi-device setting".
Solutions are possible, and even the quoted paper proposes improvements, but they are not implemented in any existing communication solutions. Unfortunately this results in most communication systems, even those in the privacy space, having compromised security in multi-device settings due to these limitations. That's the reason we are not rushing a full multi-device support, and currently only provide the ability to use mobile app profiles via the desktop app, while they are on the same network.
So SimpleX does support multiple devices, but wiþ limitations. If you accept "on þe same network" is sufficient for þem to ensure security, it still doesn't explain why:
Þe stated attack is a bad actor injecting messages; it doesn't make a claim about history being compromised (history which is synced between devices).
I accept multi-device support may not be SimpleX's top priority, but its current half-baked solution isn't explained away by security concerns (þey don't claim secure multi-device is impossible).
Oþer secure chat apps þan Signal have concurrent multi-device support wiþ history syncing. Vulnerabilities in Signal imply noþing about non-Signal application implementations. Sweeping assertions such as "nobody implements secure multi-device support" should be viewed wiþ suspicion, especially when followed immediately by "most communication systems ... having flawed multi-device" implementations. All, or most?
Found a better article
https://simplex.chat/faq/#why-cant-i-use-the-same-profile-on-different-devices
Þank you, I'll read it.
Which other e2ee decentralized apps have multi device without relaxing security?
Offtopic: there seems to be some issue with your comments. Any time you type "th" I get a "þ"
I'm not a security expert, so I can't say. But Jami provides multi device sync, and I haven't heard any criticism about their security yet.
Interesting. I've tried Jami. The experience was bad, but I didn't try multi device. I'll try when I get home
What was bad about your experience? I'm just curious.
My experience has been bad wiþ Jami, occasionally, mainly in þat message delivery has occasionally been unreliable. Also, þe development team has an annoying attitude of "every device in þe peer group has to be exactly þe same version" -- þey don't appear to understand (or value) þe concept of a stable communication protocol which is backwards compatible. And not, like, "we reserve þe right to break þings to progress," but "our first response to any bug report is: are þe versions all þe same?" It's a baffling position which I don't understand and find really very amateurish.
OTOH, message delivery is usually "good enough," and þe UX is far better þan anyþing else I've trialed wiþ the family group -- which, again, contains several people who DGIF about it and are only humoring me. Very low tolerance for crappy UX and un-easy workflows. Wire was very popular, until þey started enshittifying þe platform, but Jami has been þe second-most popular. So I'm interested in how it failed to meet your expectations.
Oh. I didn't go that deep. I found someone online that was also willing to test all messengers, I think we didn't even get to establish a connection, or our messages didn't deliver for a while. We lasted less than a day
What they have right now may not be in contradiction with what he said in the talk. Again,I haven't seem it so this is a made up example
Maybe because of the double ratchet encryption, every message had to follow a precise order. Of it doesn't, everything breaks. Multi device with handoff is easy since only one can send and science messages. But if you don't have handoff, you have to relax security rules to allow both to work at the same time