XMPP/Jabber via a web client like movim.eu sounds like it ought to work!

You can also look into Snikket as a host for small groups like friends or family, but can continue to use the Movim web client even if you're hosting with Snikket rather than Movim itself.

IMO the best on-boarding I have seen in a chat app. Just scan each other's QR codes or click a link. No account management because ID is unique to each conversation.

Signal and WhatsApp need a phone number, Matrix/Element is needlessly messy, XMPP/Conversations is sensible IIRC (ID + password)

So much cope you didn't even notice no one mentioned matrix. We are comparing XMPP with Signal.

Your reasoning would hold up if 80% of xmpp wasn't running on Conversations or forks of it

Also, you really think saying only 20% of your chats are insecure is somehow making it better?

I will use the opportunity to remind that Signal is operated by a non-profit in the jurisdiction called "the US". This could have implications.

A somewhat more anarchist option might be TOX. There is no single client, TOX is a protocol, you can choose from half a dozen clients. I personally use qTox.

Upside: no phone number required. No questions asked.

Downside: no servers to store and forward messages. You can talk if both parties are online.

America is not a monolith. Signal's developers are very much aware of the risks of operating there and probably already have several escape plans given recent developments. I also think five-eyes probably has access but getting it might be computationally expensive.

Just got the app. Really like the idea!

FYI, while Threema front-end clients (apps) are open-source (and offer reproducible builds, which is surprisingly uncommon in open-source land), the server component, though supposedly audited, remains closed-source.

EDIT: for comparison, the Signal server code is mostly open source, but things like the spam filter are closed.

TIL I have no family I care to keep in touch with and I have no friends.

Well yeah we could also use Briar or whatever... but would your grandma?

How do we know signal isn’t also run by a techbro who just wants our data?

Hell yeah. Tox continues to rock. If anyone wants to chat, HMU, here's my key:

fdd7005639c618263ab2eedab974f7576c7c0ded6217eed9e9dc0344c622e72aeef7055f8b4d

The founder of SimpleX is out of his mind. Check yourself: https://xcancel.com/epoberezkin

Not saying that it's necessarily a bad option, but my biggest issue with delta chat is that it does not offer forward secrecy (if a user's private key is compromised, past messages can be revealed); Signal does. Delta no question beats signal in decentralization, though email is less decentralized than it seems--how many people do you know who still use gmail? Delta also inherently leaks metadata on whom you're communicating with to the email host (that's just imap/smtp). Signal can mitigate this somewhat with Sealed Sender (which gives one-way anonymity), though it can be broken with statistical analysis, and signal metadata is more identifying due to requiring a phone number.

it does make sense, actually. as they had that function when the app was first around. why do you think they have you sign up with a phone number in the first place?

also, it's not on me to solve every technical hurdle you make up. if you want to learn more about Spam Prevention methods, I can point you to some resources if you're truly interested.

I'm sorry that not everyone thinks Signal is a god app worthy of worship. its a message app, and its not the only one. it does stuff some people don't like. including me.

why do you think they have you sign up with a phone number in the first place?

Again, spam & abuse prevention. We've been over this.

I’m sorry that not everyone thinks Signal is a god app worthy of worship. its a message app, and its not the only one. it does stuff some people don’t like. including me.

I'm not saying that Signal is a god app worthy of worship, I'm saying it's detrimental for them to include SMS functionality, since that's fundamentally insecure. That's literally why they removed it. Is that so hard to understand?

I don't think that the founders are bad people. If you look at their history of work, they have done enormous amounts of work in the computer security sector. The founder, however, did run a cloud based WPA cracking service.

Meredith Whitaker, who is the president, used to work at Google doing research for "issues related to net neutrality measurement, privacy, security, and the social consequences of artificial intelligence".

In 2018 she then staged walkouts at Google over concerns of sexual misconduct and citizen surveillance.

The people on Signal's board seem to be trustworthy people with a pretty airtight background. You have to worry more about the mobile operating system compromising you than do you about Signal.

That's their problem. If their messages aren't encrypted, it isn't like you won't be aware of it. Request that they use a modern client and get with the times. None of this is an actual problem without easy solutions.

Not sure if you're actually sincere or are sarcastically making fun of Tox's onboarding. That's a long key.

Does it really matter who made it if you can see the source code? You don't have to trust them.