But their server of course sees everything inside the TLS channel which means no PFS since the data inside is all encrypted under static keys. they do claim forward secrecy but only in fine print do they then clarify this only holds for the client server connection as that uses TLS.

What annoys me about this is not so much that this is the way Threema works (which sucks, but OK) its that they go to quite some lengths to obfuscate this on their website and documentation. So if it ever leaks an adversary can go back and decrypt whatever traffic it can get their hands on. All msgs to you ever over the life time of the account are encrypted to that same key pair. You generate your Threema key pair when you create your account thats it. Unlike any other messenger in this E2E space including Signal, Wire, Wickr, WhatsApp, Matrix, etc. As I stated elsewhere in this thread, they market themselves as E2EE (which I blieve they are) and Forward Secure, which they are NOT from the perspective of their infrastructure. :-( I find them problematic to say the least. Note that Wickr does seem to reveal contacts as some have claimed below (unlike WhatsApp for example).Īs for Threema. Here's an interesting document from the FBI (as of Jan.2021) obtained by Property of the People via a FOIA laying out what info law enforcement gets from various messaging services. So, what do you think, which app is better? Are you comfortable with sharing your phone number with Signal? Give us your two cents in the comments below.About Metadata. The final choice boils down to you and what you expect from an encrypted messaging app. As mentioned, both apps are super secure and offer plenty of features to protect your communication. It would be unfair to pronounce one or the other app as the overall winner. With Two-Factor Authentication, you could be required to provide additional info and the company would log it. This is something that might change with a future update, though it’s not that simple. But Signal doesn’t provide support for Two-Factor Authentication. If you overlook the fact that you need to provide your phone number, there aren’t any negative sides.

In other words, nobody can get your information unless they snatch your phone and somehow manage to log into the app.Īs for the security protocols, Signal uses Perfect Forward Secrecy and proprietary Signal protocol. In addition, they aren’t recoding whom you’ve been chatting with. That said, the app doesn’t log anything regarding your contacts or groups you’re in. The same goes for the time and date you joined and the date of your last log-in. The thing is, you need to provide a phone number when registering with the service and they keep that phone number on record. But some information is on Signal servers. But don’t get this wrong, Wickr is also good in this respect.Īs for the actual storage protocols, the data lives on your device in an encrypted form. Signal goes the extra mile to secure your data.

And similar to Wickr, it’s available on iOS, Android, Linux, and Windows. More importantly, Signal complies with GDPR 100%.

Wickr pro vs me reddit