Signal-Server VS ricochet

> They could at least BSL the server code and allow others to verify the server code and host but not compete.

This is exactly what they do (except they use AGPL): https://github.com/signalapp/Signal-Server

https://github.com/signalapp/Signal-Server/blob/main/service/src/main/java/org/whispersystems/textsecuregcm/push/APNSender.java for APNs push notification payloads

git clone https://github.com/signalapp/Signal-Server.git

yes it is available here https://github.com/signalapp/Signal-Server/blob/main/service/pom.xml

You could also start your own signal server, but with blackjack, and hookers

The fact that it locks you into using their servers, does not distribute on F-Droid (only Google Play OR an APK with an insecure update mechanism), and has a completely closed-source "abusive message filter" module server side, that could functionally be used for censorship, storing messages for future decryption, or any other number of nefarious purposes - we have no idea since it's not open source (https://github.com/signalapp/Signal-Server/blob/main/.gitmod...).

Additionally, you cannot distribute branded forks or Signal, and if you do fork it, your fork is not allowed to connect to Signal's "official" OWS (open whisper systems) servers - hostility to federation should be viewed with prejudice and suspicion at the very least, it suggests a vested interest in a single point of failure (or control), which goes against user interests.

Further reading: https://drewdevault.com/2018/08/08/Signal.html

It’s actually the signal server that isn’t reproducible because of the abusive message filter that’s in a private repository. It’s clear as day here: https://github.com/signalapp/Signal-Server

This looks like a much more polished alternative to Ricochet: https://github.com/ricochet-im/ricochet

Ricochet seems dead. It's been five years since its last commit to their git repo, and their website's certificate expired last year. This is probably why you can't find much information.

I think something like Ricochet (if it were still actively maintained) could be a good solution.

https://github.com/ricochet-im/ricochet

Every user is their own Tor onion service, so you get E2E encryption and no centralized servers. The whole thing hinges on the security of Tor itself which is probably a safe enough bet.

With that being said, if I had just one piece of advice - try to avoid ostentatious phrases like Speek is by far the most secure way to converse or 100% anonymous. Tor itself is not 100% anonymous, so that should immediately make anyone cautious. One of the things that I admired about the original Ricochet was that the developers never made brazen claims about their software. In fact, quite the opposite.

Check out https://github.com/ricochet-im/ricochet/blob/master/doc/prot.... It is metadata-free. It does not require a centralized server. It uses Tor.

[1] https://cwtch.im/ [2] https://ricochet.im/

Abandoned, unmaintained, deprecated or unreleased: Ricochet, TOR Messenger, Cwtch

ricochet.im website not working (??)

> there isn't a currently easily available obvious way to have private secure conversations.

Ricochet[1] works really well. It uses Tor hidden services to communicate. Your Ricochet ID is your onion address. To add a contact, you input their Ricochet ID and a short message, and Ricochet connects to their onion address and sends a contact request. If the contact request is accepted then you'll each show up as a contact on each other's client and can chat whenever you want.

Tor is really perfect for this, you can't get more private or censorship-resistant than Tor.

The UI is currently not great, but that's not a protocol problem.

The biggest problem with Ricochet is that hardly anyone is using it.

[1] https://ricochet.im/