session-desktop VS ContactDiscoveryService

https://github.com/oxen-io/session-android https://github.com/oxen-io/session-desktop https://github.com/oxen-io/session-ios

This is the correct place to raise feature requests and bug reports: https://github.com/oxen-io/session-desktop/issues

We're at 1.10.8. Please update: https://github.com/oxen-io/session-desktop/releases

Session's reasoning seems much more... cagey. Telling people to recreate their identities themselves sounds a little like the Threema stopgap solution, but it's much sloppier (I can't imagine end users WANT to recreate their account and communicate this to all their contacts via a third party). They're talking about implementing this eventually, but the ticket for doing so was closed right after saying this.

Session F-Droid (version 1.15.4): Encrypted private messenger

Or Briar, Session, Tox, Element/Matrix, Jami...

[1] https://signal.org/blog/private-contact-discovery/

Signal uses SGX for remote attestation, which presumably lets the client verify that the code running on the server is a build of the OSS code and not a modified version. But I don't know the details or if this is reliable.

SGX and remote attestation described here:

https://signal.org/blog/private-contact-discovery/

Signal does private contact discovery and the effort they've gone to to do this is quite impressive.

TEEs have numerous privacy-enhancing applications that may benefit users. One of them is, as discussed earlier, private contact discovery; the Signal application uses a contact discovery service enhanced using Intel SGX, a TEE technology, to protect its users' privacy. A similar application of TEEs is performing malware analysis in a remote cloud service, so that the service may not identify users by the contents of their devices, such as the applications they have installed, especially important as 98.93% of users may be uniquely identified by the list of applications they have installed.

Signal (or, more accurately, one of its predecessors) used to use client-side private set intersection for contact discovery, but this scales poorly [1].

Now they use a solution based on Intel SGX and server-side trusted computing [2].

[1] https://signal.org/blog/contact-discovery/

[2] https://signal.org/blog/private-contact-discovery/