Still lame that they require phone number at all, it took them a long time to add usernames so you don't have to expose your phone number to a new contact. Still skeeves me out that the account is associated with a SIM at all.
We need an established secure anonymous/subpoena-resistant chat app at this point. Signal is great for a minimal threat model but we're kinda past that now given everything going on.
Simplex was a decent option but they're going down the crypto rabbit hole and their project lead is...not someone who should be trusted by anyone in the crosshairs right now.
Check out the developer/owner's social media, the chats they're in, and their responses to others and you'll see. They're much more interesting in crypto and politics than they are acting professional in public and towards others while representing their project and company.
It's not hard to do so, so if they're having difficulty doing that, what other simple things are they having difficulty with? Why would anyone hinge their safety and well being on the whims of such a person?
I say this as a person who bought into the initial concept, and who has used it myself.
>They're much more interesting in crypto and politics
I have yet to see any of that while just using the app. Do you think people owning a project should not be allowed to have and share there options about anything but the project?
SimpleX front page lied by omission about it having no identifiers. The fine print threat model did not mention the server has access to your IP addresses, and the mitigation to create "decentralized" system of users talking via separate servers ran into the problem of there being two VPS companies hosting the entire public server infrastructure. These issues were major as SimpleX advertised itself as an improvement over Cwtch, which should've meant superset of metadata had been protected. But that obviously wasn't the case.
The thing is, there's Akamai and Runonflux, two companies hosting the entire public SimpleX infrastructure. If you're not using Tor and SimpleX Onion Services with your buddies, these two companies can perform end-to-end correlation attacks to spy on which IPs are conversing, and TelCos know which IPs belong to which customers at any given time. Mandatory data retention laws about the assigned IPs aren't rare.
Yes, that's why I said I don't like their relays. It doesn't even have to be Akamai, you need to trust SimpleX first that not to track your IP. I'd rather use a messenger where something is not possible (or even hard) than trust.
As long as IP leaks are possible, I'd rather also use Signal, where at least the rest is battle tested and state of the art.
My concern with Signal is they'll either comply or move out of the EU with the incoming Chat Control, and I'd rather have a fully decentralized messenger with as few leaks as possible.
In my country, you cannot legally get a phone number not linked to the identity, and the prices are relatively high on the black market. Also, the phone discloses your location with pretty good precision, especially in US where everyone is living in their own house.
Signal accounts do not require a SIM. There is no requirement that the phone you use for running the app Signal has the phone number you use for Signal login.
My Signal number is a Google Voice number that has nothing to do with any mobile phone. The Google account has advanced protection turned on so you can’t port it or get the SMSes without a hardware login token.
Can you buy a phone number from a different country? (genuinely curious, I live somewhere I can buy a sim card with cash, and saw some in the impulse-purchase section of a store earlier today)
The PIN can be longer than four digits. Signal also guards against this with safety numbers; if someone takes over an account, every contact will see that the safety number has changed and should consider that the account may be compromised until verifying out of band.
Google Voice doesn't look like a safe option, your number can be taken away if you forget to pay or you can be banned for arbitrary reason without a way to appeal.
