In many countries around the world, phone numbers are attached to biometrics data and personal IDs. Telecommunications companies are either government owned or are heavily regulated, privately owned monopolies who comply with most government requests for backdoors or user data. The idea that today, we still need to give out our phone numbers as primary identifiers to be able to use the leading messaging apps should be frowned upon and actively challenged. It’s necessary to advocate for private alternatives in messaging that do not rely on user IDs of any kind - and yes, it’s possible.
-
Messaging is still not where it needs to be. Privacy is confused with security, when both are not synonymous, and there are major gaps in helping users understand the fundamental differences.
-
-
For example, while WhatsApp messages are end-to-end encrypted, let’s consider what you give up when you use it, per its own listings in app stores:
-
-
App activity (app interactions, in-app search history, and other user-generated content)
-
Location
-
Financial information (user payment info and payment history)
-
Contacts and their phone numbers
-
Groups you’re a member of
-
When you use the app and how often you use it
-
Device and other IDs
-
Personal info (email address, user IDs, phone number)
-
-
This is called metadata. It reveals a wealth of information about you and your connections, and in the hands of a centralized monopoly, this can and does get misused in incredibly dangerous ways. Once such metadata is logged, it can create very detailed profiles about who you are, everywhere you’ve been, and everyone you’ve ever spoken to. In settling for apps that normalize this while giving you the illusion of privacy in their marketing, we are doing ourselves a disservice by accepting this as the default. Collectively, we aren’t doing enough to protect ourselves and our social graph from this invasive overreach.
-
When stored, aggregated and analyzed, this metadata provides ample information that could potentially incriminate someone or be submitted to authorities. When WhatsApp and Facebook Messenger enabled end-to-end encryption for messages, of course it was a welcome and widely celebrated change. But it’s important to remember that not all end-to-end encryption utilizes the same standards, some implementations are more secure than others, so it’s something that shouldn’t necessarily be accepted at face value. More importantly: collecting and storing an obscene amount of metadata should invite global scrutiny, considering this data is often combined with whatever other information companies like Meta harvest about your identity (which is a lot.)
-
-
This is one of the many reasons why we need to resist giving out our phone numbers just to access an app, especially to do something as personal and intimate as private messaging. Even though users can sometimes mask their numbers with a username, their identity on the app is still fundamentally tied to their phone number. App operators have access to this, as well as user contacts. Additionally, with a simple modification to the app's source code, the contacts may also gain access in some cases. This should raise more concerns about privacy, and it makes the need for anonymity difficult to achieve.
-
Everyone has a different threat model (and if you don’t yet, now is a good time to create one). For many users today, WhatsApp and other apps may be sufficient for their specific needs, especially in connecting with families and friends who are already on the app and unlikely to migrate elsewhere. If that suits your life and needs, and if you’re aware and consciously accept the risks, great.
-
But we also need to acknowledge that the world is becoming increasingly dangerous in the way AI is being used to supercharge surveillance, and we need to be educated and aware of the risks this is already having on our lives and what it subjects others in your network to when you choose metadata-heavy apps as your primary form of communication. Having alternatives will always be important, even if it’s not what you default to for everyday messaging. Recognize who in your social circles might require the extra privacy, anonymity and security, so that you can play a role in protecting vulnerable individuals who need it most. The messaging app you choose implicates others as well, not just yourself, and while you personally may not require complete privacy, others might have their lives depend on it.
-
End-to-end encryption is a solid start, but it's just the beginning of our pursuit for true privacy and security. True privacy means that even when legal demands come knocking, there's no useful metadata to hand over. It's not enough to just protect the content of messages; we need consistent innovation in protecting metadata too.
-
Changing ingrained habits is tough, but your privacy is always worth the fight. Although giants like WhatsApp and Telegram may dominate global messaging for now, increasing concerns about data harvesting and AI-driven surveillance are fueling demand for alternatives. SimpleX Chat aims to be one of those strong alternatives, hence its radical focus on a decentralized framework with no user identifiers (in other words, nothing that uniquely identifies users on the protocol level to their contacts or to the relays) and extra optionality (self-hosting an SMP server or XFTP server, access via Tor, chat profiles with incognito mode, etc.)
-
As of today, most messaging alternatives, including SimpleX, will have some limitations. But with the limited resources we have, we are committed to daily progress towards creating a truly private messenger that anyone can use while maintaining the features that users have come to know and love in messaging interfaces. We want to be the prime example of a messenger that achieves genuine privacy without compromising it for convenience. We need to be able to reliably move away from small and niche use cases to endorsing and enforcing global standards for privacy and making it accessible for all users regardless of their technical expertise.
-
We’re grateful for the users and donors who have been following along on this journey thus far and helping with feedback, anything from bug reports to identifying potential risks. Building in the open has always been a necessity for transparency and ongoing auditability, because we don’t want anyone to just take our word for it. See for yourself and engage in the discussions. We fully expect you to hold us accountable to our word.
It's important not to be complacent with the current standards of messaging,
- where metadata aggregation is still normalized in apps falsely and dangerously marketed as "private".
- This is a post exploring the fundamental differences between privacy and security.
SimpleX Chat Protocol is a protocol used to by SimpleX Chat clients to exchange messages. This protocol relies on lower level SimpleX protocols - SimpleX Messaging Protocol (SMP) and SimpleX Messaging Agent protocol. SimpleX Chat Protocol describes the format of messages and the client operations that should be performed when receiving such messages.
+
SimpleX Chat Protocol is a protocol used by SimpleX Chat clients to exchange messages. This protocol relies on lower level SimpleX protocols - SimpleX Messaging Protocol (SMP) and SimpleX Messaging Agent protocol. SimpleX Chat Protocol describes the format of messages and the client operations that should be performed when receiving such messages.
Scope
The scope of SimpleX Chat Protocol is application level messages, both for chat functionality, related to the conversations between the clients, and extensible for any other application functions. Currently supported chat functions:
-
diff --git a/feed.atom b/feed.atom
index 037b404ca0..feae9a740a 100644
--- a/feed.atom
+++ b/feed.atom
@@ -4,7 +4,7 @@
It allows you to stay up to date with the latest Blogs from SimpleX Chat.
- 2024-04-16T00:00:00Z
+ 2024-04-04T00:00:00Zhttps://simplex.chat/SimpleX Chat
@@ -2266,42 +2266,6 @@ file ---> | XFTP | ------> XFTP ----&
<p>It’s worth noting that some private foundations operate on the VC model in supporting nonprofits, either by requiring Board seats or requesting that their funding be used towards very specific objectives not always in alignment with the organization’s values and mission. It’s also worth noting that <a href="https://www.engadget.com/2019-05-31-sex-lies-and-surveillance-fosta-privacy.html">some nonprofits</a> actually operate on the models of surveillance and censorship. Therefore, whether an organization or company is VC-backed or a nonprofit should not be the sole factor in deciding whether or not it is trustworthy. Actions are important, with full transparency being one of the most critical factors, and being fully open source being another to attract valid criticisms and audits to ensure any product or protocol lives up to its privacy and security promise. SimpleX Chat prides itself on being both transparent and open, on top of also being fully decentralized. If you’re new to it and eager to know more, you can start with <a href="https://github.com/simplex-chat/simplexmq/blob/stable/protocol/overview-tjr.md">this overview</a>.</p>
<p>Another important consideration is that the SimpleX network does have a plan that would rely on users' payments for specific or tailored services, and not on some other sources of revenue or funds (ads, etc.). Building anything that users would be willing to pay for requires substantially more time and resources, hence the VC route to establish a business model that doesn’t translate to the user being the product. But any business services need to be separate from SimpleX as a public interest technology. As outlined in this <a href="https://simplex.chat/blog/20240323-simplex-network-privacy-non-profit-v5-6-quantum-resistant-e2e-encryption-simple-migration.html">recent post</a>, I’ll be using my background in nonprofit governance structures to ensure that the SimpleX network protocols evolve under the stewardship of nonprofit entities in various jurisdictions, so that its continued evolution aligns more closely with the vision of community-driven, independent and decentralized governance. This would help create a necessary balance between different structures, in the same way many tech nonprofits also have for-profit subsidiaries to attract fee-for-service agreements to sustain their operations.</p>
<p>In summary: My decision to join Simplex Chat, despite my deep-rooted beliefs and skepticism towards VC funding, reflects a broader realization: that the fight for privacy, security, and decentralization in today’s web is multifaceted and sometimes requires us to depart from our comfort zones to explore sustainable paths for continuous growth and impact so that open source privacy tools and protocols are no longer “niche”, but universally accessible standards. As long as nothing in this journey compromises our moral principles and integrity, this will remain a very worthwhile goal to pursue.</p>
-
-
-
-
- The dangers of metadata in messengers
-
-
- 16 Apr 2024
- https://simplex.chat/blog/20240416-dangers-of-metadata-in-messengers.html
- <h1 id="the-dangers-of-metadata-in-messengers" tabindex="-1">The dangers of metadata in messengers</h1>
-<p><strong>Published:</strong> Apr 16, 2024</p>
-<p><em>By <a href="https://mastodon.social/@alshafei">Esra'a al Shafei</a></em></p>
-<p>In many countries around the world, phone numbers are attached to biometrics data and personal IDs. Telecommunications companies are either government owned or are heavily regulated, privately owned monopolies who comply with most government requests for backdoors or user data. The idea that today, we still need to give out our phone numbers as primary identifiers to be able to use the leading messaging apps should be frowned upon and actively challenged. It’s necessary to advocate for private alternatives in messaging that do not rely on user IDs of any kind - and yes, it’s possible.</p>
-<p>Messaging is still not where it needs to be. Privacy is confused with security, when both are not synonymous, and there are major gaps in helping users understand the fundamental differences.</p>
-<img src="https://simplex.chat/blog/images/20240416-whatsapp.jpg" class="float-to-right" width="38%" />
-<p>For example, while WhatsApp messages are <a href="https://faq.whatsapp.com/820124435853543">end-to-end encrypted</a>, let’s consider what you give up when you use it, per its own listings in app stores:</p>
-<ul>
-<li>App activity (app interactions, in-app search history, and other user-generated content)</li>
-<li>Location</li>
-<li>Financial information (user payment info and payment history)</li>
-<li>Contacts and their phone numbers</li>
-<li>Groups you’re a member of</li>
-<li>When you use the app and how often you use it</li>
-<li>Device and other IDs</li>
-<li>Personal info (email address, user IDs, phone number)</li>
-</ul>
-<p>This is called <a href="https://en.wikipedia.org/wiki/Metadata">metadata</a>. It reveals a wealth of information about you and your connections, and in the hands of a centralized monopoly, this can and does get misused in incredibly dangerous ways. Once such metadata is logged, it can create very detailed profiles about who you are, everywhere you’ve been, and everyone you’ve ever spoken to. In settling for apps that normalize this while giving you the illusion of privacy in their marketing, we are doing ourselves a disservice by accepting this as the default. Collectively, we aren’t doing enough to protect ourselves and our social graph from this invasive overreach.</p>
-<p>When stored, aggregated and analyzed, this metadata provides ample information that could potentially incriminate someone or be submitted to authorities. When WhatsApp and Facebook Messenger enabled end-to-end encryption for messages, of course it was a welcome and widely celebrated change. But it’s important to remember that not all end-to-end encryption utilizes the same standards, <a href="https://simplex.chat/blog/20240314-simplex-chat-v5-6-quantum-resistance-signal-double-ratchet-algorithm.html#how-secure-is-end-to-end-encryption-in-different-messengers">some implementations are more secure</a> than others, so it’s something that shouldn’t necessarily be accepted at face value. More importantly: collecting and storing an obscene amount of metadata should invite global scrutiny, considering this data is often combined with whatever other information companies like Meta harvest about your identity (which is <a href="https://www.vox.com/recode/23172691/meta-tracking-privacy-hospitals">a lot</a>.)</p>
-<img src="https://simplex.chat/blog/images/20240416-metadata.png" class="float-to-right" width="38%" />
-<p>This is one of the many reasons why we need to resist giving out our phone numbers just to access an app, especially to do something as personal and intimate as private messaging. Even though users can sometimes mask their numbers with a username, their identity on the app is still fundamentally tied to their phone number. App operators have access to this, as well as user contacts. Additionally, with a simple modification to the app's source code, the contacts may also gain access in some cases. This should raise more concerns about privacy, and it makes the need for anonymity difficult to achieve.</p>
-<p>Everyone has a different threat model (and if you don’t yet, now is a good time to <a href="https://www.privacyguides.org/en/basics/threat-modeling/#creating-your-threat-model">create one</a>). For many users today, WhatsApp and other apps may be sufficient for their specific needs, especially in connecting with families and friends who are already on the app and unlikely to migrate elsewhere. If that suits your life and needs, and if you’re aware and consciously accept the risks, great.</p>
-<p>But we also need to acknowledge that the world is becoming increasingly dangerous in the way AI is being used to <a href="https://www.forbes.com/sites/forbestechcouncil/2024/02/02/artificial-intelligence-the-new-eyes-of-surveillance/?sh=cd57bc214f27">supercharge surveillance</a>, and we need to be educated and aware of the risks this is already having on our lives and what it subjects others in your network to when you choose metadata-heavy apps as your primary form of communication. Having alternatives will always be important, even if it’s not what you default to for everyday messaging. Recognize who in your social circles might require the extra privacy, anonymity and security, so that you can play a role in protecting vulnerable individuals who need it most. The messaging app you choose implicates others as well, not just yourself, and while you personally may not require complete privacy, others might have their lives depend on it.</p>
-<p>End-to-end encryption is a solid start, but it's just the beginning of our pursuit for true privacy and security. True privacy means that even when legal demands come knocking, there's no useful metadata to hand over. It's not enough to just protect the content of messages; we need consistent innovation in protecting metadata too.</p>
-<p>Changing ingrained habits is tough, but your privacy is always worth the fight. Although giants like WhatsApp and Telegram may dominate global messaging for now, increasing concerns about data harvesting and AI-driven surveillance are fueling demand for alternatives. SimpleX Chat aims to be one of those strong alternatives, hence its radical focus on a decentralized framework with no user identifiers (in other words, nothing that uniquely identifies users on the protocol level to their contacts or to the relays) and extra optionality (self-hosting an <a href="https://simplex.chat/docs/server.html">SMP server</a> or <a href="https://simplex.chat/docs/xftp-server.html">XFTP server</a>, access via Tor, <a href="https://simplex.chat/docs/guide/chat-profiles.html">chat profiles</a> with incognito mode, etc.)</p>
-<p>As of today, most messaging alternatives, including SimpleX, will have some limitations. But with the limited resources we have, we are committed to daily progress towards creating a truly private messenger that anyone can use while maintaining the features that users have come to know and love in messaging interfaces. We want to be the prime example of a messenger that achieves genuine privacy without compromising it for convenience. We need to be able to reliably move away from small and niche use cases to endorsing and enforcing global standards for privacy and making it accessible for all users regardless of their technical expertise.</p>
-<p>We’re grateful for the users and <a href="https://github.com/simplex-chat/simplex-chat#help-us-with-donations">donors</a> who have been following along on this journey thus far and helping with feedback, anything from bug reports to identifying potential risks. Building in the open has always been a necessity for transparency and ongoing <a href="https://simplex.chat/blog/20221108-simplex-chat-v4.2-security-audit-new-website.html">auditability</a>, because we don’t want anyone to just take our word for it. <a href="https://github.com/simplex-chat">See for yourself</a> and engage in the discussions. We fully expect you to hold us accountable to our word.</p>
diff --git a/feed.rss b/feed.rss
index 90dfda4cfb..d7ceb777d2 100644
--- a/feed.rss
+++ b/feed.rss
@@ -6,43 +6,6 @@
It allows you to stay up to date with the latest Blogs from SimpleX Chat.en
-
- The dangers of metadata in messengers
- https://simplex.chat/blog/20240416-dangers-of-metadata-in-messengers.html
- <h1 id="the-dangers-of-metadata-in-messengers" tabindex="-1">The dangers of metadata in messengers</h1>
-<p><strong>Published:</strong> Apr 16, 2024</p>
-<p><em>By <a href="https://mastodon.social/@alshafei">Esra'a al Shafei</a></em></p>
-<p>In many countries around the world, phone numbers are attached to biometrics data and personal IDs. Telecommunications companies are either government owned or are heavily regulated, privately owned monopolies who comply with most government requests for backdoors or user data. The idea that today, we still need to give out our phone numbers as primary identifiers to be able to use the leading messaging apps should be frowned upon and actively challenged. It’s necessary to advocate for private alternatives in messaging that do not rely on user IDs of any kind - and yes, it’s possible.</p>
-<p>Messaging is still not where it needs to be. Privacy is confused with security, when both are not synonymous, and there are major gaps in helping users understand the fundamental differences.</p>
-<img src="https://simplex.chat/blog/images/20240416-whatsapp.jpg" class="float-to-right" width="38%" />
-<p>For example, while WhatsApp messages are <a href="https://faq.whatsapp.com/820124435853543">end-to-end encrypted</a>, let’s consider what you give up when you use it, per its own listings in app stores:</p>
-<ul>
-<li>App activity (app interactions, in-app search history, and other user-generated content)</li>
-<li>Location</li>
-<li>Financial information (user payment info and payment history)</li>
-<li>Contacts and their phone numbers</li>
-<li>Groups you’re a member of</li>
-<li>When you use the app and how often you use it</li>
-<li>Device and other IDs</li>
-<li>Personal info (email address, user IDs, phone number)</li>
-</ul>
-<p>This is called <a href="https://en.wikipedia.org/wiki/Metadata">metadata</a>. It reveals a wealth of information about you and your connections, and in the hands of a centralized monopoly, this can and does get misused in incredibly dangerous ways. Once such metadata is logged, it can create very detailed profiles about who you are, everywhere you’ve been, and everyone you’ve ever spoken to. In settling for apps that normalize this while giving you the illusion of privacy in their marketing, we are doing ourselves a disservice by accepting this as the default. Collectively, we aren’t doing enough to protect ourselves and our social graph from this invasive overreach.</p>
-<p>When stored, aggregated and analyzed, this metadata provides ample information that could potentially incriminate someone or be submitted to authorities. When WhatsApp and Facebook Messenger enabled end-to-end encryption for messages, of course it was a welcome and widely celebrated change. But it’s important to remember that not all end-to-end encryption utilizes the same standards, <a href="https://simplex.chat/blog/20240314-simplex-chat-v5-6-quantum-resistance-signal-double-ratchet-algorithm.html#how-secure-is-end-to-end-encryption-in-different-messengers">some implementations are more secure</a> than others, so it’s something that shouldn’t necessarily be accepted at face value. More importantly: collecting and storing an obscene amount of metadata should invite global scrutiny, considering this data is often combined with whatever other information companies like Meta harvest about your identity (which is <a href="https://www.vox.com/recode/23172691/meta-tracking-privacy-hospitals">a lot</a>.)</p>
-<img src="https://simplex.chat/blog/images/20240416-metadata.png" class="float-to-right" width="38%" />
-<p>This is one of the many reasons why we need to resist giving out our phone numbers just to access an app, especially to do something as personal and intimate as private messaging. Even though users can sometimes mask their numbers with a username, their identity on the app is still fundamentally tied to their phone number. App operators have access to this, as well as user contacts. Additionally, with a simple modification to the app's source code, the contacts may also gain access in some cases. This should raise more concerns about privacy, and it makes the need for anonymity difficult to achieve.</p>
-<p>Everyone has a different threat model (and if you don’t yet, now is a good time to <a href="https://www.privacyguides.org/en/basics/threat-modeling/#creating-your-threat-model">create one</a>). For many users today, WhatsApp and other apps may be sufficient for their specific needs, especially in connecting with families and friends who are already on the app and unlikely to migrate elsewhere. If that suits your life and needs, and if you’re aware and consciously accept the risks, great.</p>
-<p>But we also need to acknowledge that the world is becoming increasingly dangerous in the way AI is being used to <a href="https://www.forbes.com/sites/forbestechcouncil/2024/02/02/artificial-intelligence-the-new-eyes-of-surveillance/?sh=cd57bc214f27">supercharge surveillance</a>, and we need to be educated and aware of the risks this is already having on our lives and what it subjects others in your network to when you choose metadata-heavy apps as your primary form of communication. Having alternatives will always be important, even if it’s not what you default to for everyday messaging. Recognize who in your social circles might require the extra privacy, anonymity and security, so that you can play a role in protecting vulnerable individuals who need it most. The messaging app you choose implicates others as well, not just yourself, and while you personally may not require complete privacy, others might have their lives depend on it.</p>
-<p>End-to-end encryption is a solid start, but it's just the beginning of our pursuit for true privacy and security. True privacy means that even when legal demands come knocking, there's no useful metadata to hand over. It's not enough to just protect the content of messages; we need consistent innovation in protecting metadata too.</p>
-<p>Changing ingrained habits is tough, but your privacy is always worth the fight. Although giants like WhatsApp and Telegram may dominate global messaging for now, increasing concerns about data harvesting and AI-driven surveillance are fueling demand for alternatives. SimpleX Chat aims to be one of those strong alternatives, hence its radical focus on a decentralized framework with no user identifiers (in other words, nothing that uniquely identifies users on the protocol level to their contacts or to the relays) and extra optionality (self-hosting an <a href="https://simplex.chat/docs/server.html">SMP server</a> or <a href="https://simplex.chat/docs/xftp-server.html">XFTP server</a>, access via Tor, <a href="https://simplex.chat/docs/guide/chat-profiles.html">chat profiles</a> with incognito mode, etc.)</p>
-<p>As of today, most messaging alternatives, including SimpleX, will have some limitations. But with the limited resources we have, we are committed to daily progress towards creating a truly private messenger that anyone can use while maintaining the features that users have come to know and love in messaging interfaces. We want to be the prime example of a messenger that achieves genuine privacy without compromising it for convenience. We need to be able to reliably move away from small and niche use cases to endorsing and enforcing global standards for privacy and making it accessible for all users regardless of their technical expertise.</p>
-<p>We’re grateful for the users and <a href="https://github.com/simplex-chat/simplex-chat#help-us-with-donations">donors</a> who have been following along on this journey thus far and helping with feedback, anything from bug reports to identifying potential risks. Building in the open has always been a necessity for transparency and ongoing <a href="https://simplex.chat/blog/20221108-simplex-chat-v4.2-security-audit-new-website.html">auditability</a>, because we don’t want anyone to just take our word for it. <a href="https://github.com/simplex-chat">See for yourself</a> and engage in the discussions. We fully expect you to hold us accountable to our word.</p>
-
-
-
- 16 Apr 2024
- SimpleX Chat
- https://simplex.chat/blog/20240416-dangers-of-metadata-in-messengers.html
- Why I joined SimpleX Chat - by Esra'a al Shafei
https://simplex.chat/blog/20240404-why-i-joined-simplex-chat-esraa-al-shafei.html
diff --git a/fi/contact/index.html b/fi/contact/index.html
index 2e01737716..bc9f91193d 100644
--- a/fi/contact/index.html
+++ b/fi/contact/index.html
@@ -193,8 +193,6 @@
SimpleX Chat Ltd. is a company registered in the UK – it develops communication software enabling users to operate and communicate via SimpleX network, without user profile identifiers of any kind, and without having their data hosted by any network infrastructure operators.
-
This page will include any and all reports on requests for user data.
-
To date, we received none.
-
Our objective is to consistently ensure that no user data and absolute minimum of the metadata required for the network to function is available for disclosure by any infrastructure operators, under any circumstances.
For any sensitive questions please use SimpleX Chat or encrypted email messages using the key for this address from keys.openpgp.org (its fingerprint is FB44 AF81 A45B DE32 7319 797C 8510 7E35 7D4A 17FC) and make your key available for a secure reply.
-
-
-
-
- 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
-