Evgeny @ SimpleX Chat
d00513ed27
* docs: user guide for the 7.1 apps * docs, website: guide order, badge benefits, message expiry; soft line breaks on the site * docs: guide videos for the first profile, invitations, joining and the address * docs: guide screens with the iPhone status bar * docs: guide shows full and cut screens only * docs: guide pages corrected in place, keeping master's structure * docs: group chat and SimpleX address pictures in the iPhone frame * docs: plainer wording in the guide * docs: guide checked against how SimpleX explains its features * docs: guide answers on profiles, channel privacy, SOCKS and names * docs: android guide picture from the emulator in the pixel 7 frame
4.4 KiB
title
| title |
|---|
| Privacy & security |
Privacy and Security
SimpleX Chat default configuration aims to balance privacy, security and convenience. You may want to change the default options.
This page lists the main features and options that affect privacy and security.
Privacy and Security settings
These settings are available in Your privacy settings.
End-to-end encryption
Direct chats and groups are protected by end-to-end encryption. When a conversation starts, the app shows: "Messages, files and calls are protected by end-to-end encryption with perfect forward secrecy, repudiation and break-in recovery." In a direct chat with quantum resistant encryption, it shows quantum resistant e2e encryption instead.
Messages in channels are not end-to-end encrypted: "Chat relays can see these messages." See How channels work.
Security code verification
SimpleX Chat always establishes connection via link passed via an independent channel, so servers cannot substitute the encryption keys. In some scenarios, the invitation links can be substituted in transit (MITM attack). To protect against such attacks, you should verify the security code with your contacts:
- open the conversation with the contact
- tap the contact name in the chat toolbar
- tap "Verify security code"
- ask your contact to do the same
- the connection is secure if you and your contact have the same security code
This can be validated by one of the following:
- one of you can scan the security code from their device (iOS and Android), if the codes match the contact will be marked as verified on the device that scanned the code.
- simply tap mark verified if you trust the confirmation from your contact that the code is verified.
- you can also read the code over the voice call.
You can verify the security code of a group member in the same way, in the member's info.
Read more in this post
Database passphrase
When installed, the app generates a random passphrase for the chat database and stores it securely in Keychain (iOS) or using Keystore (Android, secure hardware is used when available). The desktop app offers to set your own passphrase when you create your first profile and, if you skip it, stores the random passphrase in the app settings as plaintext. You can set your own passphrase and also remove it from the device, in which case you will need to enter it every time you start the app, and notifications may be limited, in the Database passphrase & export settings.
Incognito mode
This feature generates a random profile name for a new contact or group, when you choose it for the connection. Read more in Incognito mode.
Hidden profiles
This feature allows to hide some of your chat profiles with the password. Read more in Hiding and muting chat profiles.
Network settings
Transport isolation (BETA) allows to isolate the traffic of each chat profile (by default) or your traffic with each contact in a different TCP connection (and Tor circuit, on Android and desktop).
Private message routing is used by default: "To protect your IP address, private routing uses your SMP servers to deliver messages."
Protect IP address, in Your privacy > More privacy, makes the app ask you to confirm downloads of files from unknown file servers, unless you use a SOCKS proxy or the .onion address of the server. It is on by default.
Using Tor
To connect to SMP relays (messaging servers) via Tor you need to install Orbot app or another app that provides a SOCKS proxy to Tor network.
Android: use Orbot app as SOCKS proxy on port 9050 (default) and enable Use SOCKS proxy.
Desktop: use a SOCKS proxy to Tor network in the same way.
iOS: use Orbot app as VPN provider and enable VPN, or set a SOCKS proxy to Tor in Advanced network settings.
You can also change which server addresses are used with Use .onion hosts option.
Calls connect without the SOCKS proxy.