> What do you think is the most promising tool for this sort of communication? I've been hearing about Riot/Matrix; do you think that's a good option for people to use?

> I'm not talking about an ultra-high-risk situation, just I'd rather not announce who I am when I'm interacting with people I don't know that well.

In that case, yes, with some caveats.

Be mindful of your list of Matrix devices because that is something all participants can see. Otherwise, Matrix will allow you preserve basic anonymity with respect to the other participants (but not with respect to the server) with solid encryption.

Also bear in mind that Matrix is built on the premise of storing all messages server-side indefinitely by default (in end-to-end encrypted form and with regular key rotation so forward secrecy is preserved).

Of course, forward secrecy does not help if the participants retain all keys indefinitely and subsequently leak them. I think disappearing messages are in the works.

For a specific, common usecase, what should be used for submitting security bugs for software?

Another concern I have with the proposed replacments is many (Signal, Keybase, etc.) depend on a single centralized service.

The idea with Keybase (can't speak for signal) is that your client doesn't need to trust the server. You only need to trust that your client isn't compromised, which is easier to verify.

Sure (and that's true for signal as well), that's not my point. My point is you have to rely on that service being available. And you need to trust it to deliver and (at least with keybase) persist your encrypted data. And if that service becomes as prevalent as email, that gives the organization that controls it a lot of power.

"I'm still looking for a solution for the situation when I'm trying to communicate without revealing my identity to the person I'm talking with."

This exists. In the past, it took the form of an "anon.penet.fi" email address. This was a very simple, useful service[1] that many people used to great advantage.

In modern times, you can see this very same concept used at craigslist wherein CL maps your email address to a random craigslist email address, allowing you and another party to have painless email back-and-forth without leaking identity.

Now that I am thinking about it, you could set up a simple SMS remailer with codes that would allow the same thing to happen.

None of this addresses secure comms, but that's not the question you asked ...

[1] A "remailer".

> In modern times, you can see this very same concept used at craigslist wherein CL maps your email address to a random craigslist email address, allowing you and another party to have painless email back-and-forth without leaking identity

CL implementation is flawed and only gives perception of privacy. I forget the header/tech name for it, but if you hit reply and your email account is set to “First Last <[email protected]>” it will pass along that entire string to the recipient in the body of the email. The obfuscation is only in the actual email address the message goes through

And in some countries getting burner phones is very hard. The phone number requirement removes Signal as a serious option for many.

One option is XMPP with OTP or OMEMO encryption. XMPP IDs are similar to email addresses, it's easy to set up a server, and there are lots of public servers you could get an account on as well.

Keybase is the best encryption tool around and you can tie it to a pseudonymous identity